Privacy notice

This explains what happens to personal details you give Lister, in plain words. It covers the forms on this site, email you send us, the analytics that run while you read it, the payment step if you buy a placement, and the emails we sometimes send to companies first. Last updated 14 October 2026.

Who is responsible

The controller for this data is Lister.ai, Sepapaja tn 6, Tallinn 15551, Estonia. Write to hello@lister.ai about anything on this page and a person will answer.

What we collect

When you fill in a form

The forms on For companies, Contact and the claim box on a company page all send us the same things: the company or product name, its website, your name, your email address, your message, and which list or company page you were looking at when you wrote. That is everything. There is no hidden field, and we do not buy or append anything to it from elsewhere.

The robot check and the website lookup

Before a form sends, and before the website lookup on Buy a placement reads the homepage you typed in, Cloudflare Turnstile checks that you are a person and not a bot. Usually you see nothing; on the company forms it shows as a tick box. To do that, Cloudflare sees your IP address and details of your browser and device. We get back only a pass or a fail.

To stop those forms and the lookup being abused, we also count how many times each visitor uses them. The count is filed under a one-way scramble (a hash) of your IP address, never the address itself, and is only kept for about a day.

When you email us

Email to Lister arrives in our Google Workspace inbox. We read it, and an assistant built on Google's Gemini model reads sales enquiries and writes the replies. Its answers to ordinary sales questions are sent automatically, without a person reading them first. A reply about a refund, a complaint, a legal question or anything else a person has to decide waits for one of us to read it before it is sent.

If you buy a placement

Checkout is handled by Stripe. You give Stripe your email for the receipt and your card details. Card details never reach Lister. We see the email and what was bought. If you start a checkout and do not finish it, Stripe may email you once with a link back to it.

If you ask to pay by invoice, you give us the legal billing name and address to put on it, and we pass those to Stripe, which issues the invoice.

While you read the site

Our host records the ordinary server logs any website keeps, including your IP address, and we run analytics. The cookies section below says exactly which, and which of them wait for your permission.

If we contacted you first

We sometimes email companies that could appear on, or already appear on, our rankings. For that we use the business contact details of someone at the company, found on the company's own website or in business contact directories: a name, a work email address, a job title and the company. Reply and ask us to stop, or use the unsubscribe link, and you will not hear from us again.

Why we hold it, and our lawful basis

For form submissions and email the basis is legitimate interests, GDPR Article 6(1)(f). You contacted us unprompted, asking to be listed, to claim a listing, or for a reply. Keeping your message so we can read it, answer it, and remember what was agreed is exactly what you expected when you sent it, and there is no way to run a business that replies to people without doing so.

Weighed against that: these are business contact details, not sensitive data. We do not profile you, we do not sell or share your details for anyone else's marketing, and we do not add you to a mailing list. If you would rather we did not hold your message, say so and we will delete it. See your rights below.

The emails we send to companies first rely on the same basis: a short, relevant business message to a work address, which you can stop at any time. Invoicing and delivering a placement you have bought is done to perform our contract with you, Article 6(1)(b), and keeping the records of a sale is a legal obligation, Article 6(1)(c).

How long we keep it

A submission we do not take forward is deleted 24 months after you sent it. The sales cycle here is slow and an enquiry can turn into a conversation a year later, which is why it is not shorter. If we end up doing business with you, we keep the records of that business for as long as we are required to.

Who else sees it

Lister is a small operation and runs on other people's software. These are the companies that handle your details on our behalf:

• Supabase: the database where a form submission is stored once you press send. Older submissions, from before 21 September 2026, are held in Sanity, our content system.
• Google: our email runs on Google Workspace, so your emails and the alert telling us a form arrived pass through Gmail. Google's Gemini model reads sales enquiries and writes the replies, and Google Analytics runs on this site.
• Slack and Buzz: our internal team chat. When a form arrives we post a short alert there, which can include your company, your email address and your message.
• Vercel: hosts the site, so every request including yours passes through it, and provides the traffic and page speed analytics.
• PostHog: product analytics and session recordings, and only if you accept cookies. Anything typed into a form is masked in a recording, so we never see your keystrokes.
• Stripe: payments and invoices, if you buy a placement.
• Cloudflare: the Turnstile robot check on our forms and the website lookup, which sees your IP address and browser details to tell people from bots.
• Smartlead: sends the emails we send to companies first, and records replies and unsubscribes.

Some of these companies are based outside the European Economic Area and the UK, so your details may be transferred and stored abroad under the data protection terms in their contracts with us. Nobody else gets your details. We do not sell them, and we do not pass them to advertising networks.

Cookies and analytics

PostHog, which covers product analytics, heatmaps and session recordings, is switched off and stores nothing at all until you press Accept on the cookie banner. You can change that answer any time with the Cookie settings link in the footer.

Google Analytics, Vercel Analytics and Vercel Speed Insights run on every visit, whatever you told the banner, and the banner says so.

Your rights

Under the GDPR, and the UK GDPR if you are in the UK, you can ask us for a copy of what we hold about you, ask us to correct it, ask us to delete it, ask us to restrict what we do with it, or ask for it in a portable form. Because we rely on legitimate interests, you can also object to us holding it at all, and we will stop unless we have a compelling reason not to, which for an unanswered enquiry we will not.

Email hello@lister.ai and we will act on it. If you are not happy with how we handled it you can complain to a data protection regulator: the Estonian Data Protection Inspectorate at aki.ee, the regulator where you live, or in the UK the Information Commissioner's Office at ico.org.uk.

Changes

If this notice changes in a way that matters, the date at the top changes with it.