Privacy Policy

1. Controller

salesperformer GmbH Sperberweg 7 82152 Krailling Germany Phone: +49 (0)89 28741023 Email: support@listplus.ai Commercial register: Amtsgericht München, HRB 189481 Managing Director: Stephan Methner

For any data protection question and to exercise your rights, contact us at support@listplus.ai.

2. Data protection officer

We are not required to appoint a data protection officer (Art. 37 GDPR, Section 38 BDSG). Please send data protection requests to support@listplus.ai.

3. Overview: our role in processing your data

Depending on your relationship with ListPlus, we process your data in different roles:

• Website visitors (listplus.ai): we are the controller for the data arising when you visit the website (sections 4 and 5).
• Users of the application (customers and their staff with their own account): we are the controller for account, contract, billing, usage and support data (sections 6 to 10).
• People in customer lists: personal data that customers upload, import, create, enrich or forward to the Inbox is processed by us on behalf of that customer as a processor under Art. 28 GDPR. The customer is the controller (section 11).
• People whose business contact data is retrieved through ListPlus: when customers retrieve contact or company data from data providers through ListPlus, section 13 gives you the information required by Art. 14 GDPR about the sources and the processing.
• Visitors who look at the application without an account: they see the interface and the sample list with invented data; searches, enrichments and everything that retrieves third-party data require an account. Section 4 applies to these visitors.

4. Visiting the website and hosting

The website and the application are hosted by Vercel Inc. (440 N Barranca Ave #4133, Covina, CA 91723, USA); servers and file storage are located in the EU region Frankfurt am Main. When you open a page, Vercel processes technically necessary connection data: IP address, date and time, requested URL, referrer, browser and operating system information and status codes (server log files).

Purpose: delivering the website, stability, security and abuse prevention. Legal basis: Art. 6(1)(f) GDPR (legitimate interest in a secure, working service). Retention: server log files are deleted after at most 30 days unless needed longer to investigate a security incident.

Although servers and file storage are in the EU, data may also be transferred to the USA by Vercel itself, as Vercel is a US company and uses subprocessors. Vercel is certified under the EU-U.S. Data Privacy Framework; in addition we have concluded a data processing agreement with Standard Contractual Clauses with Vercel (see sections 15 and 16).

5. Cookies, local storage and analytics

We do not use advertising or tracking cookies, and no cookies from ad networks or social networks. We use the following cookies and entries in your browser's local storage (localStorage):

Legal basis: storing and reading this information on your device is based on Section 25(2) no. 2 TDDDG (German Telecommunications Digital Services Data Protection Act) where it is strictly necessary to provide the service you explicitly requested (sign-in, language setting, application settings, the AI help's conversation). The subsequent processing is based on Art. 6(1)(b) GDPR (user agreement) or Art. 6(1)(f) GDPR.

Reach measurement, usage events and error logs

Website: we use Vercel Web Analytics and Vercel Speed Insights to measure reach and page speed. These services work without cookies and without cross-device profiles. They record pages visited, referrer, approximate country-level location, device type, browser and operating system, and load times; to distinguish visits, a hash derived from request data is used and discarded daily.

Application: which features are used when, we count with PostHog (PostHog Inc., EU cloud in Frankfurt). Each event carries a pseudonym of your account (a hash of the user ID, not reversible), the plan, a hash of the workspace, the event and its properties (e.g. “list created”, “enrichment started”, the number of rows) — never names, email addresses or the contents of your lists. PostHog sets no cookies for us and records no sessions. You can switch usage measurement off in your account settings; a workspace owner can switch it off for all members (workspace policy). Independently of that, we keep daily counters without any personal reference (how often a feature was used).

Error logs: the logs of our servers are kept by our host Vercel. When an error happens in your browser, we only count on which kind of page it happened (as a usage event at PostHog, see above) — without the error text; the error itself does not leave your browser.

Purpose: improving the website and application, error analysis. Legal basis: Art. 6(1)(f) GDPR (legitimate interest in designing our service to meet demand and in running it reliably). Recipients: Vercel Inc., PostHog Inc. (see section 15).

