Service providers and data sources
Last updated: 19 October 2026
Draft: this text is currently under legal review and may still change.
This English version is a convenience translation. The German version is legally binding.
This list is Annex 3 of our data processing agreement (listplus.ai/en/dpa) and the “Recipients” section of our privacy policy in one — generated from a single source so that there are never two versions. Changes of sub-processors are announced to customers 30 days ahead (DPA § 7).
“Customer can switch off” names the workspace policy switch with which a workspace owner stops transfers to this provider for its workspace.
Part A: Sub-processors
These providers process customer data on our behalf under Art. 28 GDPR. “Switch off” names the workspace policy switch with which the customer stops transfers to this provider for its workspace.
| Service provider | Service | Data transmitted | Seat / location | Third-country safeguard | Customer can switch off |
|---|---|---|---|---|---|
| Vercel Inc. | Running the application, file storage for lists and imports, queues for background work, web analytics and speed insights, AI gateway (access to the model “Jev”) | All data of the application; connection data on every request (IP address, browser) | Covina, California, USA — Hosting, file storage and queues in the EU region Frankfurt | EU-U.S. Data Privacy Framework; Standard Contractual Clauses in the data processing agreement | no |
| Redis EMEA Ltd. (Redis Cloud) | The application's database: workspaces, lists, working data, caches | All data of the application | London, United Kingdom (contracting entity for customers in Europe; parent company Redis Ltd., Tel Aviv, Israel) — Databases in Frankfurt (AWS eu-central-1), encrypted at rest, transport TLS-encrypted | Processing in the EU; United Kingdom: adequacy decision; Standard Contractual Clauses in the provider's data processing agreement (part of the Redis Cloud Agreement) for support access from third countries | no |
| Amazon Web Services EMEA SARL (Amazon S3) | Daily backup of the database; every backup is deleted after 7 days | All data of the database at the time of the backup | Luxembourg — Own storage (S3 bucket) in Frankfurt (eu-central-1), encrypted, no public access | Processing in the EU; Amazon is certified under the EU-U.S. Data Privacy Framework; Standard Contractual Clauses in AWS's data processing addendum (part of the AWS Service Terms) | no |
| Pusher Ltd. | Live status updates in the browser (import done, enrichment running, new hits) | Events about operations; for small changes the changed cell values | London, United Kingdom (Bird group) — Cluster “eu”: AWS eu-west-1 (Ireland) | Processing in the EU (Ireland); adequacy decision for the United Kingdom; Standard Contractual Clauses in Bird's data processing agreement | no |
| Pipedream, LLC | Connections to CRM systems and spreadsheets (OAuth credentials, forwarding of calls); creating email drafts in the user's connected mailbox (Gmail, Outlook) — never sending; delivery of app events from connected apps (form answers, bookings, messages) | Records the customer exchanges with a connected system (for email drafts the contact's address and name, subject and text); the content of the app events the customer sets up | San Francisco, California, USA | Standard Contractual Clauses | yes (connections) |
| Postmark (AC PM LLC, ActiveCampaign) | Receiving e-mails forwarded to the Inbox address @in.listplus.ai; sending workspace invitations and pipeline digest mails from notifications@listplus.ai; sending support requests from the AI help to our support | Forwarded e-mails in full (sender, subject, body, attachments); the invitee's address and the inviter's name; per digest entry name, position, company; for a support request the conversation, the user's e-mail address, workspace, plan and page | Chicago, Illinois, USA | EU-U.S. Data Privacy Framework (ActiveCampaign, LLC including AC PM LLC); Standard Contractual Clauses in the data processing agreement that is part of Postmark's terms of service | yes (inboxEmail, pipelineEmail) |
| OpenAI | Language models for commands, checks, AI columns, column recognition on import, recognition of contacts in the Inbox, mapping of unknown webhook fields, AI research; transcription of dictations | The excerpt the task needs (section “AI processing” of the privacy policy); requests with the “do not store” setting (store: false), not used for training; the provider keeps abuse-monitoring logs for up to 30 days | OpenAI Ireland Ltd., Dublin, Ireland (contracting entity for the EU) / OpenAI, L.L.C., San Francisco, USA | Standard Contractual Clauses in the Data Processing Addendum with OpenAI Ireland Ltd., which is part of the OpenAI Services Agreement (OpenAI is not certified under the EU-U.S. Data Privacy Framework) | yes (ai) |
