Privacy policy

This policy explains what Listed Local (listedlocal.io) collects, why, how long we keep it and what you can do about it. It covers the free checker and the paid agency plans.

Who we are

Listed Local is run by Agily AB, Fleminggatan 21, 112 26 Stockholm, Sweden, company registration number 559426-8079. We are the controller of the personal data in this policy, except for data agencies add to their own workspaces (see "Agency customers" below).

Write to privacy@listedlocal.io about anything in this policy. For anything else, use our contact page.

The short version

• You can use the free checker without an account. We don't ask for your name.
• We use your IP address to stop bots and overuse. Our database stores only a pseudonymous key made from it, never the address itself, and rate-limit records are deleted within 30 days.
• We keep scan results as history. They are about businesses and come mostly from public Google Business Profile listings.
• If you give us your email address in the lead form, we use it only for the option you picked (and for two follow-up emails, if you tick that optional box). We share it with a local SEO agency only if you chose "Match me with a local SEO specialist".
• The summary at the top of your results is written by Anthropic's Claude from the numbers in your scan. If you ask our AI assistant about your results, Claude writes those answers from your scan too.
• Advertising cookies (Google's conversion tag) load only after you accept them, and rejecting is as easy as accepting.
• We count visits and a few steps with PostHog, without cookies or anything stored in your browser.
• We don't sell your personal data.

What we collect and why

When you look up a business and run a scan

What: the text you type to find a business (usually a name and city), the business you pick, the search term you scan and the grid settings. For the business and the businesses ranking around it, we store what the Google Maps results show publicly: name, address, map coordinates, category, rating, number of reviews, whether the profile is claimed, and the position at each grid point.

Why: to run the scan and show you the results.

Who else sees it: our search-data provider receives the search text, the search term and the coordinates of each grid point. It does not receive your IP address or your email address.

Legal basis (GDPR and similar laws): legitimate interests. You asked for the scan, and we need this data to run it.

Your IP address and the bot check

What: the IP address your request comes from. We don't store the address itself in our database: our server turns it into the visitor key described below (for an IPv6 address, from its first half, the /64 network prefix), and rate limits count requests per visitor key in each time window. Cloudflare Turnstile, our bot check, reads signals from your browser, including your IP address, when you look up a business, start a scan or the AI check, ask the results chat your first question, send the lead form, send the contact form or ask for a sign-in link.

Why: every scan costs us money, so we limit free use per visitor and block automated traffic.

Legal basis: legitimate interests in keeping the service available and protecting it from abuse.

How long: rate-limit records are deleted after two days, and always within 30 days. Server request logs, which contain IP addresses, up to 30 days. We check the Turnstile result when you submit and don't store the token afterwards. Cloudflare also uses Turnstile signals to improve its bot detection, as its own controller under its own privacy policy.

The visitor key

Scans, AI checks, results-chat conversations and lead form entries are linked to a pseudonymous visitor key: a keyed one-way hash of your network address. We use it to count your free scans and to make sure only the visitor who ran a scan can run the AI check or ask the results chat about it. After 30 days we remove the key from these records. The scan itself stays as history.

Scan history

We keep completed scans as history. We use them to show the saved result when the same scan is requested again within 24 hours, to compare a business's position over time, to check the quality and cost of the service, and for statistics that don't identify anyone. We review stored history once a year and delete what we no longer use.

City pages

We also run searches ourselves, from a grid of points around the centre of large US cities, and publish only counts from them on pages such as "Google Maps rankings for plumbers in Austin": for example, how many different businesses held the top spot across the grid, and the median rating and number of reviews of the business in first place. These pages name no business, and they hold no data about visitors or their scans. We keep the counts, not the individual results.

Businesses we contact

From time to time we write once, by email, to a business in the United States that appears on Google Maps, to tell it where it shows up in a local search. We use the business's name, address, website, a business email address (found on its website or listing and checked before use) and public ranking figures from a search we ran for it. We do not buy personal data, and we do not track opens or clicks. The legal basis is our legitimate interest in telling businesses about a service that concerns them; where the contact is a sole trader, it is also a business contact in the sense of US law. Every email says who we are, carries our postal address and has a one-click opt-out; we stop at once for an address or domain that opts out or asks us to delete its data, and we keep only a keyed hash of the address on that list. We keep a prospect record for 12 months, or until the business opts out, whichever is first. We send these emails through Instantly (see the service providers table), which receives the business name, address, website and email address and the figures in the email. We do not do this in the EU, the UK, Canada or Australia.

