You're the controller for that request
You decide who to contact through ListPlus, so you answer access, erasure and objection requests yourself, not ListPlus.
Privacy & GDPR
Privacy & GDPR at ListPlus
Roles, hosting locations, named subprocessors, retention periods and how to request a DPA — the specifics behind ListPlus's data handling.
You control outreach
You decide who to contact; ListPlus processes your list data on your behalf under a DPA.
EU hosting
Application and files run on Vercel in Frankfurt; the working data cache is in Frankfurt too.
DPA on every plan
A data processing agreement is available for every plan — email support@listplus.ai.
Roles
You are the controller. ListPlus is the processor.
For the contact data in your lists, the two roles are kept separate.
- You (the controller)
- You decide who to contact, why, and on what legal basis. That responsibility stays with you.
- ListPlus (the processor)
- ListPlus processes your list data on your behalf — storage, enrichment, checks — under the data processing agreement (DPA) that applies to every plan.
Our position
Read our position How we see our role — written for your data protection officer.
A tool, not a database. The customer is the controller and in control, on the server. One provider list with every name. A notice and a suppression list for the people in the data. And a section on what is still open — we write that down too.
The same text opens the data protection package.
Your controls
What you can switch off.
A data protection officer who objects to one provider or one feature does not have to reject the product.
- Workspace policy
- The workspace owner switches off, for everyone in the workspace: single data providers (Prospeo, FullEnrich, CompanyEnrich, LinkedIn data, e-mail verification, Google search, scrapers), AI features, Watchlist alerts, the Inbox e-mail address, the Agent API, connected systems, pipeline e-mails, usage events, or contributing to the shared company cache. Off means no data reaches that provider — enforced on the server, not only hidden in the UI. The policy exports as a text file for your review.
- Published provider list
- Every sub-processor, data provider and source with seat, data received, safeguard and the switch that stops it, at listplus.ai/en/subprocessors — the same list as Annex 3 of the DPA, generated from one source.
- For the people in the data
- A notice addressed to them at listplus.ai/en/contact-data-notice, and a global do-not-retrieve list: someone who objects is no longer looked up through ListPlus, for any customer.
One click
Open the sample package The data protection package, before you sign up.
Everything a data protection officer asks for in one printable page: the workspace switches, the DPA with its annexes, every provider with seat and safeguard, the notice for the people in the data, and the privacy policy. Customers generate the same package with their own switches from the workspace settings — or send it as a 30-day link.
Opens in the browser; print or download from there.
Hosting & locations
EU hosting, Frankfurt region.
Application, files and the working data cache are hosted in the Frankfurt region.
- Application & file storage
- Vercel, EU region Frankfurt. Runs ListPlus and stores your lists and uploaded files.
- Working data cache
- Redis Cloud, hosted on AWS eu-central-1 (Frankfurt), for fast reads while you work in a list.
- Cross-border transfers
- Some processing — AI features, enrichment lookups — is done by subprocessors outside the EU. Those transfers are covered by data processing agreements.
Subprocessors
Who processes data on ListPlus's behalf.
Subprocessors first, then the data providers that receive only the search key of a lookup. Each handles one part of the product and receives only what that part needs. The complete list with safeguards and the policy switch per provider is at listplus.ai/en/subprocessors.
