Privacy Policy

• Account data: name, email address, password (stored as a hash by our authentication provider), workspace role.
• Workspace content you provide: brand profiles, product information, uploaded files (reviews, keyword exports, flat files), reference images, and the AI outputs generated from them.
• Billing data: your plan, subscription status and payment history. Payments are processed by Lemon Squeezy, our merchant of record — we never see or store card numbers.
• Usage and technical data: actions in the app (audit log), AI usage metrics (tokens, costs), and standard server logs (IP address, browser type) for security and debugging.
• If you save your own AI provider API keys, they are encrypted at rest (AES-256-GCM), used server-side only, never logged and never shown to the client after saving.

• To provide the Service you signed up for — accounts, workspaces, AI generation, billing (contract performance).
• To secure the Service — authentication, audit logs, abuse prevention (legitimate interest).
• To comply with legal obligations — accounting and tax records.
• To send service emails such as invitations, password resets and run notifications (contract performance). We do not send marketing email without consent.
• To measure our advertising campaigns and know which campaign or offer brought you — your consent where the law requires it, otherwise our legitimate interest (see section 7).

We share data only with the processors needed to run the Service:

• Supabase (database, authentication, file storage — EU-hosted project region where available)
• Vercel (application hosting and delivery)
• Lemon Squeezy (merchant of record — checkout, invoicing, tax; Lemon Squeezy is an independent controller for payment data)
• Resend (transactional email delivery)
• AI model providers used to generate your content (e.g. Anthropic, OpenAI, OpenRouter): the prompts derived from your workspace data are sent to the provider selected for your plan or configured by you. On bring-your-own-key plans, your own provider agreement applies.
• Advertising platforms (Meta, Google, LinkedIn, X, TikTok, Reddit, Microsoft) — only on the pages and under the conditions described in section 7.

Some processors are located outside the EEA; where that is the case, transfers rely on adequacy decisions or Standard Contractual Clauses. We never sell personal data.

• Workspace content: kept while your account is active. When you delete your workspace it is closed for a grace period (30 days by default — the exact number is shown in the app when you request deletion; signing in during that period cancels the deletion), after which products, generated texts, images and uploaded files are permanently removed. Account, subscription, usage and billing records are retained as described below.
• Documents uploaded for AI brand-profile import are transient: deleted right after analysis (plus a daily cleanup sweep).
• Billing and revenue records: kept as long as tax law requires (up to 10 years in Romania). This includes the record of an offer you redeemed (the offer, code, dates and amounts) — without its campaign details, which are erased when a deleted workspace is purged.
• Server logs: kept for a short rolling window for security and debugging.

Under the GDPR you can request access to, correction of, deletion of, or a portable copy of your personal data, object to or restrict certain processing, and withdraw consent where processing is based on consent. Write to support@listvamp.com and we will respond within one month. You may also lodge a complaint with your supervisory authority — in Romania, ANSPDCP (dataprotection.ro).

We never sell personal data. Advertising cookies are used only on our offer pages and the steps that follow them, as described in section 7. Besides those, two kinds of storage exist:

• Strictly necessary — used without consent: your authentication session, interface preferences (language, theme), the record of the cookie choices you make, and — when you choose an offer on one of our offer pages — a first-party cookie (lv_offer, up to 30 days) naming that offer, so its discount can be applied when you subscribe.
• Referral tracking — used only as described next: we run an affiliate programme, so that creators who recommend ListVamp are paid a commission when someone they referred subscribes. When you arrive through a referral link (a link carrying ?aff=), we store the referral code in a first-party cookie (lv_aff) for up to 90 days and, if you create a workspace, on that workspace's record, so the right person is credited if you upgrade later. We also load a tracking script from our payment provider Lemon Squeezy, which identifies your browser by its technical characteristics (a device fingerprint — screen, fonts, graphics and similar), sends that to Lemon Squeezy to match the referral, and stores its own cookie (ls_aff_ref).

Referral tracking is notstrictly necessary, so in the EEA, the UK and Switzerland nothing is stored or read for it until you accept the banner, and declining costs you nothing. Elsewhere it runs by default and the same banner lets you decline. Withdrawing is one click: choose “Decline”, and we delete both referral cookies. The legal basis is your consent (GDPR art. 6(1)(a)); where consent is not required it is our legitimate interest in paying the people who recommend us (art. 6(1)(f)). Blocking cookies in your browser has the same effect.

We advertise ListVamp on social networks and search engines. To measure whether those campaigns work, our offer landing pages — and, for visitors who arrived through one, the signup and checkout-confirmation steps — may load the following advertising tags. The rest of listvamp.com and the app itself do not load them.

• Meta Pixel (Meta Platforms — Facebook and Instagram)
• Google Ads / Google tag, including Google Tag Manager and Google Analytics (Google)
• LinkedIn Insight Tag (LinkedIn)
• X Pixel (X Corp.)
• TikTok Pixel (TikTok)
• Reddit Pixel (Reddit)
• Microsoft Advertising UET tag (Microsoft)

These tags set or read cookies and similar identifiers in your browser and send the vendor information such as the page you visited, the ad you clicked, technical data about your browser and device, your IP address, and events such as signing up or starting a subscription, so the vendor can tell us which ads lead to sign-ups and help us measure and improve our campaigns.

When you arrive through a campaign or offer link, we also store the campaign parameters it carries (UTM tags such as utm_source or utm_campaign), any ad click identifier the platform added (for example gclid, fbclid, li_fat_id, ttclid or msclkid) and the domain of the website that sent you to the offer page (the domain only, never the full address) in the lv_offer cookie and, if you create a workspace, alongside your account, together with the offer you claimed and when you arrived and claimed it — so we know which campaign or offer brought you. These campaign details are stored only where advertising measurement is allowed as described below; otherwise we keep just the name of the offer you chose. They are kept while your account exists; when a deleted workspace is purged they are erased, and only the offer record itself (the offer, code, dates and amounts) stays with the billing records.

In the EEA, the UK and Switzerland the legal basis is your consent (GDPR art. 6(1)(a)): nothing loads and no campaign details are stored before you accept the advertising cookies banner, and declining costs you nothing. Elsewhere the tags load by default on the pages above, on the basis of our legitimate interest in measuring our advertising (art. 6(1)(f)), and you can decline in one click; if your browser sends a Global Privacy Control signal, we treat it as a decline. You can withdraw or change your choice at any time through “Cookie settings” in the footer of our website and of every offer page: we then stop loading the tags, expire the advertising cookies set on our domain and remove the campaign details from the offer cookie.

Each vendor processes the data it receives under its own privacy policy and may combine it with other information it holds about you; several of them are located outside the EEA, where transfers rely on adequacy decisions or Standard Contractual Clauses.

Data is encrypted in transit (TLS) and at rest by our hosting providers; API keys get an additional application-level encryption layer. Access to production data is limited to the operator. Workspaces are isolated from each other at the application layer, and every administrative action is recorded in an audit log.

We may update this policy as the Service evolves; material changes are announced by email or in-app. Contact for any privacy matter: support@listvamp.com.