Privacy Policy

1. Controller

airrange software GmbH Sperberweg 7 82152 Krailling Germany Phone: +49 (0)89 28741023 Email: support@listplus.ai Commercial register: Amtsgericht München, HRB 271683 Managing Director: Stephan Methner

For any data protection question and to exercise your rights, contact us at support@listplus.ai.

2. Data protection officer

[TO CHECK: whether a data protection officer must be appointed is under review. Once appointed, their contact details will be listed here.] Until then, please send data protection requests to support@listplus.ai.

3. Overview: our role in processing your data

Depending on your relationship with ListPlus, we process your data in different roles:

• Website visitors (listplus.ai): we are the controller for the data arising when you visit the website (sections 4 and 5).
• Users of the application (customers and their staff with their own account): we are the controller for account, contract, billing, usage and support data (sections 6 to 10).
• People in customer lists: personal data that customers upload, import, create, enrich or forward to the Inbox is processed by us on behalf of that customer as a processor under Art. 28 GDPR. The customer is the controller (section 11).
• People whose business contact data is retrieved through ListPlus: when customers retrieve contact or company data from data providers through ListPlus, section 13 gives you the information required by Art. 14 GDPR about the sources and the processing.
• Visitors who try the application without an account (guest access): we are the controller for searches in guest access (section 13).

4. Visiting the website and hosting

The website and the application are hosted by Vercel Inc. (440 N Barranca Ave #4133, Covina, CA 91723, USA); servers and file storage are located in the EU region Frankfurt am Main. When you open a page, Vercel processes technically necessary connection data: IP address, date and time, requested URL, referrer, browser and operating system information and status codes (server log files).

Purpose: delivering the website, stability, security and abuse prevention. Legal basis: Art. 6(1)(f) GDPR (legitimate interest in a secure, working service). Retention: server log files are deleted after [PLACEHOLDER: Vercel log retention, e.g. X days] unless needed longer to investigate a security incident.

Although servers and file storage are in the EU, data may also be transferred to the USA by Vercel itself, as Vercel is a US company and uses subprocessors. Vercel is certified under the EU-U.S. Data Privacy Framework; in addition we have concluded a data processing agreement with Standard Contractual Clauses with Vercel (see sections 15 and 16).

5. Cookies, local storage and analytics

We do not use advertising or tracking cookies, and no cookies from ad networks or social networks. We use the following cookies and entries in your browser's local storage (localStorage):

Legal basis: storing and reading this information on your device is based on Section 25(2) no. 2 TDDDG (German Telecommunications Digital Services Data Protection Act) where it is strictly necessary to provide the service you explicitly requested (sign-in, language setting, application settings, support chat). The chat widget is only loaded once you click the chat button. The subsequent processing is based on Art. 6(1)(b) GDPR (user agreement) or Art. 6(1)(f) GDPR. [TO CHECK: classification of lp-first-views/lp-signup-tracked under Section 25 TDDDG.]

Vercel Web Analytics and Speed Insights

We use Vercel Web Analytics and Vercel Speed Insights to measure reach and page speed. These services work without cookies and without cross-device profiles. They record pages visited, referrer, approximate country-level location, device type, browser and operating system, and load times; to distinguish visits, a hash derived from request data is used and discarded daily. In the application, aggregated usage events are also counted (for example the first visit to a view, sign-up, list created, enrichment started, plan subscribed), without user ID, email address or list content.

Purpose: improving the website and application, error analysis. Legal basis: Art. 6(1)(f) GDPR (legitimate interest in designing our service to meet demand). Recipient: Vercel Inc. (see section 15).

Stripe payment pages

When you subscribe to a plan or buy credits, you are redirected to a Stripe payment page (checkout.stripe.com or the Stripe customer portal). Stripe's privacy notice applies there; Stripe sets its own cookies there, among other things for fraud prevention.

6. Registration, sign-in and user account

To use ListPlus you create an account with your email address. You sign in only with your email address and a one-time passcode we send you by email; we do not store a password. The sign-in service is operated for us by Hanko GmbH [TO CHECK: seat and hosting location; hosted in the EU according to airrange's current privacy policy]. We process your email address, optionally your name, an internal user ID, the times of registration and sign-in, and technical session data.

Purpose: setting up and securing your account. Legal basis: Art. 6(1)(b) GDPR (contract or pre-contractual steps). Retention: for the duration of the user relationship; after the account is deleted, the data is deleted unless statutory retention obligations apply.

