Service providers and data sources
Last updated: 8 October 2026
Draft: this text is currently under legal review and may still change.
This English version is a convenience translation. The German version is legally binding.
This list is Annex 3 of our data processing agreement (listplus.ai/en/dpa) and the “Recipients” section of our privacy policy in one — generated from a single source so that there are never two versions. Changes of sub-processors are announced to customers 30 days ahead (DPA § 7).
“Customer can switch off” names the workspace policy switch with which a workspace owner stops transfers to this provider for its workspace.
Part A: Sub-processors
These providers process customer data on our behalf under Art. 28 GDPR. “Switch off” names the workspace policy switch with which the customer stops transfers to this provider for its workspace.
| Service provider | Service | Data transmitted | Seat / location | Third-country safeguard | Customer can switch off |
|---|---|---|---|---|---|
| Vercel Inc. | Running the application, file storage for lists and imports, queues for background work, web analytics and speed insights, AI gateway (access to the model “Jev”) | All data of the application; connection data on every request (IP address, browser) | Covina, California, USA — Hosting, file storage and queues in the EU region Frankfurt | EU-U.S. Data Privacy Framework; Standard Contractual Clauses in the data processing agreement | no |
| Redis Ltd. (Redis Cloud) | The application's database: workspaces, lists, working data, caches | All data of the application | Seat: Mountain View, California, USA — Database in Frankfurt (AWS eu-central-1), transport TLS-encrypted — [TO CHECK: Confirm the data processing agreement and encryption at rest] | Processing in the EU; Standard Contractual Clauses for support access from third countries | no |
| Pusher Ltd. | Live status updates in the browser (import done, enrichment running, new hits) | Events about operations; for small changes the changed cell values | London, United Kingdom — [TO CHECK: Confirm the cluster location] | Adequacy decision for the United Kingdom | no |
| Pipedream, Inc. | Connections to CRM systems and spreadsheets (OAuth credentials, forwarding of calls); internal notifications about account, list and payment events | Records the customer exchanges with a connected system; from events the user id, e-mail address, list name and row count and a summary of the payment event (customer, e-mail, amount, plan) | San Francisco, California, USA — [being replaced] — [TO CHECK: The service is being discontinued; notifications move to n8n, the replacement for connections is open] | Standard Contractual Clauses | yes (connections) |
| Postmark (ActiveCampaign, LLC) | Receiving e-mails forwarded to the Inbox address @in.listplus.ai; sending workspace invitations and pipeline digest mails from notifications@listplus.ai | Forwarded e-mails in full (sender, subject, body, attachments); the invitee's address and the inviter's name; per digest entry name, position, company | Chicago, Illinois, USA — [TO CHECK: Sign the data processing agreement; shorten retention at the provider (default 45 days)] | Standard Contractual Clauses | yes (inboxEmail, pipelineEmail) |
| OpenAI | Language models for commands, checks, AI columns, column recognition on import, recognition of contacts in the Inbox, mapping of unknown webhook fields, AI research; transcription of dictations | The excerpt the task needs (section “AI processing” of the privacy policy); requests are not stored at the provider (store: false) and not used for training | OpenAI Ireland Ltd., Dublin, Ireland (contracting entity for the EU) / OpenAI, L.L.C., San Francisco, USA — [TO CHECK: Confirm the contracting entity (Ireland/USA) and the Data Processing Addendum] | EU-U.S. Data Privacy Framework; Standard Contractual Clauses in the Data Processing Addendum | yes (ai) |
| Groq, Inc. | Fast language model for short single calls: understanding a search query, role resolution, list titles, short Inbox entries | The short text of the request (search description, signature line) | Mountain View, California, USA — [TO CHECK: Confirm the Data Processing Addendum and the no-training clause] | Standard Contractual Clauses | yes (ai) |
| TypeSafe AI (Modell „Jev“, über das AI Gateway von Vercel) | Judgement model: seniority of job titles, kind of a LinkedIn position, pre-check of Inbox entries and webhook records, judge columns | The values to judge (job titles, positions, up to 12 fields of a record); without storage at the provider (zero data retention) | Seat: to be confirmed — [TO CHECK: Confirm seat, contracting entity and safeguard] | Standard Contractual Clauses via Vercel | yes (ai) |
| Apify Technologies s.r.o. | Data collection platform: runs scrapers (“actors”) that read public pages — LinkedIn imports (Sales Navigator, employee lists, post reactions and comments, people search incl. by past employer), Crunchbase company pages, Reddit, X, Google Maps profiles, web traffic, contact details on websites | The search URL, company URL, post URL, company name or research query — never the customer's list | Prague, Czech Republic — [TO CHECK: Confirm the data processing agreement; third-party actors run on Apify's infrastructure] | Processing in the EU | yes (provider:apify) |
| PostHog Inc. (EU-Cloud) | Usage events of the application (which feature was used when), pseudonymous | Event name and properties, a pseudonym of the account (hash), plan, workspace hash; no names, e-mail addresses or list contents; can be switched off per account and per workspace | San Francisco, California, USA — EU cloud in Frankfurt | Processing in the EU; Standard Contractual Clauses in the data processing agreement | yes (telemetry) |
| Axiom, Inc. | Server logs and browser error reports for troubleshooting | Log lines of the application; on browser errors the error text, stack and page (without user id and without query string) | San Francisco, California, USA — [TO CHECK: Confirm seat, data location and retention period] | Standard Contractual Clauses | no |
| Chatwoot Inc. | Support chat in the application; first answers by an AI assistant that reads only approved help texts | User id, name, e-mail address and chat messages; only after clicking the chat button | Wilmington, Delaware, USA — [TO CHECK: Confirm the data processing agreement] | Standard Contractual Clauses | yes (supportChat) |
| Hanko GmbH | Sign-in: e-mail address with one-time code or Google login; sessions (30 days) | E-mail address, user id, sign-in method, timestamps | Kiel, Germany | Processing in the EU | no |
| Google LLC (Anmeldung mit Google) | Confirming the sign-in when the user chooses “Sign in with Google” | E-mail address and Google account id; Google learns that the person signs in to ListPlus | Mountain View, California, USA | EU-U.S. Data Privacy Framework | no |
| Stripe Payments Europe, Ltd. | Payments, invoices, VAT | Name, e-mail address, billing address, VAT id, payment data (only at Stripe) | Dublin, Ireland | Standard Contractual Clauses for transfers to Stripe, Inc. (USA) | no |
| Attio Ltd. (CRM) | Account e-mails: stores the e-mail address at sign-up and sends the welcome e-mail | E-mail address | London, United Kingdom | Adequacy decision for the United Kingdom | no |
| Amazon Web Services EMEA SARL (DynamoDB) | User record: e-mail address and purchased plan | E-mail address, plan | Luxembourg — Frankfurt (eu-central-1) | Processing in the EU | no |
Part B: Data providers and sources
On a lookup these providers receive only the search key (e.g. e-mail address, domain, LinkedIn URL, name and company or search filters), never the rest of the list. They are controllers of their own data; ListPlus is the tool with which the customer queries them. Whether they count as sub-processors or as independent recipients for the search key is being clarified with our lawyers.