Third-party content your browser loads

In a few places your browser loads content directly from third parties, which thereby learn your IP address: explainer videos on the application's start page from Wistia (only after a click), map tiles from OpenStreetMap in the contact view (with the coordinates of the company shown, not yours), icons from jsDelivr, and profile pictures of people directly from LinkedIn or the data provider. Legal basis: Art. 6(1)(f) GDPR.

Stripe and Link payment pages

When you subscribe to a plan or buy credits, you are redirected to a Stripe Managed Payments checkout page (checkout.stripe.com) on which Sold Through Link, LLC acts on our behalf as merchant of record (section 8); to manage the subscription we take you to the Stripe customer portal, and you can also manage orders at link.com. The privacy notices of Stripe and Link apply there; Stripe and Link set their own cookies there, among other things for fraud prevention.

6. Registration, sign-in and user account

To use ListPlus you create an account with your email address. You sign in with your email address and a one-time passcode we send you by email, or with “Sign in with Google”; we do not store a password. The sign-in service is operated for us by Hanko GmbH, Kiel, Germany (hosted in the EU); a session lasts 30 days. If you choose to sign in with Google, Google LLC (USA) confirms your identity and sends us your email address and your Google account ID; Google learns that you sign in to ListPlus (third-country safeguard: EU-U.S. Data Privacy Framework). We process your email address, optionally your name, an internal user ID, the sign-in method, the times of registration and sign-in, and technical session data.

Purpose: setting up and securing your account. Legal basis: Art. 6(1)(b) GDPR (contract or pre-contractual steps). Retention: for the duration of the user relationship; after the account is deleted, the data is deleted unless statutory retention obligations apply.

7. Providing the application and performing the contract

When you use ListPlus, we process your account data, your plan, your credit balance and its transactions (purchases, usage per action, refunds), settings, the lists, folders and saved contacts you create, API connections and their execution logs, as well as technical logs for error analysis and abuse detection.

Purpose: providing the contractual services, billing credits, security and abuse prevention (e.g. rate limits). Legal basis: Art. 6(1)(b) GDPR; for security and abuse prevention Art. 6(1)(f) GDPR.

For a fast working data store we use Redis Cloud (Redis EMEA Ltd., London), hosted in the Frankfurt region (AWS eu-central-1). For live status updates in the browser (e.g. “import finished”) we use the realtime service Pusher (Pusher Ltd.) (London; servers in Ireland); it transmits event and status information about your operations.

For managing your account, the following also applies:

• On sign-up, we add you to our CRM system Attio: your email address and your user ID. There we also note your plan and key events of your account — sign-up, first list, first enrichment, first flow, joining a workspace, buying a plan or credits, cancelling — and the progress they add up to (a stage and a score, e.g. “Enriched”, 40 of 100), so we see how far you use ListPlus. The contents of your lists never go there. The CRM system sends a welcome email.
• On a purchase, Stripe reports it to an interface of our service; we record the purchased plan or credits on your account.

Purpose: managing your account and plan, sending the welcome email to get you started, and looking after our customers (e.g. help getting started, questions about the plan or a cancellation). Legal basis: Art. 6(1)(b) GDPR (performance of the user agreement); for the account events in the CRM Art. 6(1)(f) GDPR (legitimate interest in looking after our customers). When you delete your account, we delete these entries too; only your email address stays there on a suppression list so that we never contact you again (Art. 6(1)(f) GDPR). The welcome email is purely a greeting and onboarding message about your account, not advertising. We only send newsletters or promotional emails with your explicit consent (Art. 6(1)(a) GDPR), which you can withdraw at any time.

Workspaces and invitations

You work in workspaces. Lists, Watchlist, Inbox, research runs, pipelines and connected systems belong to the workspace and every member sees them; plan and credits belong to the workspace owner. Whoever invites a member triggers an email to the invited address with the inviter's name and the workspace name, sent via Postmark (section 14) from notifications@listplus.ai; an invitation expires after 14 days. The owner can switch features and data providers off for all members in the workspace policy; the current policy can be viewed in the workspace settings and exported as a text file. Legal basis: Art. 6(1)(b) GDPR; for the invitation email to a person not yet registered, Art. 6(1)(f) GDPR (the inviter's interest in working together).