7. Providing the application and performing the contract

When you use ListPlus, we process your account data, your plan, your credit balance and its transactions (purchases, usage per action, refunds), settings, the lists, folders and saved contacts you create, API connections and their execution logs, as well as technical logs for error analysis and abuse detection.

Purpose: providing the contractual services, billing credits, security and abuse prevention (e.g. rate limits). Legal basis: Art. 6(1)(b) GDPR; for security and abuse prevention Art. 6(1)(f) GDPR.

For a fast working data store we use Redis Cloud (Redis Ltd.), hosted in the Frankfurt region (AWS eu-central-1). For live status updates in the browser (e.g. “import finished”) we use the realtime service Pusher (Pusher Ltd.) [TO CHECK: seat/cluster]; it transmits event and status information about your operations.

Through workflows (webhooks) at the service Pipedream, Inc. (USA) we receive internal notifications about events in our service: sign-up, sign-in, sign-out and deletion of an account (user ID, email address, sign-in method), lists created (list ID, user ID, list name, import type and row count, no list content), and events from our payment provider Stripe. Pipedream receives these notifications; of their content, only your email address is stored, as follows:

• On sign-up, a Pipedream workflow adds your email address to our CRM system Attio and creates a user record in a database at Amazon Web Services (AWS DynamoDB), region Frankfurt (EU). No other data is stored there. The CRM system sends a welcome email.
• On a purchase, Stripe calls an interface of our service; it finds the user record by the payer's email address and records the purchased plan there.

Purpose: managing your account and plan, and sending the welcome email to get you started. Legal basis: Art. 6(1)(b) GDPR (performance of the user agreement). The welcome email is purely a greeting and onboarding message about your account, not advertising. We only send newsletters or promotional emails with your explicit consent (Art. 6(1)(a) GDPR), which you can withdraw at any time.

8. Payments and invoices

Subscriptions and credit packs are processed by Stripe (Stripe Payments Europe, Ltd., 1 Grand Canal Street Lower, Grand Canal Dock, Dublin, Ireland). Stripe processes name, email address, billing address, VAT ID where given, and payment data, and calculates VAT. We do not receive full card or account details from Stripe, only customer and payment status information and invoices.

Legal basis: Art. 6(1)(b) GDPR (performance of contract) and Art. 6(1)(c) GDPR (tax and commercial law obligations). Retention: we keep invoices and accounting records for the statutory periods (Section 147 AO, Section 257 HGB), currently up to 10 years. For certain purposes of its own (e.g. fraud prevention, regulatory obligations) Stripe is itself a controller.

9. Support by email and chat

When you contact us by email (support@listplus.ai) or via the chat widget in the application dashboard, we process your message, your contact details and, for signed-in users, your user ID, name and email address so we can match your account. The chat widget is provided by Chatwoot Inc. [TO CHECK: address], USA; the data is processed on servers in the USA. The widget is only loaded once you click the chat button in the application dashboard — no data is sent to Chatwoot before that. Chat replies may first come from an AI assistant that only draws on approved help articles; you can ask to be handed to a person at any time.

Legal basis: Art. 6(1)(b) GDPR where your request concerns the contract, otherwise Art. 6(1)(f) GDPR (legitimate interest in answering requests). Retention: until the request is fully resolved, then [PLACEHOLDER: e.g. 24 months] for traceability, unless statutory retention obligations apply.

10. Connections to other systems

When you connect a CRM, spreadsheet or other tool (e.g. HubSpot, Salesforce, Pipedrive, Google Sheets, Airtable, Notion, Lemlist, Stripe), the connector service Pipedream, Inc. [TO CHECK: seat, USA] manages the login credentials (OAuth) on our behalf; ListPlus itself does not store them. Requests to and transfers into the connected system run wholly or partly through Pipedream's proxy service; the transferred records pass through Pipedream's servers. Which data is transferred is determined by your actions (import or export). Legal basis: Art. 6(1)(b) GDPR; section 11 applies to the content.

11. Customer data: ListPlus as processor

Personal data that customers process in ListPlus — such as lists from file imports, imports from LinkedIn or connected systems, enrichment results, saved contacts and Inbox entries — is processed by us on behalf of and on the instructions of the customer (Art. 28 GDPR). The customer is the controller of this data and of its use, for example for sales outreach. Data subjects should address their requests to the company using their data; if such a request reaches us, we forward it to the customer where possible.

The data processing agreement (DPA) at listplus.ai/dpa applies and is part of the user agreement for customers on every plan. A signed copy is available on request at support@listplus.ai.