| Subprocessor | Purpose | Data received | Seat / location |
|---|---|---|---|
| Vercel Inc. | Running the application, file storage for lists and imports, queues for background work, web analytics and speed insights, AI gateway (access to the model “Jev”) | All data of the application; connection data on every request (IP address, browser) | Covina, California, USA — Hosting, file storage and queues in the EU region Frankfurt |
| Redis EMEA Ltd. (Redis Cloud) | The application's database: workspaces, lists, working data, caches | All data of the application | London, United Kingdom (contracting entity for customers in Europe; parent company Redis Ltd., Tel Aviv, Israel) — Databases in Frankfurt (AWS eu-central-1), encrypted at rest, transport TLS-encrypted |
| Amazon Web Services EMEA SARL (Amazon S3) | Daily backup of the database; every backup is deleted after 7 days | All data of the database at the time of the backup | Luxembourg — Own storage (S3 bucket) in Frankfurt (eu-central-1), encrypted, no public access |
| Pusher Ltd. | Live status updates in the browser (import done, enrichment running, new hits) | Events about operations; for small changes the changed cell values | London, United Kingdom (Bird group) — Cluster “eu”: AWS eu-west-1 (Ireland) |
| Pipedream, LLC | Connections to CRM systems and spreadsheets (OAuth credentials, forwarding of calls); creating email drafts in the user's connected mailbox (Gmail, Outlook) — never sending; delivery of app events from connected apps (form answers, bookings, messages) | Records the customer exchanges with a connected system (for email drafts the contact's address and name, subject and text); the content of the app events the customer sets up | San Francisco, California, USA |
| Postmark (AC PM LLC, ActiveCampaign) | Receiving e-mails forwarded to the Inbox address @in.listplus.ai; sending workspace invitations and pipeline digest mails from notifications@listplus.ai; sending support requests from the AI help to our support | Forwarded e-mails in full (sender, subject, body, attachments); the invitee's address and the inviter's name; per digest entry name, position, company; for a support request the conversation, the user's e-mail address, workspace, plan and page | Chicago, Illinois, USA |
| OpenAI | Language models for commands, checks, AI columns, column recognition on import, recognition of contacts in the Inbox, mapping of unknown webhook fields, AI research; transcription of dictations | The excerpt the task needs (section “AI processing” of the privacy policy); requests with the “do not store” setting (store: false), not used for training; the provider keeps abuse-monitoring logs for up to 30 days | OpenAI Ireland Ltd., Dublin, Ireland (contracting entity for the EU) / OpenAI, L.L.C., San Francisco, USA |
| Groq UK Limited | Fast language model for short single calls: understanding a search query, role resolution, list titles, short Inbox entries | The short text of the request (search description, signature line); according to the provider not retained by default, at most 30 days for reliability and abuse prevention; not used for training (Services Agreement § 4.2) | London, United Kingdom (contracting entity for the EEA) — Processing and storage in the USA |
| TypeSafe AI (model “Jev”, via Vercel's AI Gateway) | Judgement model: seniority of job titles, kind of a LinkedIn position, pre-check of Inbox entries and webhook records, judge columns | The values to judge (job titles, positions, up to 12 fields of a record); without storage at the provider (zero data retention); according to the provider not used for training | TypeSafe AI, Inc., Oakland, California, USA |
| Apify Technologies s.r.o. | Data collection platform: runs scrapers (“actors”) that read public pages — LinkedIn imports (Sales Navigator, employee lists, post reactions and comments, people search incl. by past employer), Crunchbase company pages, Reddit, X, Google Maps profiles, web traffic, contact details on websites | The search URL, company URL, post URL, company name or research query — never the customer's list; actors by other developers run on Apify's infrastructure under Apify's terms | Prague, Czech Republic |
| PostHog Inc. (EU cloud) | Usage events of the application (which feature was used when), pseudonymous | Event name and properties, a pseudonym of the account (hash), plan, workspace hash; no names, e-mail addresses or list contents; can be switched off per account and per workspace | San Francisco, California, USA — EU cloud in Frankfurt |
| Hanko GmbH | Sign-in: e-mail address with one-time code or Google login; sessions (30 days) | E-mail address, user id, sign-in method, timestamps | Kiel, Germany — Data centres in Germany only |
| Google LLC (Sign in with Google) | Confirming the sign-in when the user chooses “Sign in with Google” | E-mail address and Google account id; Google learns that the person signs in to ListPlus | Mountain View, California, USA |
