Listoria

Listoria
Start for free

Privacy Policy

This Privacy Policy describes what personal data is processed in connection with the Listoria service (listoria.app) and the Listoria browser extension, for what purposes, on what legal basis and to whom it is disclosed. Capitalised terms have the meaning given in the Terms of Service.

1. Controller

The controller of the personal data of Users and visitors is Dawid Burdek, conducting unregistered business activity within the meaning of Article 5(1) of the Polish Entrepreneurs' Law, address for service: os. Pod Skarpą 20/24, 34-100 Wadowice, Poland (the "Controller").

Contact for personal data matters: kontakt@listoria.app or in writing to the address for service. The Controller has not appointed a data protection officer.

2. Data of Users' clients

Users enter data of their clients and other people involved in projects into the Service (e.g. name, contact details, project address, interview answers, Client Panel comments). For this data the User is the controller, and Listoria processes it only on the User's instructions as a processor, under §11 of the Terms. If your data reached the Service this way, please contact the designer who entered it first. We will help them handle your request.

3. What data we process

  • Account data - e-mail address, name (if provided), password in encrypted form, language, time zone. When signing in with Google: e-mail address, name and profile picture from the Google account.
  • Studio profile data - studio name, logo and contact details entered for use in exports.
  • User Content - projects, product lists, cost estimates, moodboards, interviews, images, files and comments.
  • Document acceptances and consents - date and version of the accepted Terms and Privacy Policy, method of acceptance, browser information, as well as cookie and marketing consent choices.
  • Payment data - processed by Stripe. The Controller receives the customer ID, subscription status, billing details (name or company name, address, tax ID if provided) and the last digits and type of the card. The Controller has no access to the full card number.
  • Browser extension data - the address and content of the product page the User saves, sent only after clicking the extension. The extension does not track browsing history.
  • Technical data - IP address, browser and system type, server logs, application error information, events in the Service and the traffic source (e.g. an ad campaign).
  • Correspondence - messages sent to the Controller and replies, as well as reports and feedback sent from within the Service.

Providing data is voluntary, but an Account cannot be created without an e-mail address, and the Pro Plan cannot be purchased without payment data.

4. Purposes and legal bases

  • Concluding and performing the contract (Account, Free and Pro Plan features, payments, complaints) - Article 6(1)(b) GDPR.
  • Legal obligations (bills, revenue records, handling data requests) - Article 6(1)(c) GDPR.
  • Documenting acceptance of the Terms and consents - Article 6(1)(f) GDPR (legitimate interest: being able to demonstrate conclusion of the contract and compliance).
  • Transactional communication (notifications, trial end reminders, answers to questions) - Article 6(1)(b) and (f) GDPR.
  • Security and error detection - Article 6(1)(f) GDPR (legitimate interest: reliable and secure operation of the Service).
  • Analytics and ad measurement - Article 6(1)(a) GDPR (consent given in the cookie panel), except for anonymous Umami statistics, based on Article 6(1)(f) GDPR.
  • Newsletter and product updates - Article 6(1)(a) GDPR (consent). You can withdraw consent at any time, e.g. via the link in the e-mail footer.
  • Establishing and defending claims - Article 6(1)(f) GDPR.

The Controller does not make decisions about Users based solely on automated processing that produce legal effects or similarly significantly affect them.

5. Recipients and sub-processors

The Controller uses the services of the entities below, only to the extent necessary for the given purpose. Entities marked as sub-processors also process data of Users' clients (§11 of the Terms).

Sub-processors (operating the Service)

  • Supabase Inc. (USA, servers in the EU) - database, file storage and authentication.
  • Vercel Inc. (USA) - application hosting and server logs.
  • Resend, Inc. (USA) - sending e-mails.
  • Functional Software, Inc. (Sentry) (USA, servers in the EU) - application error detection. When an error occurs, the IP address, Account ID, browser information and error trace are sent, with form field content masked.
  • OpenRouter, Inc. (USA) and the model providers it uses (OpenAI, Google) - automatic completion of product data in the extension, column recognition when importing a list from a file and reading items from an imported document (PDF, Word) or pasted text. The product page content, the headers and a fragment of the table, or the text of the imported document are sent, without Account data. The providers have data collection for model training turned off.