The AI check

What: after a completed scan, our search-data provider asks ChatGPT, Gemini and Perplexity a question that customers in your city might ask. We store the question, the engine and model, the answer, whether and where your business was mentioned, and the sources the answer cited. Answers can name other businesses and sometimes people.

How long: the full answer text 90 days. The derived result (mentioned or not, where, which sources) is kept as history.

Legal basis: legitimate interests, as for the scan.

The AI summary of your results

What: a short summary of a finished scan and its AI check: a headline, what is working, what is holding the business back and what to do first. We store it with the scan, together with the numbers it was written from: how many grid points the business ranks at, the names of the business and of the competitors that Google Maps shows, and for each AI assistant whether and where it named the business. Not the assistants' answer text, and not your IP address, your email address or your visitor key.

How: the summary is written by Claude, an AI model from Anthropic. To write it, Anthropic receives those numbers and names and nothing else about you. It is written once for each scan and AI check and kept, so opening or sharing the results doesn't send anything again. If Claude can't be used, we build a plain summary from the same numbers ourselves. The page says which one you are reading. Summaries can be wrong, and they are not a promise about rankings.

Why: to give you a readable overview of the scan and the AI check.

Legal basis: legitimate interests, as for the scan.

How long: as long as the scan it belongs to, which we keep as history. It is deleted with the scan, for example when you ask us to delete your data.

Questions about your results (the results chat)

What: the questions you type in "Ask about your results", the assistant's answers, the scan they are about and the visitor key. Not your IP address or your email address.

How: the answers are written by Claude, an AI model from Anthropic, working only from your scan, your AI check answers and our help articles. To write an answer, Anthropic receives your question, the recent conversation and that scan data. Answers can be wrong. Please don't put personal details in your questions.

Why: to answer your questions, and to see which questions people ask so we can improve our help articles and the checker.

Legal basis: legitimate interests in answering you and improving our help.

How long: 12 months.

The lead form

What: your email address, the option you picked, the market, the page you were on (including the search term from an ad), the scan the form belongs to, and a record of your consent: the exact wording you agreed to, its version and the time.

What we do with it depends on the option:

• "Email me the report": we email you the report. Legal basis: you asked us to (steps at your request).
• The optional box under "Email me the report" (follow-up emails): if you tick it, we send two more emails from the same address: one 3 days after the report with what to fix first, and one about a week later with a reminder to scan again. Every one has a link that stops them at once, and we send nothing more. Legal basis: your consent, recorded with the wording you saw. If you leave the box empty, you get the report only.
• "Match me with a local SEO specialist": we pass your email address, the business, your market and your scan results to one partner agency that serves your market, and we tell you by email which agency it is. The agency then contacts you and handles your data as its own controller under its own privacy policy. Legal basis: your consent. Partner agencies may pay us for introductions. If no partner covers your area, we tell you and share nothing.
• "I'm an agency: white-label this report": we email you about Listed Local's agency plans. Legal basis: you asked us to.

We don't add you to a newsletter unless you ask for one. Every email we send has a way to stop further emails.

You can withdraw consent to the match at any time. We then stop sharing, and if we already passed your request on, we ask the agency to delete it and give you its name so you can contact it directly.

How long: 24 months after our last contact with you, or sooner if you ask us to delete it.

Support

What: what you write to us, your name and email address if you send the contact form, and anything you choose to include.

The contact form: we don't store your name, email address or message in our database. We email the message to our support inbox (support@listedlocal.io) with your address as the reply-to, and we email you one automatic confirmation that holds nothing you wrote. Resend sends both emails and Google Workspace hosts the support inbox (see the subprocessors page). The form uses the bot check and the visitor key described above. To stop it being used to send email to other people, we also count confirmations per email address, under a keyed one-way hash of the address and not the address itself, and delete that counter within two days. If your address is on our deletion list, we still pass your message to support, marked as such, and send no confirmation.

How: replies may be written and sent by an automated assistant built on Anthropic's Claude. It works only from our help articles and policies, and a person takes over for anything it can't handle. You can ask for a person at any time.

Legal basis: legitimate interests in answering you, or steps at your request.