| Sold Through Link, LLC and Stripe (Stripe Managed Payments) | Handling the sale of plans and credits on our behalf as merchant of record: checkout, payment processing, invoices and receipts, VAT, refunds, payment disputes, fraud prevention, the buyer's Link account. Independent controllers for the purchase and the Link account, not only processors | From us: e-mail address, user id, purchased product and price; in the checkout the buyer enters name, billing address and payment data directly with Stripe/Link | Sold Through Link, LLC (formerly Lemon Squeezy, LLC): South San Francisco, California, USA; payment processing in the EU: Stripe Technology Europe, Limited, Dublin, Ireland |
| Attio Ltd. (CRM) | Customer care: the account with e-mail address, plan and key account events; sends the welcome e-mail | E-mail address, user ID, plan, account events | London, United Kingdom |
| Prospeo | B2B contact database (segment search), verified business e-mail addresses and phone numbers, company profiles, job changes | Search filters or the search key: LinkedIn URL, name and company, domain | Defastra Tech Inc. (Prospeo), Toronto, Canada; EU representative in Paris — Hosting in the USA (AWS us-east-1) |
| FullEnrich | Business e-mail address and phone number from name and company or LinkedIn URL (waterfall through 20+ sources) | Name and company, domain or LinkedIn URL | FullEnrich Corp., San Francisco, USA |
| CompanyEnrich | Company data from domain or company name (industry, size, location, website); workforce, decision makers, similar companies | Domain or company name; for person lookups name and company | STDİO Bilişim San. ve Tic. Ltd. Şti., Ankara, Türkiye — Servers, databases and backups in Finland (Hetzner, Helsinki) |
| Crustdata | Company identification by domain (LinkedIn company page, name, size class); funding rounds of watched companies for the Watchlist alert | Only the company domain (for the funding alert also the date of the last check); no personal data | Crustdata Technologies Inc., San Francisco, California, USA — Data in the USA |
| HarvestAPI | Publicly visible LinkedIn data: profile, company, profile search, posts and reactions, open jobs; the basis of the Watchlist alerts | LinkedIn URL, name and company, post URL | Aventra Technologies Limited (seat not stated) |
| Enrich.so | Publicly visible LinkedIn profile data from a URL (fallback when HarvestAPI does not answer) | LinkedIn URL | Enrich Labs L.L.C-FZ, Dubai, United Arab Emirates |
| MillionVerifier | Checking whether an e-mail address is deliverable | The e-mail address | Southern Vector Limited, Christchurch, New Zealand — Processing in New Zealand, Hungary and other EEA countries, the USA and other countries |
| Serper (Google search) | Google search results: LinkedIn profile URL for name and company, company website, news, web search of the AI research, confirmation of recognised contacts in the Inbox | The search term (e.g. name and company) | Serper (company not named; terms under the law of the United Kingdom) |
| Hacker News (search via Algolia) | Public stories and comments on Hacker News including user names, for the AI research | Only the search term, never data from customer lists | Algolia, Inc., San Francisco, USA — public interface without an account |
| Public sources (read via Apify) | Publicly visible pages a scraper reads at the customer's request; the platforms are not our contracting partners, the customer observes their terms | The URL or search called | LinkedIn, Crunchbase, Reddit, X, Google Maps, Similarweb, arbitrary websites |
Some subprocessors process data outside the EU; the safeguard for each transfer and the workspace switch that stops it are on listplus.ai/en/subprocessors.
Retention
How long data is kept.
Your lists stay until you delete them. A few places are deliberately temporary.
| What | Kept for |
|---|---|
| Lists | Until you delete them — no automatic expiry |
| Inbox entries | 14 days after arrival |
| Shared result links | 7 days from creation — opening the link does not extend it |
| Background AI Research runs | 7 days from when you start them |
| Recently viewed profiles (Person Search) | 30 days of no further activity — contacts saved to a folder or enriched don't expire |
| Search result sessions (Segment Search, Person Search) | 30 days, sliding — renewed each time you reopen them |
| LinkedIn lookup cache (profile, company, search) | 30 days |
| Provider lookup cache (Prospeo, FullEnrich, Crunchbase) | 7 days, per user — only lookups that returned data |
| Repeated Segment Search | 30 days |
| Company data cache (by domain) | Shared across all customers, no fixed expiry |
| AI classification cache | 30 days for confident results |
| Email verification cache | 7 days |
| Inbound e-mail at the provider (Postmark) | 45 days (the provider's default) |
What the AI sees
Never the whole list.