Other recipients

  • Stripe Payments Europe, Limited (Ireland) - payment and subscription processing.
  • Google Ireland Limited / Google LLC - Google sign-in, if the User chooses this method.
  • Umami Software, Inc. - anonymous traffic statistics, without cookies or personal identifiers.
  • PostHog, Inc. (USA, servers in the EU) - product analytics and session recording with form field content masked. Only after consent to analytics cookies.
  • Microsoft Corporation (USA) - Microsoft Clarity, recording of cursor movement, clicks and scrolling and heatmaps on public pages of the Service. Recordings do not cover the logged-in area or text typed into forms. Only after consent to analytics cookies.
  • Google Ireland Limited (with possible transfer to Google LLC in the USA) - Google Analytics 4, visit and event statistics, with truncated IP addresses and without Client Panel links. Only after consent to analytics cookies.
  • Google Ireland Limited - Google Ads, ad effectiveness measurement. Only after consent to marketing cookies. Without it, Google receives a signal that consent was not given.
  • Meta Platforms Ireland Limited (with transfer to Meta Platforms, Inc. in the USA) - ad effectiveness measurement. A hashed (SHA-256) e-mail address, IP address and browser information are sent. Only after consent to marketing cookies.
  • Agent Monitor (USA) - recognising AI bots visiting the Service. Only technical request data is sent (page address, HTTP headers, IP address), without form content, cookies or login data. Legal basis: Article 6(1)(f) GDPR.
  • Public authorities, where required by law.

Data is transferred outside the European Economic Area on the basis of an adequacy decision of the European Commission (including under the EU-U.S. Data Privacy Framework) or standard contractual clauses (Articles 45 and 46 GDPR). You can obtain a copy of the safeguards by writing to kontakt@listoria.app.

6. Retention

  • Account data and User Content - for as long as the Account exists. After deletion, data is removed within 30 days, and from backups in their natural rotation cycle.
  • Records of acceptance of the Terms and Privacy Policy - for as long as the Account exists. Records of consents - for as long as the Account exists, and then until claims become time-barred.
  • Billing data - 5 years from the end of the year in which the tax obligation arose.
  • Data processed on the basis of consent - until consent is withdrawn.
  • Correspondence - up to 3 years from the last contact.
  • Technical logs and error information - up to 90 days.

7. Your rights

You have the right to:

  • access your data and receive a copy,
  • rectification,
  • erasure,
  • restriction of processing,
  • data portability,
  • object to processing based on the Controller's legitimate interest,
  • withdraw consent at any time, without affecting the lawfulness of processing carried out before withdrawal.

To exercise these rights, write to kontakt@listoria.app. We will reply within one month. You also have the right to lodge a complaint with the Polish supervisory authority, the President of the Personal Data Protection Office (ul. Stawki 2, 00-193 Warsaw), or with the authority in your country of residence.

8. Cookies and similar technologies

The Service stores cookies and data in browser storage (localStorage) on your device:

  • Necessary - login session, settings, language, record of your cookie choice. No consent required.
  • Analytics - PostHog (ph_* cookies), Microsoft Clarity (_clck, _clsk, on public pages), Google Analytics 4 (_ga, _ga_*) and Listoria's own cookies listoria_ft (up to 90 days) and listoria_lt (until the browser is closed), which remember the traffic source for sign-up statistics. Loaded only after consent.
  • Marketing - Meta Pixel (_fbp, _fbc) and Google Ads (_gcl_*). Loaded only after consent.

You can change or withdraw consent to analytics and marketing cookies at any time: . After withdrawal, the relevant cookies are deleted. You can also delete or block cookies in your browser settings, but disabling necessary cookies will prevent you from logging in.

9. Browser extension

The extension reads the content of the current page only when the User opens it to save a product. It sends this content to the Service only to create a product on the list. The extension does not collect browsing history, does not run in the background on other pages and does not sell or share data for advertising purposes.

10. Data security

The Controller applies technical and organisational measures appropriate to the risk, in particular: encrypted connections (HTTPS), storing passwords as cryptographic hashes, database-level access control (Row Level Security), random, hard-to-guess addresses for files and Client Panel links, and restricting data access to the Controller. Payments are handled by Stripe (PCI DSS Level 1).

11. Minors

The Service is intended for adults, in particular professionals. The Controller does not knowingly process data of persons under 18. If you notice that a minor has created an account, please contact us and the account will be deleted.

12. Changes to this Policy

This Privacy Policy may be updated, e.g. when providers or features of the Service change. We will announce material changes in advance by e-mail and in the Service. The current version is always available at listoria.app/en/privacy-policy.

Last updated: 9 October 2026