8. Payments and invoices

We sell plans and credit packs through Stripe Managed Payments. The sale is handled on our behalf by the merchant of record Sold Through Link, LLC (formerly Lemon Squeezy, LLC), 354 Oyster Point Boulevard, South San Francisco, California 94080, USA, a Stripe company; payments are processed in the EU by Stripe Technology Europe, Limited and in other regions by another Stripe group company. Link calculates, collects and remits VAT (or sales tax or GST), issues invoices, receipts and refund notices and sends them to you by email, handles requests about payments and refunds (support.link.com) and gives you your order history and management of subscription, payment method and billing address at link.com; Stripe handles payment disputes and screens payments for fraud.

Data: In the checkout you enter your name, email address, billing address and payment data directly with Stripe or Link; you can create a Link account or pay as a guest. We pass your email address, your user ID and the purchased product and price to Stripe. We do not receive full card or account details from Stripe, only customer and payment status information (customer and transaction IDs, email address, amount, currency, tax amount, status, plan) and invoice data.

Responsibility: Link and Stripe are independent controllers for the purchase, invoicing, tax, payment processing, fraud prevention and the Link account; the privacy notices of Link and Stripe apply. You can ask Stripe or Link to delete the data of your Managed Payments purchases and your Link account. We process the data we receive from Stripe to activate your plan and credits and to keep our accounts. Under its terms Stripe alone determines the purposes and means of this processing (Stripe Managed Payments Terms, section 6.1; Stripe's data processing agreement, “Stripe as controller”); there is no joint controllership. Privacy notices: stripe.com/privacy and link.com/privacy.

Third-country transfer: Sold Through Link, LLC and Stripe, LLC are based in the USA; the data of your purchase is therefore transferred to the USA. The basis is Stripe's Data Transfers Addendum: primarily the EU-U.S. Data Privacy Framework (Art. 45 GDPR; Stripe, LLC is certified), otherwise the EU Standard Contractual Clauses (Art. 46(2)(c) GDPR). The addendum also covers Stripe's affiliates, including Sold Through Link, LLC.

Legal basis: Art. 6(1)(b) GDPR (performance of contract) and Art. 6(1)(c) GDPR (tax and commercial law obligations). Retention: we keep accounting records for the statutory periods (Section 147 AO, Section 257 HGB: 8 years for vouchers, 10 years for books and annual accounts); how long Link and Stripe keep data is set out in their privacy notices.

9. Support by email and AI help

When you contact us by email (support@listplus.ai), we process your message, your contact details and, where you have an account, your user ID, name and email address so we can match your account. There is no chat with staff in the application; questions are answered there by the AI help (see below), which can pass a conversation on to our support by email.

Legal basis: Art. 6(1)(b) GDPR where your request concerns the contract, otherwise Art. 6(1)(f) GDPR (legitimate interest in answering requests). Retention: until the request is fully resolved, then 24 months for traceability, unless statutory retention obligations apply.

AI help (“Ask ListPlus”)

In the application's help window and via the “Questions about ListPlus?” button on our website you can ask questions about ListPlus. The answers are given by an AI model, not a person; it answers only from our help texts and our product description. When you ask a question, we transmit to our servers and from there to the AI provider OpenAI (section 12): your question, the latest messages of the current conversation, the interface language and the address of the page you are on (without search parameters). For signed-in users the workspace's plan and credit balance are added so that the answer fits, and — when you ask in an open list — counts of that list (e.g. the number of rows, of rows with an email address or a company, of duplicate or invalid email addresses). The contents of your lists — names, addresses or other values, including the list's name — are not transmitted. Please do not enter personal data of third parties into your questions.

