Who processes your data (subprocessors)
A subprocessor is another company that processes data on ListPlus's behalf to run part of the product — hosting your lists, verifying an email, or taking a payment. This page lists ListPlus's subprocessors by category. The complete, current list with every provider's name, seat, the data it receives, its third-country safeguard and the workspace switch that stops the transfer is published at listplus.ai/en/subprocessors (German: listplus.ai/de/subprocessors) — it is the same list as Annex 3 of the DPA.
Hosting and file storage#
Vercel, in the EU region Frankfurt. Runs the ListPlus application, stores your lists and uploaded files, and collects usage and performance statistics.
Working data store#
A database used for fast reads while you work in a list, located in the EU (Frankfurt region). It is separate from the long-term storage above.
Data providers (lookups)#
When you enrich or search for a contact, the specific provider for that lookup — Prospeo, FullEnrich, CompanyEnrich, MillionVerifier, Crustdata, a specialised LinkedIn data provider, or Google search (also used for the web searches in AI Research) — receives only the identifier needed (an email, domain, LinkedIn URL, a name and company, or a company name), never your whole list. Crustdata receives only a company domain: it finds a company's LinkedIn page and checks watched companies for new funding rounds. See "Where does the data come from?" for which provider handles which lookup.
Data collection for imports and AI Research#
A data-collection platform runs LinkedIn imports (Sales Navigator, Company Employees and others), Crunchbase company lookups (the Crunchbase page is found with a Google search for the company name), and the optional Reddit and X sources in AI Research. Algolia powers the optional Hacker News search in AI Research. They receive the search URL, the company URL or the research query, never your list.
Email service (inbound and outbound)#
When you forward an email to your personal Inbox forwarding address, an email service receives it first and passes the message to ListPlus, which keeps the body and supported attachments as Inbox entries (see "Where is my data stored?" for how long). It only processes mail sent to that one address, never your regular mailbox.
The same email service also sends the emails ListPlus sends on your behalf from notifications@listplus.ai: workspace invitations (the invitee's address, your name and the workspace name) and the digest mails of an Team email pipeline (the recipients' addresses and, per entry, name, position, company and links). It also delivers a help chat conversation you send to support with "Send to support". It doesn't send the one-time login codes; those come from the sign-in service below.
AI model providers#
AI model providers process the text ListPlus's AI features send them (commands, checks, AI Column, AI Research, Inbox recognition). See "What the AI sees of your data" for exactly what each request includes.
Authentication#
A sign-in service handles your email address and sends your one-time login codes by email. If you choose "Sign in with Google", Google confirms the sign-in and learns that you sign in to ListPlus.
Usage analytics and error logs#
PostHog (EU cloud, Frankfurt) receives pseudonymous usage events — which feature was used when, with a hashed account id and your plan. It never receives names, email addresses or list contents. You can turn it off under Settings → Profile & sign-in → Usage evaluation, and a workspace owner can switch it off for everyone in the Workspace policy. Server logs stay with our host Vercel; an error in your browser is only counted (on which kind of page), without the error text.
Realtime updates#
A messaging service delivers live status updates to your browser (for example, when an import or enrichment finishes).
OAuth connector#
When you connect a CRM, spreadsheet or other tool (HubSpot, Salesforce, Pipedrive, Attio, Google Sheets, Airtable, Notion, Slack, Lemlist, Instantly and others), a dedicated connector service holds those login credentials — ListPlus itself doesn't store those logins. The connector service also carries the records you import, sync or send to a connected tool, and the events of App events (form answers, bookings, messages).
Account emails#
When you sign up, ListPlus adds you to its CRM system: your email address and user ID, later your plan and key account events (sign-up, first list, first enrichment, first flow, joining a workspace, buying a plan or credits, cancelling) — never the contents of your lists. The CRM system sends you a welcome email about your new account; it is part of your account, not advertising. Deleting your account deletes these entries; only your email address stays on a suppression list so you are never contacted again.
Account record#
Your account, your workspaces and your plan are kept in ListPlus's own working data store in the EU (Frankfurt region). When you pay, Stripe notifies ListPlus, which sets the purchased plan on your account.