| Service provider | Service | Data transmitted | Seat / location | Third-country safeguard | Customer can switch off |
|---|---|---|---|---|---|
| Prospeo | B2B contact database (segment search), verified business e-mail addresses and phone numbers, company profiles, job changes | Search filters or the search key: LinkedIn URL, name and company, domain | Prospeo SAS, Paris, France — [TO CHECK: Confirm the seat] | Processing in the EU | yes (provider:prospeo) |
| FullEnrich | Business e-mail address and phone number from name and company or LinkedIn URL (waterfall through 20+ sources) | Name and company, domain or LinkedIn URL | FullEnrich Corp., San Francisco, USA | Standard Contractual Clauses according to the provider's privacy policy | yes (provider:fullenrich) |
| CompanyEnrich | Company data from domain or company name (industry, size, location, website); workforce, decision makers, similar companies | Domain or company name; for person lookups name and company | Company in Turkey — Servers, databases and backups in Finland — [TO CHECK: Clarify the safeguard for access from Turkey] | Processing in the EU (Finland); Turkey without an adequacy decision | yes (provider:companyenrich) |
| HarvestAPI | Publicly visible LinkedIn data: profile, company, profile search, posts and reactions, open jobs; the basis of the Watchlist alerts | LinkedIn URL, name and company, post URL | Seat: to be confirmed — [TO CHECK: Confirm seat and safeguard] | To be confirmed | yes (provider:linkedin, alerts) |
| Enrich.so | Publicly visible LinkedIn profile data from a URL (fallback when HarvestAPI does not answer) | LinkedIn URL | Seat: to be confirmed — [TO CHECK: Confirm seat and safeguard] | To be confirmed | yes (provider:linkedin) |
| MillionVerifier | Checking whether an e-mail address is deliverable | The e-mail address | GBD Software as a Service Private Limited Company, Budapest, Hungary | Processing in the EU | yes (provider:millionverifier) |
| Serper (Google-Suche) | Google search results: LinkedIn profile URL for name and company, company website, news, web search of the AI research, confirmation of recognised contacts in the Inbox | The search term (e.g. name and company) | Serper, seat: to be confirmed — [TO CHECK: Confirm seat and safeguard] | To be confirmed | yes (provider:serper) |
| Hacker News (Suche über Algolia) | Public stories and comments on Hacker News including user names, for the AI research | Only the search term, never data from customer lists | Algolia, Inc., San Francisco, USA — public interface without an account | No contract; only the search term is transmitted | no |
| Öffentliche Quellen (über Apify gelesen) | Publicly visible pages a scraper reads at the customer's request; the platforms are not our contracting partners, the customer observes their terms | The URL or search called | LinkedIn, Crunchbase, Reddit, X, Google Maps, Similarweb, arbitrary websites | Not applicable (retrieval of public pages) | yes (provider:apify, source:reddit, source:twitter, source:linkedin, source:people, source:sources) |
Part C: Recipients chosen by the customer
Systems the customer transfers data to because it connects or names them itself. The customer is the controller of that transfer; they are listed for completeness.
| Service provider | Service | Data transmitted | Seat / location | Third-country safeguard | Customer can switch off |
|---|---|---|---|---|---|
| Verbundene Systeme des Kunden | Import from and export to systems the customer connects; pipeline targets | The records the customer transfers | HubSpot, Salesforce, Pipedrive, Google Sheets, Airtable, Notion, lemlist (via Pipedream); Instantly, Smartlead, Attio, Close, Slack (with the customer's key) | The customer is the controller of this transfer | yes (connections) |
| Eigener Webhook-Endpunkt des Kunden | Pipeline target “endpoint” | The records the customer transfers | Named by the customer | The customer is the controller of this transfer | no |
| Die eigene KI des Kunden (Agent-API, MCP, Recherche-Link) | Reading and writing lists and research through an AI system the customer connects | What the connection exposes (columns, sublists, actions) | Chosen by the customer, e.g. ChatGPT, Claude, own agents | The customer is the controller of this transfer | yes (agentApi) |