The conversation is kept in your browser until you close the tab. In addition we store every question and its answer for 30 days, to check the quality of the answers and to improve our help texts. These entries contain the text of your question, the answer, the language, the page address and whether the question came from a signed-in user (with their plan) or a visitor — but no user ID, no email address and no IP address. We also count how many questions are asked and how they were answered (answered, nothing found, not about the product). To limit misuse we count the questions per day: for signed-in users under the user ID, for visitors without an account under a shortened hash of the IP address; these counters contain no question text and are deleted after two days at the latest.

If the AI help cannot help, signed-in users can send the conversation to our support with one click (“Send to support”). We then receive by email the conversation, what you add, your email address, workspace, plan, the page you were last on and the browser identifier; a copy goes to your account's email address. The email is sent via Postmark (section 14).

Legal basis: Art. 6(1)(b) GDPR (help as part of the application, or pre-contractual information at your request); for the counters that limit misuse and for storing questions and answers for 30 days Art. 6(1)(f) GDPR (legitimate interest in protecting the service and in improving the answers). The owner of a workspace can switch off the AI functions, and with them the AI help, for their workspace (workspace policies).

10. Connections to other systems

When you connect a CRM, spreadsheet or other tool (e.g. HubSpot, Salesforce, Pipedrive, Google Sheets, Airtable, Notion, Lemlist, Stripe, or as an import source Apollo, Phantombuster, Intercom, Zoom, Calendly), the connector service Pipedream, LLC (San Francisco, USA) manages the login credentials (OAuth) on our behalf; ListPlus itself does not store them. Requests to and transfers into the connected system run wholly or partly through Pipedream's proxy service; the transferred records pass through Pipedream's servers. Which data is transferred is determined by your actions (import, export, pipeline target); a reference list reloads from its source regularly at your request. Destinations you connect with your own API key (e.g. Instantly, Smartlead, your own webhook endpoint) we reach directly; we store the key encrypted. Legal basis: Art. 6(1)(b) GDPR; section 11 applies to the content.

Email drafts: When a customer sets up a pipeline with the target “Email draft”, ListPlus uses this connector service to create one draft per contact in the connected mailbox (Gmail or Outlook) of the person who sends (for automatic sending: the person who set up the pipeline): the contact's address and name, subject and text from the customer's template. ListPlus does not send any email; whether and when a draft is sent is decided by the user in their mail program. We read the sender's name from the connected mailbox. We store the draft's identifier and a link to it on the record (“Open in mailbox”) and, per pipeline, the email addresses a draft already went to, so that nobody gets two drafts of the same pipeline — until the pipeline is deleted. The content of the mailboxes is not read. The owner of a workspace can switch email drafts off for all members (workspace policy), independently of the other connected systems. Legal basis: Art. 6(1)(b) GDPR; section 11 applies to the contact data.

Your own AI: Agent API, MCP and research link

You can connect an AI system of your choice (e.g. ChatGPT, Claude or your own agents) to ListPlus through a connection per list (REST at listplus.ai/d/…, MCP at listplus.ai/mcp/…) or through a research link (listplus.ai/r/…). That AI system then reads and writes what the connection exposes (columns, sublists, permitted actions); every call is logged with action, rows, credits and duration (the last 50 calls per connection, deleted one day after the last call). The provider of that AI system is your recipient, not our service provider: which data it receives and how it treats it is determined by your choice of provider and the scope of the connection. The access key is part of the address path and therefore appears in the access logs of our hosting provider.

11. Customer data: ListPlus as processor

Personal data that customers process in ListPlus — such as lists from file imports, imports from LinkedIn or connected systems, enrichment results, saved contacts and Inbox entries — is processed by us on behalf of and on the instructions of the customer (Art. 28 GDPR). The customer is the controller of this data and of its use, for example for sales outreach. Data subjects should address their requests to the company using their data; if such a request reaches us, we forward it to the customer where possible.

The data processing agreement (DPA) at listplus.ai/dpa applies and is part of the user agreement for customers on every plan. A signed copy is available on request at support@listplus.ai.