Retention: lists are stored until the customer deletes them; deletion is immediate and permanent. Some areas are deliberately time-limited: Inbox entries are deleted 14 days after arrival, shared result links stop working 7 days after they were last opened, AI research runs executed in the background are deleted 7 days after they start, profiles that were only viewed (not saved or enriched) drop out of “Recently viewed” after 30 days without further activity, and a pipeline’s history (records sent to a destination the customer chose, with the destination’s response) is deleted 30 days after sending. When an account is deleted (on request to support@listplus.ai), we delete the account, its lists and saved contacts.

12. AI processing

ListPlus uses AI models to understand commands, check data, fill AI columns, detect columns on import, recognise Inbox entries and run research. Processing takes place exclusively on our servers; only the part of the data needed for the task is sent to the AI provider:

• Commands and questions: your text, column names and types, row count and sublist names; only when a command needs values, the distinct values of the columns involved (duplicates removed).
• AI checks and AI Column: only the distinct values or value combinations of the columns involved, never whole rows.
• Column detection on import: column headers and a sample of example values (10% of the file, at least 50 and at most 200 rows).
• Inbox: To recognise people and companies in a longer entry, its text is sent to OpenAI: for forwarded emails, the email body and the text extracted from supported attachments (e.g. PDF), cut to at most about 24,000 characters. Structured entries (vCards, calendar invitations, CSV and JSON data) are read without AI extraction. Short entries (e.g. a signature line) and the recognised contact details (name, position, company, email address, location) are sent to Groq or to a model via the Vercel AI Gateway for classification and a plausibility check; to confirm a person or company, a Google search with name and company may be run (section 13).
• AI Research: your search description, or the known identity details of a person (name, company, job title, location), to search public web sources.

Providers: OpenAI [TO CHECK: contracting entity and seat], Groq, Inc. [TO CHECK: seat, USA], and models connected through the AI Gateway of Vercel Inc. [TO CHECK: exclusion of training on submitted data and retention periods at the AI providers.] Legal basis: for customer data we act as processor (section 11); otherwise Art. 6(1)(b) GDPR. No automated decision-making with legal or similarly significant effects within the meaning of Art. 22 GDPR takes place; AI results are suggestions that the user reviews and applies.

13. Data providers and data enrichment (information under Art. 14 GDPR)

ListPlus lets customers search for, complete and verify business contact and company data. This data does not come from ListPlus itself — ListPlus owns no contact database of its own — but is retrieved at the moment of the request from specialised data providers or from publicly available sources. If your business contact data has been retrieved through ListPlus, this section informs you about the processing.

Categories of data

Name, job title and seniority, company and company data (industry, size, location, website, funding, technologies), business email address and its deliverability status, business phone number and, where applicable, mobile number, LinkedIn profile URL, location, and publicly visible profile details (e.g. career history) as well as public posts or reactions where a customer imports them.

Sources

The data providers are responsible for their own data sets; information on their processing is available in their respective privacy notices. A complete list with seat and data location is available on request at support@listplus.ai.

Purposes, recipients and legal basis

The data is retrieved when a customer triggers a specific search or enrichment and is provided only to that customer, who uses it for their own business purposes (e.g. sales, maintaining CRM data). We send the data provider only the search key needed for the lookup (e.g. email address, domain, LinkedIn URL, name and company, or search filters), never the rest of the customer's list. The legal basis is Art. 6(1)(f) GDPR: the legitimate interest of the customer and of ListPlus lies in finding business contacts and maintaining accurate business data; it is limited to data in a professional context. Personal enrichment results (email addresses, phone numbers, job titles) are not shared between customers. For retrievals a customer triggers, we act as that customer's processor (DPA § 2). [TO CHECK: allocation of controller/processor roles when retrieving third-party data, see lawyer notes L29.]

Search without a user account (guest access)

Visitors can try the person and company search without a user account. In that case there is no customer on whose behalf we act; we are the controller for these retrievals. We retrieve data from the sources listed above in a limited number per day (e.g. Google search, LinkedIn data provider, company data) and show the visitor the result, such as name, job title, company, profile picture and LinkedIn profile. The purpose is to show prospective customers how ListPlus works before they register. The legal basis is Art. 6(1)(f) GDPR. The results are not assigned to an account and not stored in lists; the search history may be stored in the visitor's browser (section 5). To limit abuse and costs, we count searches per IP address and day; these counters are deleted automatically after about 26 hours. [TO CHECK: balancing of interests for showing personal results to unregistered visitors; alternative: limit guest access to company data or anonymised person matches. Confirm in code whether query results of guest searches are cached.]

