Subprocessors and other recipients
This page lists the companies that handle personal data for Listed Local, what they do and where. Agencies on paid plans get 30 days' notice by email before we add or replace a subprocessor that handles their workspace data, and can object as the data processing agreement describes.
Service providers that process data for us
| Provider | What they do for us | Personal data involved | Where | Transfer safeguard | In use |
|---|---|---|---|---|---|
| Vercel Inc. | Hosts the website and server functions, runs the edge firewall and first-level rate limits, keeps request logs | IP address, request details, all data passing through the app | Server functions in the European Union (Stockholm, Sweden). Vercel is based in the United States; its edge network and request logs are global. | Standard Contractual Clauses | Now |
| Supabase, Inc. | Database for scans, AI checks, results-chat conversations, leads, rate limits, the cost ledger, and agency accounts and sign-in sessions | Everything we store | European Union (Stockholm, Sweden) | Standard Contractual Clauses for any access from outside the EU | Now |
| Cloudflare, Inc. | Turnstile bot check. Cloudflare also uses these signals for its own purposes (see the next table). | IP address, browser and device signals | Global network | Standard Contractual Clauses | Now |
| DataForSEO OÜ | Search data: Google Maps results for each grid point, and answers from ChatGPT, Gemini and Perplexity (and, for agency plans, Google AI Mode) | Search text, search terms, grid coordinates, city, business names. Not your IP address or email address. | European Union (Tallinn, Estonia). Its own providers include cloud services in the United States. | None needed for an EU company. For its own providers outside the EU, DataForSEO uses Standard Contractual Clauses or adequacy decisions. | Now |
| MapTiler AG | Map image tiles, loaded by your browser | IP address, page address | Switzerland and the EEA. Tiles are delivered through Cloudflare's global network, which holds IP addresses in memory for up to 20 minutes. | EU adequacy decision for Switzerland | Now |
| Resend, Inc. | Sends sign-in links, report emails, lead emails, and contact form messages to our support inbox with their confirmations | Email address, email content | European Union (Ireland) for sending; Resend is based in the United States | EU-U.S. Data Privacy Framework; Standard Contractual Clauses | Now |
| Foo Monk, LLC, doing business as Instantly.ai | Sends and warms up the one-time email to US businesses we write to (see the privacy policy, "Businesses we contact"), keeps its block list and reports bounces and unsubscribes | Business name, address, website and business email address, and the ranking figures in the email. No visitor data. | United States | Not needed for a US recipient business. Instantly's own transfers rely on Standard Contractual Clauses and the EU-U.S. Data Privacy Framework. | When the cold-email pilot is on |
| PostHog, Inc. | Usage analytics: which pages and steps visitors use, without cookies | IP address (used for a one-day visitor code, then deleted), page addresses with identifiers removed, browser and device type | European Union (Frankfurt, Germany), PostHog's EU Cloud | Standard Contractual Clauses for any access from outside the EU | When analytics is turned on |
| Slack Technologies, LLC | Internal alerts and hand-offs from the support assistant to a person | Ticket and lead numbers, market, and a short summary of the request, without names or contact details | United States | Standard Contractual Clauses | Now |
| Anthropic, PBC | Claude, the AI model behind the AI summary of your results, the results chat ("Ask about your results") and our automated support assistant | AI summary: the numbers of your scan, the names of the business and its competitors from Google, and whether each AI assistant named the business, without your IP address, your email address or the assistants' answers. Results chat: questions, answers and the scan they are about, without your IP address or email address. Support: messages, email address, anything you include in them. | United States | Standard Contractual Clauses | The AI summary and the results chat, when they are switched on; the support assistant, when it goes live |
| Google (Google Workspace) | The support@ and privacy@ inboxes, which receive contact form messages, and our replies from them | Support messages, name and email address, anything you include in them | Google's data centres worldwide | EU-U.S. Data Privacy Framework; Standard Contractual Clauses | Now |
Companies that receive data as their own controller
These companies decide for themselves how to use the data they receive, under their own privacy policies.
| Company | What they receive | When |
|---|---|---|
| Partner local SEO agencies | Your email address, the business, your market and your scan results | Only if you choose "Match me with a local SEO specialist". We tell you which agency by email. |
| Paddle.com Market Limited (United Kingdom) | Your name, email, billing details and payment details | When you buy a paid plan. Paddle is the merchant of record. |
| Cloudflare, Inc. | Turnstile signals: IP address, browser and device signals | When the bot check runs. Cloudflare uses them to improve its bot detection. |
| Ad-click identifier, page, conversion event, IP address and browser details | Only if you accept advertising cookies. Google is an independent controller for this data, not our processor. |
Services our providers query
To build a scan and the AI check, DataForSEO queries Google Maps, ChatGPT, Gemini and Perplexity, and for agency plans Google AI Mode. Those services receive the search terms and locations, not your IP address, email address or any other data about you.
Questions
privacy@listedlocal.io. For anything else, use our contact page.