Retention: lists are stored until the customer deletes them; deletion is immediate and permanent. Some areas are deliberately time-limited: Inbox entries are deleted 14 days after arrival, shared result links stop working 7 days after they were created, AI research runs are deleted 1 to 7 days after they start (the user's choice; a run that hands its hits to a list, 30 days), profiles that were only viewed (not saved or enriched) drop out of “Recently viewed” after 30 days without further activity, and a pipeline’s history (records sent to a destination the customer chose, with the destination’s response) is deleted 30 days after sending. Watchlist entries, contacts from the Outlook add-in and form submissions stay until the customer deletes them.

Deleting the account: you delete your account yourself in the settings (“Delete account”). We then delete your account, every workspace you own with all its lists, files, pipelines, inboxes, research runs and watchlists, your personal data in our database and your pseudonym at PostHog with its events; running subscriptions are cancelled. What remains: invoices and the customer record at Stripe (statutory retention), a Link account if you created one when buying (it belongs to Link; you request its deletion there), data you created in workspaces owned by others (it belongs to that workspace), logs at the hosting and logging providers until they expire (without user ID), the message history at the email service (45 days), and the cross-customer caches without personal reference. A 30-day marker prevents a still-valid sign-in session from recreating the account.

12. AI processing

ListPlus uses AI models to understand commands, check and judge data, fill AI columns, detect columns on import, recognise Inbox entries and webhook records, transcribe dictation, run research and — when the customer sets it up or clicks for it — write and check texts for email drafts and suggest the company knowledge from the customer's website. The calls are made exclusively from our servers, never from your browser; the AI provider receives the part of the data the task needs — for checks only distinct values, for the features named below also whole texts or records:

• Commands and questions: your text, column names and types, row count and sublist names; only when a command needs values, the distinct values of the columns involved (duplicates removed).
• AI checks and judge columns: only the distinct values or value combinations of the columns involved (e.g. job title, city and country); a verdict is cached for 30 days, without the value itself.
• AI text columns: the prompt you wrote with the values of the columns it names from the respective record (up to 2,000 characters), once per distinct combination.
• List webhooks and forms: unknown field names with one sample value each, so the column can be mapped; on request a spam check with up to 12 fields of 120 characters per record.
• Dictation: the audio recording of your voice input (up to 3 MB) to turn it into text.
• Column detection on import: column headers and a sample of example values (10% of the file, at least 50 and at most 200 rows).
• Inbox: To recognise people and companies in a longer entry, its text is sent to OpenAI: for forwarded emails, the email body and the text extracted from supported attachments (e.g. PDF), cut to at most about 24,000 characters. Structured entries (vCards, calendar invitations, CSV and JSON data) are read without AI extraction. Short entries (e.g. a signature line) and the recognised contact details (name, position, company, email address, location) are sent to Groq or to a model via the Vercel AI Gateway for classification and a plausibility check; to confirm a person or company, a Google search with name and company may be run (section 13).
• AI Research: your search description, or the known identity details of a person (name, company, job title, location), to search public web sources.
• AI help: your question to the help with the latest messages of the conversation, language and page address, for signed-in users plan and credit balance (section 9) — also from website visitors without an account.
• AI texts in email drafts: only when the customer puts an AI text into the template of an “Email draft” pipeline. Then the AI provider receives, for each draft, the template's instructions, the briefing, the workspace's company knowledge, the sender's name and the data of the record including its enrichment data (e.g. position, career, former employers, company data, each with its date) — without email addresses and phone numbers. Without an AI text in the template no contact data is sent to an AI provider. We keep the result for one day in the workspace so the same text is not generated twice.
• Check content: only on a click on “Check content”: subject, text and signature of the template with placeholders (no contact data), the briefing and the workspace's company knowledge.
• Company knowledge from the website: only on a click on “Suggest” in the settings (Company knowledge): ListPlus fetches the customer's website — the home page and up to four linked public pages, no legal or login pages — and sends their text for evaluation. We store the company knowledge (information about the customer's own company, its products, audiences and proof) in the workspace until the customer changes it or deletes the workspace.