Payment#
Subscriptions and credit packs are sold through Stripe Managed Payments. Sold Through Link, LLC (South San Francisco, USA), a Stripe company, handles the sale for us as merchant of record: it runs the checkout, calculates and collects the VAT, issues receipts and invoices, handles refunds and payment questions, and keeps your Link account if you create one. Stripe processes the payment (in the EU, Stripe Technology Europe, Limited), screens it for fraud and handles disputes. For the purchase and the Link account, Link and Stripe decide for themselves how they use the data; their own privacy notices apply.
Some subprocessors process data outside the EU. The safeguard for each transfer is on listplus.ai/en/subprocessors.
Switching a provider off#
A workspace owner can switch off individual providers and features for the whole workspace under Settings → Privacy & compliance → Workspace policy. The public list names the switch for each provider.
Related topics: where-does-the-data-come-from · where-is-my-data · dpa-avv.
FAQ#
Which other companies process my data?#
Each subprocessor handles one part of the product: hosting (Vercel, EU Frankfurt), a working data store, the data provider of a lookup, a data-collection platform for imports and AI Research, an email service, AI model providers, sign-in, usage analytics and error logs, realtime updates, a connector for connected tools, account emails, an account record and payments (Stripe). The complete list with every name and seat is at listplus.ai/en/subprocessors.
Who processes emails I forward to my Inbox?#
An email service receives mail sent to your personal Inbox forwarding address and passes the message to ListPlus, which stores the body and supported attachments as Inbox entries. It only sees mail sent to that one address, never your regular mailbox.
Which company hosts ListPlus?#
Vercel, in the EU region Frankfurt. ListPlus's application and your uploaded files run and are stored there.
Do data providers see my whole list when I enrich a contact?#
No. A data provider (such as Prospeo, FullEnrich or CompanyEnrich) receives only the identifier needed for that one lookup — an email, domain, LinkedIn URL, or a name and company — never the rest of your list.
Who manages my login when I connect a CRM or Google Sheets?#
A dedicated connector service holds those credentials on ListPlus's behalf. ListPlus itself never stores or sees your CRM or Google login. The connector service also carries the records you import, sync or send to that tool.
Who stores my email address when I sign up?#
ListPlus's CRM system stores your email address, user ID, plan and key account events (never list contents) and sends your welcome email. Your account itself, with the plan you bought, stays in ListPlus's own data store in the EU.
Which company handles payments?#
Stripe, through Stripe Managed Payments: Sold Through Link, LLC, a Stripe company, handles the sale for us as merchant of record and is the name on your checkout and invoice, and Stripe processes the payment, for subscriptions and credit packs on every plan.
Does ListPlus use its own database, or another company's?#
ListPlus uses a working data store, hosted in the EU (Frankfurt region), for fast reads while you work in a list, separate from the long-term file storage on Vercel.
Which AI provider processes ListPlus's AI features?#
AI model providers process the text ListPlus's AI features send them. See "What the AI sees of your data" for exactly what's included in a request — never your whole list.
Is there a complete subprocessor list with exact locations for every provider?#
Yes. The complete list with every provider's name, seat, the data it receives, its third-country safeguard and the workspace switch that stops it is published at listplus.ai/en/subprocessors. It is the same list as Annex 3 of the DPA.
Who sends workspace invitations and pipeline emails?#
The same email service that receives forwarded Inbox mail sends them, from notifications@listplus.ai. It processes the recipients' email addresses and the mail content — for an invitation your name and the workspace name, for a pipeline digest each entry's name, position, company and links. Login codes are sent separately by the sign-in service.
Does ListPlus track how I use the app?#
ListPlus sends pseudonymous usage events (which feature was used when) to PostHog in its EU cloud — never names, email addresses or list contents. Turn off Usage evaluation under Settings → Profile & sign-in, or, as workspace owner, switch usage events off for the whole workspace in the Workspace policy.
Can I stop ListPlus from sending data to a specific provider?#
Yes. The workspace owner can switch off individual data providers and features under Settings → Privacy & compliance → Workspace policy; no member and no agent can use them afterwards. listplus.ai/en/subprocessors names the switch for each provider.