Retention

Results added to a customer's list are stored until the customer deletes them (section 11). Lookup results are cached in the respective customer's account for 7 days (LinkedIn data: 30 days) to avoid duplicate lookups. Company data for a domain is stored in a company cache shared across customers [PLACEHOLDER: retention of the company cache].

Your rights

You have the rights listed in section 18, in particular the right to object to the processing of your data at any time. To do so, contact support@listplus.ai. Where a customer processes your data in its own lists or contacts you, that customer is the controller; your objection to direct marketing should then be addressed to that customer.

14. Inbox: email forwarding

Users can forward emails to a personal address at @in.listplus.ai so that ListPlus recognises contact details in them (e.g. from signatures, vCards or calendar invitations). These emails are received via the Postmark service (ActiveCampaign, LLC, formerly Wildbit, USA). Postmark accepts the email and passes its content to us as structured data (JSON). We process sender, recipient, subject, body and supported attachments of the forwarded email; third-party data contained in it is processed by us as the user's processor (section 11). To recognise contacts, the content is sent to AI providers (section 12).

Legal basis: Art. 6(1)(b) GDPR (providing the Inbox feature the user uses). Third-country transfer: we base the transfer to Postmark in the USA on the EU Standard Contractual Clauses (Art. 46(2)(c) GDPR). [TO CHECK: data processing agreement with Postmark still to be signed.] Retention: Postmark keeps received messages for 45 days by default [TO CHECK: planned shortening of this period]. Inbox entries are deleted automatically on our side 14 days after arrival; contacts the user saves or adds to a list are kept.

15. Recipients and subprocessors

We only pass on personal data where this is necessary for the purposes described. Within our company, only people who need access for their tasks have it. We use the following service providers:

We have concluded, or are concluding, data processing agreements under Art. 28 GDPR with service providers acting on our behalf. [TO CHECK: completeness of the agreements.] A complete, current list with seat and data location is available on request at support@listplus.ai. Beyond that, we only disclose data where we are legally obliged to (e.g. to authorities or tax advisers under statutory obligations).

16. Transfers to third countries

Some of the service providers listed are based outside the EU/EEA, in particular in the USA, or use subcontractors there. We host the application in the EU region Frankfurt but cannot rule out that data is transferred to third countries. Transfers only take place where there is an adequacy decision of the European Commission (e.g. for companies certified under the EU-U.S. Data Privacy Framework, Art. 45 GDPR) or appropriate safeguards are in place, in particular EU Standard Contractual Clauses (Art. 46(2)(c) GDPR). You can request a copy of the safeguards at support@listplus.ai.

17. Retention at a glance

We have no feature to restore deleted data. Technical backups at our hosting provider are overwritten according to its periods [TO CHECK: backup periods].

18. Your rights

You have the following rights towards us regarding your personal data:

• Right of access (Art. 15 GDPR), including any available information about the source of the data
• Right to rectification (Art. 16 GDPR)
• Right to erasure (Art. 17 GDPR)
• Right to restriction of processing (Art. 18 GDPR)
• Right to data portability (Art. 20 GDPR)
• Right to withdraw consent with effect for the future (Art. 7(3) GDPR)

Right to object (Art. 21 GDPR): where we process your data on the basis of Art. 6(1)(f) GDPR, you have the right to object at any time on grounds relating to your particular situation. Where your data is processed for direct marketing, you can object at any time without giving reasons; the data will then no longer be processed for that purpose.

To exercise your rights, a message to support@listplus.ai is enough. We respond without undue delay and at the latest within one month (Art. 12(3) GDPR).

Right to lodge a complaint (Art. 77 GDPR): you have the right to lodge a complaint with a data protection supervisory authority. The authority responsible for us is the Bavarian State Office for Data Protection Supervision (BayLDA), Promenade 18, 91522 Ansbach, Germany, www.lda.bayern.de.

19. Obligation to provide data

Providing your email address is required for registration; without it we cannot set up an account. Payment details are required to subscribe to a paid plan or buy credits. Otherwise you are under no obligation to provide us with data.

20. Data security

Data is transmitted encrypted (TLS) and stored encrypted at our hosting provider. API and AI keys are used on the server only. Access to lists requires sign-in and is limited to the respective account and the people it is shared with. ListPlus itself holds no security certification of its own; our hosting provider Vercel is certified under ISO 27001:2022, among others, and has a SOC 2 Type 2 report.

21. Changes to this privacy policy

We update this privacy policy when our service or the legal situation changes. The version published on this page applies.