Providers: OpenAI (language models and transcription; requests are sent with the “do not store” setting and, according to the provider, not used for training; contracting entity: OpenAI Ireland Ltd., Dublin; Standard Contractual Clauses), Groq UK Limited (London, processing in the USA; a fast model for short single calls) and TypeSafe AI (judgement model “Jev”, connected through the AI Gateway of Vercel Inc., without storage at the provider; TypeSafe AI, Inc., USA). Seat, data location and safeguard per provider are in section 15. A workspace owner can switch all AI features off for the workspace (workspace policy); no AI provider is called then. Legal basis: for customer data we act as processor (section 11); otherwise Art. 6(1)(b) GDPR. No automated decision-making with legal or similarly significant effects within the meaning of Art. 22 GDPR takes place; AI results (including judgements such as seniority or a “fit” score in research) are suggestions that the user reviews and applies. The research fit score describes how well a hit matches the customer's search description; a workspace owner can switch this rating off (workspace policy), after which no hit is rated.

13. Data providers and data enrichment (information under Art. 14 GDPR)

ListPlus lets customers search for, complete and verify business contact and company data. This data does not come from ListPlus itself — ListPlus owns no contact database of its own — but is retrieved at the moment of the request from specialised data providers or from publicly available sources. If your business contact data has been retrieved through ListPlus, this section informs you about the processing.

Categories of data

Name, job title and seniority, company and company data (industry, size, location, website, funding, technologies), business email address and its deliverability status, business phone number and, where applicable, mobile number, LinkedIn profile URL, location, and publicly visible profile details (e.g. career history, past employers) as well as public posts, comments or reactions where a customer retrieves them. In AI research, in addition: the source (URL), a short piece of evidence (e.g. the comment that led to the hit) and an estimate of how well the person matches the search description (“fit”, 0–100, with a reason).

Sources

The data comes from data providers that run their own databases of business contacts — Prospeo (contact database, email and phone), FullEnrich (email and phone), CompanyEnrich (company data), Crustdata (company identification by domain, funding rounds of watched companies; only the domain), MillionVerifier (deliverability), HarvestAPI and Enrich.so (publicly visible LinkedIn data), Serper (Google search results) — and from publicly accessible sources that a service reads at the customer's request: LinkedIn (search results, employee lists, posts, comments and reactions, profile search including by past employer), Crunchbase company pages, Reddit, X, Hacker News (search via Algolia, only the search term), Google Maps profiles, web traffic estimates and arbitrary websites, also to find contact details. These public sources are read by the data collection platform Apify (Prague) with third-party programs (“actors”); the platforms themselves are not our contracting partners. The complete, current list with seat, data transmitted and safeguard is at listplus.ai/en/subprocessors, Part B.

The data providers are responsible for their own data sets; information on their processing is available in their respective privacy notices. A workspace owner can switch individual providers and sources off for the workspace (workspace policy).

Purposes, recipients and legal basis

The data is retrieved when a customer triggers a specific search or enrichment and is provided only to that customer, who uses it for their own business purposes (e.g. sales, maintaining CRM data). We send the data provider only the search key needed for the lookup (e.g. email address, domain, LinkedIn URL, name and company, or search filters), never the rest of the customer's list. The legal basis is Art. 6(1)(f) GDPR: the legitimate interest of the customer and of ListPlus lies in finding business contacts and maintaining accurate business data; it is limited to data in a professional context. Personal enrichment results (email addresses, phone numbers, job titles) are not shared between customers. For retrievals a customer triggers, we act as that customer's processor and transmit the search key to the data provider on the customer's instruction; the data providers are controllers of their own databases (DPA § 2(3)).

Watchlist: monitoring contacts

This feature is switched off by default in every workspace; only the owner can switch it on, after a notice of their responsibility (the time is recorded). A customer can then have individual contacts on their Watchlist monitored: weekly or daily, ListPlus reads the person's public LinkedIn profile (via HarvestAPI) and checks whether position or employer changed or new posts appeared; an AI model classifies the kind of position. Events are stored in the customer's workspace and can be handed to a pipeline of the customer. This is a recurring observation of specific people; it happens only when the customer explicitly sets it up, the customer is the controller for it, and a workspace owner can switch it off. Anyone who objects to the monitoring (section “Your rights”) is no longer retrieved.