| Groq UK Limited | Fast language model for short single calls: understanding a search query, role resolution, list titles, short Inbox entries | The short text of the request (search description, signature line); according to the provider not retained by default, at most 30 days for reliability and abuse prevention; not used for training (Services Agreement § 4.2) | London, United Kingdom (contracting entity for the EEA) — Processing and storage in the USA | Standard Contractual Clauses (modules 2 and 3) in the Data Processing Addendum | yes (ai) |
| TypeSafe AI (model “Jev”, via Vercel's AI Gateway) | Judgement model: seniority of job titles, kind of a LinkedIn position, pre-check of Inbox entries and webhook records, judge columns | The values to judge (job titles, positions, up to 12 fields of a record); without storage at the provider (zero data retention); according to the provider not used for training | TypeSafe AI, Inc., Oakland, California, USA | Through Vercel's AI Gateway: the contracting party is Vercel (data processing agreement with Standard Contractual Clauses); TypeSafe works for Vercel under a zero data retention agreement | yes (ai) |
| Apify Technologies s.r.o. | Data collection platform: runs scrapers (“actors”) that read public pages — LinkedIn imports (Sales Navigator, employee lists, post reactions and comments, people search incl. by past employer), Crunchbase company pages, Reddit, X, Google Maps profiles, web traffic, contact details on websites | The search URL, company URL, post URL, company name or research query — never the customer's list; actors by other developers run on Apify's infrastructure under Apify's terms | Prague, Czech Republic | Processing mainly in the EU and the USA; Standard Contractual Clauses in the provider's data processing agreement | yes (provider:apify) |
| PostHog Inc. (EU cloud) | Usage events of the application (which feature was used when), pseudonymous | Event name and properties, a pseudonym of the account (hash), plan, workspace hash; no names, e-mail addresses or list contents; can be switched off per account and per workspace | San Francisco, California, USA — EU cloud in Frankfurt | Processing in the EU; EU-U.S. Data Privacy Framework and Standard Contractual Clauses (module 2) in the signed data processing agreement (19 October 2026) | yes (telemetry) |
| Hanko GmbH | Sign-in: e-mail address with one-time code or Google login; sessions (30 days) | E-mail address, user id, sign-in method, timestamps | Kiel, Germany — Data centres in Germany only | Processing in the EU | no |
| Google LLC (Sign in with Google) | Confirming the sign-in when the user chooses “Sign in with Google” | E-mail address and Google account id; Google learns that the person signs in to ListPlus | Mountain View, California, USA | EU-U.S. Data Privacy Framework | no |
| Sold Through Link, LLC and Stripe (Stripe Managed Payments) | Handling the sale of plans and credits on our behalf as merchant of record: checkout, payment processing, invoices and receipts, VAT, refunds, payment disputes, fraud prevention, the buyer's Link account. Independent controllers for the purchase and the Link account, not only processors | From us: e-mail address, user id, purchased product and price; in the checkout the buyer enters name, billing address and payment data directly with Stripe/Link | Sold Through Link, LLC (formerly Lemon Squeezy, LLC): South San Francisco, California, USA; payment processing in the EU: Stripe Technology Europe, Limited, Dublin, Ireland | Stripe's Data Transfers Addendum (part of Stripe's data processing agreement): primarily the EU-U.S. Data Privacy Framework (Stripe, LLC is certified), otherwise Standard Contractual Clauses (module 1); the addendum also covers Stripe's affiliates, including Sold Through Link, LLC | no |
| Attio Ltd. (CRM) | Customer care: the account with e-mail address, plan and key account events; sends the welcome e-mail | E-mail address, user ID, plan, account events | London, United Kingdom | Adequacy decision for the United Kingdom | no |
Part B: Data providers and sources
On a lookup these providers receive only the search key (e.g. e-mail address, domain, LinkedIn URL, name and company or search filters), never the rest of the list. They are controllers of their own data and not sub-processors; ListPlus transmits the search key on the customer's instruction (DPA § 2(3)). “Switch off” names the workspace policy switch with which the customer switches a provider off for its workspace.