How long: 24 months after the conversation closes.

Cookies and advertising

The site needs a few cookies to work: a sign-in cookie for agency members and client-portal users, a cookie that remembers an agency's chosen workspace, and one that remembers your cookie choice.

Advertising: if you click "Accept" in our cookie banner, Google's conversion tag for Google Ads loads and tells Google when a visit from one of our ads leads to a finished scan, a sent lead form or a new agency account. Google receives the ad-click identifier, the page, the type of event and your IP address and browser details, never your email address or anything you typed, and we keep ads personalisation (remarketing) off. Until you accept, and if you reject, nothing is sent. It never runs on agencies' white-label pages. Google uses this data as an independent controller under its own privacy policy and may transfer it to the US under the EU-US Data Privacy Framework. The legal basis is your consent, which you can withdraw at any time with the "Cookie settings" link at the bottom of every page; we treat a Global Privacy Control signal as a refusal. Details are in the cookie policy.

Our server doesn't report visits or conversions to ad platforms. If we start, we will report only visits from people who accepted advertising cookies, and we will remove the visitor key from those records after 30 days. The lead form records the search term an ad link carried, as described above.

Usage analytics

What: the pages you visit on listedlocal.io and in the agency app, the page that sent you, campaign parameters in the link (such as utm_source and the search term kw), your browser and device type, and a few named steps: starting a scan, sending the lead form, asking for a sign-in link, and opening or completing a checkout. Not what you type, your email address or business names, and nothing from agencies' white-label pages (share links, the client portal and the lead widget).

Billing events: when an agency's paid plan starts, changes, has a cancellation scheduled or withdrawn, or ends, our server sends PostHog the plan, its billing interval, whether the AI add-on is on and the plan's list price, under the workspace's internal id. Never a name, an email address or payment details, and no person profile is made.

How: our analytics provider, PostHog, receives your IP address with each event. It uses the address, with your browser's details and a salt that changes every day, to make a pseudonymous code that tells visitors apart for one day, and then deletes it. The address isn't stored with the events; at most an approximate location (country and city) is. Nothing is stored in your browser: no cookies and no local storage. We remove sign-in links and other identifiers from page addresses before they are sent.

Why: to see which pages and steps work and where people get stuck, so we can improve the checker and the app.

Legal basis: legitimate interests in understanding and improving our service. You can object at privacy@listedlocal.io; a tracking blocker in your browser also stops it.

How long: 12 months. PostHog deletes older events in its regular clean-ups.

Agency accounts and paid plans

If you create an agency account, we process your account details (work email, name, team members and invitations), your sign-in links and sessions, your plan, and usage. The clients, locations, reports and branding you add to your workspace are workspace data, which we process for you (see "Agency customers"). Legal basis: our contract with you, or steps you asked for before one.

Paddle sells the plans as merchant of record and processes your payment. We receive from Paddle your name, email, country, plan, transaction ids and payment status, never your card number. Legal basis: our contract with you, and legal obligations for accounting.

If you sign up through another agency's referral link, we record which workspace referred yours, so that both can get the free month our terms describe (8.9). To decide it we check with Paddle that your first payment stood, and we check that the two workspaces don't share a member or a Paddle customer. Neither agency is shown the other's name or details: the referring agency only sees how many agencies signed up through its link, and both see the free months they earned. Legal basis: our contract with you.

Agency customers

When an agency adds its own clients, client contacts or client-portal users to a workspace, the agency decides what to add and why. For that data the agency is the controller and we are its processor. The same goes for the details you send through an agency's lead widget on its website: the agency is the controller, its privacy policy (linked next to the form) applies, and we hold and email the details for it. We still use the visitor key and bot check described above to protect the widget from abuse, and the scan it runs is a public search observation like any other. The data processing agreement, part of our terms of use, is the contract for that data, and the data processing summary explains it in short.

If your business appears in our results

Anyone can scan a business or a search term, so a business can appear in our records because someone else looked it up or because it ranked near a scanned business. We collect only what Google Maps results show publicly. This is usually business data, not personal data. For a sole trader, or a business named after a person, it can identify someone.

Our legal basis is legitimate interests in showing how local search results look. Publishing a notice here instead of contacting every business is allowed where contacting each one would take disproportionate effort. You can object at privacy@listedlocal.io and we will look at your request. We can't change what Google shows; changes to your listing go through Google.