Each AI feature receives only the data it needs for that one job.
- AI commands (Prompts panel)
- Your instruction, column names and types and the row count — not cell values, unless the command needs to judge values, in which case only the distinct values of the relevant columns are sent.
- AI checks & AI Column
- Only the distinct (unique) values of the column(s) involved, never full rows. A 10,000-row list with a few hundred unique job titles sends a few hundred combinations, not ten thousand rows.
- Enrichment providers
- Only the identifier needed for that lookup — an email, a domain, a LinkedIn URL, a name and company, or a company name — never your other columns.
- AI Research
- Your research description, or one person's known identity details — never the rest of your list.
- Inbox recognition
- The text of an entry you paste or forward (email body and supported attachments), to recognise the contacts in it.
- Import column detection
- A sample of your file's first rows (10%, 50–200 rows) with real cell values, plus the distinct values of gender, country and yes/no columns from the whole file — on every import, to suggest column types.
- Where this runs
- All of this happens on ListPlus's servers, never in your browser.
DPA / AVV
Read the DPA A data processing agreement, on every plan.
It applies to every plan — Basic, Pro and Premium — as part of the user agreement; you do not have to request it. A signed copy is available by e-mail to support@listplus.ai. ListPlus itself holds no security certification of its own (no ISO 27001, SOC 2 or similar). Vercel, ListPlus's hosting provider, holds its own certifications, including SOC 2 Type 2 and ISO 27001:2022 — that's Vercel's certification, not ListPlus's, covering Vercel's infrastructure.
Data-subject requests
Someone asks where you got their data, or wants it deleted.
That request is addressed to you, not to ListPlus — but ListPlus gives you what you need to answer it.
The source of a value
The number badge in the sparkles column at the right edge of a row opens the record panel, where each enrichment result is headed with its provider, for example "Prospeo · Contact".
Removing a row
Select the row and use the selection bar's ⋯ menu → Delete (saved automatically; Undo brings it back). This removes it from that list only — not other lists, your watchlist, the Inbox, an export, or a CRM you already pushed it to.
Contact
Email support@listplus.ai Questions about your data?
DPA requests and questions about backups and retention at ListPlus's providers go through support. The full subprocessor list is published at listplus.ai/en/subprocessors; deleting your entire account is self-service in Settings → Profile.
support@listplus.ai
Good to know.
Where is ListPlus hosted?
On Vercel, in the EU region Frankfurt. The working data cache (Redis Cloud) is also in Frankfurt, on AWS eu-central-1.
Who is the controller for the contacts in my lists?
You are. ListPlus processes that data on your behalf under a DPA, but you decide who to contact and why.
Does ListPlus hold ISO 27001 or SOC 2 certification?
No, not ListPlus itself. Vercel, its hosting provider, holds its own certifications, including SOC 2 Type 2 and ISO 27001:2022 — that covers Vercel's infrastructure, not a ListPlus certification.
Can I get a DPA / AVV?
Yes, for every plan. Email support@listplus.ai with your company name and it's sent to you to sign.
Does an AI model ever see my whole list?
No. AI commands see your instruction and column structure; AI checks and AI Column see only distinct values; enrichment providers see only the identifier being looked up.
Someone asked where I got their data — does ListPlus answer that?
No, you do — you're the controller for that outreach. The record panel's provider badge on each row shows the source you need.
How long is my data kept?
Lists are kept until you delete them. A few places are temporary by design: Inbox (14 days), shared result links (7 days from creation), research runs (1 to 7 days, 30 with hand-off to a list), lookup caches about people (30 days per workspace) and a shared company cache without personal data (30 days).
Continue exploring
Start with anything. End with contacts that are ready.
Try the sample list or bring your own starting point.