| Service provider | Service | Data transmitted | Seat / location | Third-country safeguard | Customer can switch off |
|---|---|---|---|---|---|
| Prospeo | B2B contact database (segment search), verified business e-mail addresses and phone numbers, company profiles, job changes | Search filters or the search key: LinkedIn URL, name and company, domain | Defastra Tech Inc. (Prospeo), Toronto, Canada; EU representative in Paris — Hosting in the USA (AWS us-east-1) | Canada: adequacy decision; USA: Standard Contractual Clauses according to the provider's privacy policy | yes (provider:prospeo) |
| FullEnrich | Business e-mail address and phone number from name and company or LinkedIn URL (waterfall through 20+ sources) | Name and company, domain or LinkedIn URL | FullEnrich Corp., San Francisco, USA | Standard Contractual Clauses according to the provider's privacy policy | yes (provider:fullenrich) |
| CompanyEnrich | Company data from domain or company name (industry, size, location, website); workforce, decision makers, similar companies | Domain or company name; for person lookups name and company | STDİO Bilişim San. ve Tic. Ltd. Şti., Ankara, Türkiye — Servers, databases and backups in Finland (Hetzner, Helsinki) | Processing in the EU (Finland); for Türkiye (no adequacy decision) Standard Contractual Clauses (modules 2 and 3) in the provider's terms | yes (provider:companyenrich) |
| Crustdata | Company identification by domain (LinkedIn company page, name, size class); funding rounds of watched companies for the Watchlist alert | Only the company domain (for the funding alert also the date of the last check); no personal data | Crustdata Technologies Inc., San Francisco, California, USA — Data in the USA | No transfer of personal data (company domains only) | yes (alerts) |
| HarvestAPI | Publicly visible LinkedIn data: profile, company, profile search, posts and reactions, open jobs; the basis of the Watchlist alerts | LinkedIn URL, name and company, post URL | Aventra Technologies Limited (seat not stated) | The provider names neither its seat nor a transfer safeguard | yes (provider:linkedin, alerts) |
| Enrich.so | Publicly visible LinkedIn profile data from a URL (fallback when HarvestAPI does not answer) | LinkedIn URL | Enrich Labs L.L.C-FZ, Dubai, United Arab Emirates | United Arab Emirates (no adequacy decision); the provider names no transfer safeguard | yes (provider:linkedin) |
| MillionVerifier | Checking whether an e-mail address is deliverable | The e-mail address | Southern Vector Limited, Christchurch, New Zealand — Processing in New Zealand, Hungary and other EEA countries, the USA and other countries | New Zealand: adequacy decision; onward transfers according to the provider under contractual safeguards of comparable protection (no Standard Contractual Clauses named) | yes (provider:millionverifier) |
| Serper (Google search) | Google search results: LinkedIn profile URL for name and company, company website, news, web search of the AI research, confirmation of recognised contacts in the Inbox | The search term (e.g. name and company) | Serper (company not named; terms under the law of the United Kingdom) | Adequacy decision or Standard Contractual Clauses according to the provider's privacy policy | yes (provider:serper) |
| Hacker News (search via Algolia) | Public stories and comments on Hacker News including user names, for the AI research | Only the search term, never data from customer lists | Algolia, Inc., San Francisco, USA — public interface without an account | No contract; only the search term is transmitted | no |
| Public sources (read via Apify) | Publicly visible pages a scraper reads at the customer's request; the platforms are not our contracting partners, the customer observes their terms | The URL or search called | LinkedIn, Crunchbase, Reddit, X, Google Maps, Similarweb, arbitrary websites | Not applicable (retrieval of public pages) | yes (provider:apify, source:reddit, source:twitter, source:linkedin, source:people, source:sources) |
Part C: Recipients chosen by the customer
Systems the customer transfers data to because it connects or names them itself. The customer is the controller of that transfer; they are listed for completeness.
| Service provider | Service | Data transmitted | Seat / location | Third-country safeguard | Customer can switch off |
|---|---|---|---|---|---|
| The customer's connected systems | Import from and export to systems the customer connects; pipeline targets | The records the customer transfers | HubSpot, Salesforce, Pipedrive, Attio, Close, Slack, Google Sheets, Airtable, Notion, lemlist, Instantly as a pipeline target (via Pipedream); Instantly and Smartlead in the export (with the customer's key) | The customer is the controller of this transfer | yes (connections) |
| The customer's own webhook endpoint | Pipeline target “endpoint” | The records the customer transfers | Named by the customer | The customer is the controller of this transfer | no |
| The customer's own AI (Agent API, MCP, research link) | Reading and writing lists and research through an AI system the customer connects | What the connection exposes (columns, sublists, actions) | Chosen by the customer, e.g. ChatGPT, Claude, own agents | The customer is the controller of this transfer | yes (agentApi) |