Who we share data with

• Service providers who host, store, send or process data for us under contract. They are listed on our subprocessors page.
• Partner agencies, only when you choose "Match me with a local SEO specialist".
• Paddle, when you buy a paid plan.
• Cloudflare, which also uses bot-check signals to improve its bot detection, as its own controller.
• Google, for measuring our Google ads, only if you accept advertising cookies (see "Cookies and advertising").
• Authorities, when the law requires it.
• Professional advisers such as lawyers and accountants, under confidentiality.
• A buyer of the business, if Listed Local is sold or merged. We will tell you before your data becomes subject to a different privacy policy.

We don't sell personal data, and we don't share it for advertising.

Where data is stored and international transfers

Our database is hosted in the European Union (Stockholm, Sweden), and our server functions run there too. Some of our providers are based in, or reach your data from, other countries, including the United States and Switzerland. Where data leaves the EEA, the UK or your own country, we use the safeguards the law provides: an adequacy decision where one exists (for example for Switzerland, or the EU-U.S. Data Privacy Framework for certified US providers), the European Commission's Standard Contractual Clauses, the UK International Data Transfer Addendum, or the equivalent mechanism in your country. Each provider and its safeguard is on the subprocessors page. You can ask us for a copy of the safeguards at privacy@listedlocal.io.

How long we keep data

Data	How long
Rate-limit records (visitor key or, for contact form confirmations, a keyed one-way hash of the email address; counter)	2 days, and always within 30 days
Server request logs	Up to 30 days
Turnstile token	Not stored after the check
Visitor key on scans, AI checks, results-chat conversations and lead form entries	30 days, then removed from the record
Scan results and public business data	Kept as history, reviewed yearly
Full AI answer text	90 days
AI results (mentioned or not, where, cited sources)	Kept as history, reviewed yearly
AI summaries of results	Kept with the scan they belong to, and deleted with it
Results-chat questions and answers	12 months
Lead form entries and consent records	24 months after our last contact, or until you ask us to delete them
Deletion records (date, consent version, one-way hash of the email address, ticket reference, number of records deleted)	3 years
Support conversations	24 months after the conversation closes
Support hand-off notes in our internal chat (ticket number, market, short summary; no names or contact details)	12 months
Usage analytics events (PostHog)	12 months, then deleted in PostHog's regular clean-ups
Agency account data	While the account is open, plus 30 days
Referral records (which workspace referred which, the free months owed and added)	While both workspaces exist; a free month owed is kept until it is added or lapses
Agency workspace data (as processor)	While the workspace exists, then deleted within 60 days of the service ending (90 days after sign-up for a workspace that never had a paid plan), as the data processing agreement describes
Details sent through an agency's lead widget (as processor)	24 months after they arrive, or sooner when the agency asks or its workspace is deleted
Sign-in links and sessions	Deleted within two weeks of expiring (links expire after 20 minutes, sessions after 30 days)
Accounting records	As long as the law requires (7 years in Sweden)

We keep a short deletion record so we can show we acted on your request and don't contact you again.

Security

Data is encrypted in transit. Database access is limited to our server, and row-level security is on for every table. Only the people who run Listed Local can reach production data, and our automated agents get only the access their job needs. If a breach affects your data, we will tell you and the authorities where the law requires.

Your rights

Depending on where you live, you can:

• ask what personal data we hold about you and get a copy
• have it corrected
• have it deleted
• object to our use of it based on legitimate interests
• ask us to restrict its use while we look at a complaint
• receive data you gave us in a portable format
• withdraw consent at any time (this doesn't affect what we did before)
• opt out of the sale or sharing of personal data (US). We don't sell it, and we don't share it for advertising. Our only advertising tag, Google's conversion tag, runs only with your consent and without ads personalisation; the "Cookie settings" link at the bottom of every page lets you change your choice, and we treat a Global Privacy Control signal as a refusal.
• complain to a data protection authority

How to ask: email privacy@listedlocal.io. Write from the email address your request is about, or tell us the address and we will send a confirmation to it. For scans, include the scan link. We usually can't link IP-based records to a person with confidence, and they are deleted within 30 days in any case.

We answer within 15 days and always within the time your local law sets. There is no fee. You can make a request through an authorised agent; we will check the agent's authority with you. If we refuse a request, we explain why, and you can appeal by replying to our answer. A person who was not involved in the first decision will review the appeal.