Outlook add-in

If a customer uses the Outlook add-in, it sends the name and email address of the correspondent currently opened to ListPlus, which retrieves data about them as in an enrichment and stores them in an “Outlook Contacts” list of the workspace until the customer deletes them.

Browser extension for Chrome

ListPlus browser extension for Chrome. The extension stores the people, companies and pages a user saves only locally in their browser (chrome.storage). Page content is read only on the user's click and processed with Chrome's built-in on-device AI model; it is not transferred to us. The extension reads details from LinkedIn pages only when the user turns this on. Only when the user hands entries over to ListPlus are the selected entries (name, profile address, role, company, location, contact data, notes if chosen) transferred to their ListPlus workspace and processed like other list data (section 11); if they request an enrichment, the providers named in this section apply. If the user hands entries over to their own endpoint, the extension sends them directly to the address the user entered; we do not receive this data. To sign in, the extension uses the existing ListPlus session in the browser. Legal basis: Art. 6(1)(b) GDPR (hand-over to ListPlus); local storage involves no transfer to us.

Retention

Results added to a customer's list are stored until the customer deletes them (section 11). Lookup results about people are cached only in the respective customer's workspace to avoid duplicate lookups: 30 days from the workspace's last lookup. Company data for a domain (name, industry, size, location, website, technologies, funding, address and phone of the headquarters — no details about people) is kept in a company cache shared across customers for 30 days from retrieval; a workspace can switch off contributing to this cache.

Your rights

You have the rights listed in section 18, in particular the right to object to the processing of your data at any time. To do so, contact support@listplus.ai. Where a customer processes your data in its own lists or contacts you, that customer is the controller; your objection to direct marketing should then be addressed to that customer. A short version of this information addressed to you is at listplus.ai/en/contact-data-notice. An objection is entered into a suppression list that applies to all customers: your data is then no longer retrieved through ListPlus.

14. Email receiving and sending (Postmark)

Users can forward emails to a personal address at @in.listplus.ai so that ListPlus recognises contact details in them (e.g. from signatures, vCards or calendar invitations). These emails are received via the Postmark service (ActiveCampaign, LLC, formerly Wildbit, USA). Postmark accepts the email and passes its content to us as structured data (JSON). We process sender, recipient, subject, body and supported attachments of the forwarded email; third-party data contained in it is processed by us as the user's processor (section 11). To recognise contacts, the content is sent to AI providers (section 12).

Through the same service we send, from notifications@listplus.ai, workspace invitations (the invitee's address, the inviter's name, the workspace name) and, when a customer sets up a pipeline with the “Email” target, digest mails to members of the workspace with the name, position and company of each entry and a link to its contact card (the links work for 30 days), as well as support requests from the AI help to our support. Sign-in codes are sent by the sign-in service (section 6), not by Postmark. A workspace owner can switch the Inbox address and pipeline emails off.

Legal basis: Art. 6(1)(b) GDPR (providing the feature the user uses). Third-country transfer: we base the transfer to Postmark in the USA on the EU Standard Contractual Clauses (Art. 46(2)(c) GDPR). Postmark is also certified under the EU-U.S. Data Privacy Framework (Art. 45 GDPR); the data processing agreement is part of Postmark's terms of service. Retention: Postmark keeps messages for 45 days by default. Inbox entries are deleted automatically on our side 14 days after arrival; contacts the user saves or adds to a list are kept.

14a. List webhooks and forms

A customer can set up a webhook per list (an address at listplus.ai/i/…) to which other systems send records, and publish a form (listplus.ai/f/…) that visitors of the customer's website fill in. We process the data arriving this way as the customer's processor (section 11); the customer is the controller towards the data subjects and informs them. Records pass through the queues of our hosting provider; unknown field names and, on request, a spam check go to AI models (section 12); doubtful records can be held back in the customer's Inbox.

