Privacy Policy

• Account data: name, email address, password (stored as a hash by our authentication provider), workspace role.
• Workspace content you provide: brand profiles, product information, uploaded files (reviews, keyword exports, flat files), reference images, and the AI outputs generated from them.
• Billing data: your plan, subscription status and payment history. Payments are processed by Paddle, our merchant of record — we never see or store card numbers.
• Usage and technical data: actions in the app (audit log), AI usage metrics (tokens, costs), and standard server logs (IP address, browser type) for security and debugging.
• If you save your own AI provider API keys, they are encrypted at rest (AES-256-GCM), used server-side only, never logged and never shown to the client after saving.

• To provide the Service you signed up for — accounts, workspaces, AI generation, billing (contract performance).
• To secure the Service — authentication, audit logs, abuse prevention (legitimate interest).
• To comply with legal obligations — accounting and tax records.
• To send service emails such as invitations, password resets and run notifications (contract performance). We do not send marketing email without consent.

We share data only with the processors needed to run the Service:

• Supabase (database, authentication, file storage — EU-hosted project region where available)
• Vercel (application hosting and delivery)
• Paddle (merchant of record — checkout, invoicing, tax; Paddle is an independent controller for payment data)
• Resend (transactional email delivery)
• AI model providers used to generate your content (e.g. Anthropic, OpenAI, OpenRouter): the prompts derived from your workspace data are sent to the provider selected for your plan or configured by you. On bring-your-own-key plans, your own provider agreement applies.

Some processors are located outside the EEA; where that is the case, transfers rely on adequacy decisions or Standard Contractual Clauses. We never sell personal data.

• Workspace content: kept while your account is active; deleted or anonymized within 90 days of account deletion.
• Documents uploaded for AI brand-profile import are transient: deleted right after analysis (plus a daily cleanup sweep).
• Billing and revenue records: kept as long as tax law requires (up to 10 years in Romania).
• Server logs: kept for a short rolling window for security and debugging.

Under the GDPR you can request access to, correction of, deletion of, or a portable copy of your personal data, object to or restrict certain processing, and withdraw consent where processing is based on consent. Write to support@listvamp.com and we will respond within one month. You may also lodge a complaint with your supervisory authority — in Romania, ANSPDCP (dataprotection.ro).

The app uses strictly necessary cookies only: authentication session cookies and interface preferences (such as theme). We do not use advertising or cross-site tracking cookies.

Data is encrypted in transit (TLS) and at rest by our hosting providers; API keys get an additional application-level encryption layer. Access to production data is limited to the operator. Workspaces are isolated from each other at the application layer, and every administrative action is recorded in an audit log.

We may update this policy as the Service evolves; material changes are announced by email or in-app. Contact for any privacy matter: support@listvamp.com.