Rules by country

The rights above apply wherever you are. This section adds what each law requires us to say.

European Economic Area (GDPR). Legal bases: legitimate interests (running the checker, security, scan history), steps at your request (sending the report, answering support), consent (the agency match, the optional follow-up emails and advertising cookies) and legal obligation (accounting). You can complain to the authority where you live or work. Our lead authority is the Swedish Authority for Privacy Protection (IMY).

United Kingdom (UK GDPR and PECR). The same legal bases as the EEA. You can complain to the Information Commissioner's Office (ico.org.uk).

United States (CCPA/CPRA and other state privacy laws). Notice at collection: we collect identifiers (email address, IP address), internet activity (pages and scans you request) and, for paid plans, commercial information (plan and payments). Sources: you, your browser and our search-data provider. We use them for the purposes and periods in this policy. We don't sell personal information, and we don't "share" it for cross-context behavioural advertising. Google's conversion tag runs only with your consent, without ads personalisation, and we honour Global Privacy Control. Passing your details to a partner agency happens only when you direct us to. We don't collect sensitive personal information. You have the rights to know, delete, correct, opt out and not be discriminated against for using them.

Canada (PIPEDA, and Quebec's Law 25). We rely on your implied consent to run the checker and your express consent for the agency match (and for advertising cookies). You can access and correct your data and complain to the Office of the Privacy Commissioner of Canada. The person in charge of personal information is reachable at privacy@listedlocal.io.

Brazil (LGPD). Legal bases: legitimate interest, steps at your request and consent. You have the rights in Article 18 of the LGPD, including confirmation, access, correction, anonymisation, deletion, portability and information about sharing. Our data protection contact is reachable at privacy@listedlocal.io. You can complain to the ANPD.

Mexico (Federal Law on the Protection of Personal Data Held by Private Parties, 2025). You can exercise your rights of access, rectification, cancellation and opposition (ARCO) and withdraw consent by email to privacy@listedlocal.io. We pass data to third parties only as described in this policy.

India (Digital Personal Data Protection Act, 2023). We rely on your consent, given through the lead form (and the cookie banner, for advertising cookies), and on the uses the Act allows without consent where they apply. You can ask for a summary of your data, its correction or erasure, and nominate someone to act for you. Raise grievances with us first at privacy@listedlocal.io, then with the Data Protection Board of India.

Australia (Privacy Act 1988). We handle personal information under the Australian Privacy Principles. Some of our providers are overseas (see "Where data is stored"). You can complain to us, then to the Office of the Australian Information Commissioner.

Japan (APPI). Our purposes of use are those in this policy. We provide your data to a third party, such as a partner agency, only with your consent. Our providers abroad are listed on the subprocessors page, and you can ask us how they protect your data. You can complain to the Personal Information Protection Commission.

Turkey (KVKK, Law No. 6698). This policy is our information notice. Legal bases: legitimate interest, steps at your request and explicit consent (the agency match, and advertising cookies). Transfers abroad use the safeguards the law allows. You can use your rights under Article 11 by writing to privacy@listedlocal.io, and complain to the Personal Data Protection Authority.

Saudi Arabia (Personal Data Protection Law). Legal bases: consent, legitimate interest and steps at your request. Transfers outside the Kingdom follow the PDPL transfer regulations. You can be informed, access, correct and request destruction of your data, and complain to the Saudi Data and AI Authority (SDAIA).

Indonesia (Law No. 27 of 2022 on Personal Data Protection). Legal bases: consent, steps at your request and legitimate interest. Transfers abroad use the safeguards the law requires. You can access, correct and delete your data and withdraw consent by writing to privacy@listedlocal.io.

Automated decisions

We don't make decisions about you with legal or similarly significant effects by automated means. Our rate limits and bot check can automatically refuse a free scan. If you think that happened by mistake, contact us.

Children

Listed Local is for businesses and the people who work for them. It is not meant for anyone under 18, and we don't knowingly collect data from children. If you think a child has given us data, tell us and we will delete it.

Changes to this policy

When we change this policy, we update the date at the top. For important changes we show a notice on the site, and we email paid customers at least 30 days before the change applies.

Contact

Agily AB, Fleminggatan 21, 112 26 Stockholm, Sweden. Email: privacy@listedlocal.io.