For a form we store, per submission, the page it is embedded in, with a consent checkbox the consent and its time, and for two minutes a shortened hash of the visitor's IP address to limit mass submissions; we serve the fonts ourselves, no third-party content is loaded. The form's consent text is a suggestion to the customer, not legal advice. Legal basis: Art. 6(1)(b) GDPR towards the customer; for abuse limitation Art. 6(1)(f) GDPR.

15. Recipients and subprocessors

We only pass on personal data where this is necessary for the purposes described. Within our company, only people who need access for their tasks have it. We use the following service providers:

Part A: Sub-processors

Part B: Data providers and sources

On a lookup these providers receive only the search key (e.g. e-mail address, domain, LinkedIn URL, name and company or search filters), never the rest of the list. They are controllers of their own data and not sub-processors; ListPlus transmits the search key on the customer's instruction (DPA § 2(3)). “Switch off” names the workspace policy switch with which the customer switches a provider off for its workspace.

Part C: Recipients chosen by the customer

Systems the customer transfers data to because it connects or names them itself. The customer is the controller of that transfer; they are listed for completeness.

We have concluded data processing agreements under Art. 28 GDPR with service providers acting on our behalf; for most of them it is part of the provider's terms of service. The current list with seat, data location and safeguard is published at listplus.ai/en/subprocessors; it is also Annex 3 of our data processing agreement. Beyond that, we only disclose data where we are legally obliged to (e.g. to authorities or tax advisers under statutory obligations).

16. Transfers to third countries

Some of the service providers listed are based outside the EU/EEA, in particular in the USA, or use subcontractors there. We host the application in the EU region Frankfurt but cannot rule out that data is transferred to third countries. Transfers only take place where there is an adequacy decision of the European Commission (e.g. for companies certified under the EU-U.S. Data Privacy Framework, Art. 45 GDPR) or appropriate safeguards are in place, in particular EU Standard Contractual Clauses (Art. 46(2)(c) GDPR). You can request a copy of the safeguards at support@listplus.ai.

17. Retention at a glance

We have no feature to restore deleted data. The database is backed up daily; every backup is deleted after 7 days. Until then, deleted data may still be contained in a backup.

18. Your rights

You have the following rights towards us regarding your personal data:

• Right of access (Art. 15 GDPR), including any available information about the source of the data
• Right to rectification (Art. 16 GDPR)
• Right to erasure (Art. 17 GDPR)
• Right to restriction of processing (Art. 18 GDPR)
• Right to data portability (Art. 20 GDPR)
• Right to withdraw consent with effect for the future (Art. 7(3) GDPR)

Right to object (Art. 21 GDPR): where we process your data on the basis of Art. 6(1)(f) GDPR, you have the right to object at any time on grounds relating to your particular situation. Where your data is processed for direct marketing, you can object at any time without giving reasons; the data will then no longer be processed for that purpose.

To exercise your rights, a message to support@listplus.ai is enough. We respond without undue delay and at the latest within one month (Art. 12(3) GDPR).

Right to lodge a complaint (Art. 77 GDPR): you have the right to lodge a complaint with a data protection supervisory authority. The authority responsible for us is the Bavarian State Office for Data Protection Supervision (BayLDA), Promenade 18, 91522 Ansbach, Germany, www.lda.bayern.de.

19. Obligation to provide data

Providing your email address is required for registration; without it we cannot set up an account. Payment details are required to subscribe to a paid plan or buy credits. Otherwise you are under no obligation to provide us with data.

20. Data security

Every transmission — between your browser and us, between our servers and the database, and to every service provider — is encrypted (TLS). Files are stored encrypted at our hosting provider; the database (Redis Cloud) is also encrypted at rest. API and AI keys are used on the server only; access keys customers store for their own destinations are stored encrypted. Access to lists requires sign-in and is limited to the members of the respective workspace. ListPlus itself holds no security certification of its own; our hosting provider Vercel is certified to ISO 27001:2022, among others, and has a SOC 2 Type 2 report.

21. Changes to this privacy policy

We update this privacy policy when our service or the legal situation changes. The version published on this page applies.