Legal
Privacy Policy
Last updated: 12 July 2026
Template for review — not legal advice.
This policy explains what personal data Listly processes when you use listly.business and the Listly app, why we process it, and the rights you have under the GDPR.
1. Who we are
The data controller is Listly EURL, based in Paris, France. You can reach us at contact@listly.business for any privacy question or to exercise your rights.
2. Data we collect
| Category | Examples | Purpose | Legal basis |
|---|---|---|---|
| Account data | email, name, password hash, language | Create and secure your account | Contract (Art. 6.1.b) |
| Product photos | images you upload for listing generation | Generate listing content on your instruction | Contract (Art. 6.1.b) |
| Catalog text | titles, descriptions, tags, categories | Store and export your listings | Contract (Art. 6.1.b) |
| Usage data | pages viewed, feature usage, error logs | Operate and improve the service | Legitimate interest (Art. 6.1.f) |
| Billing data | invoice details, payment method token | Process paid subscriptions | Contract & legal obligation |
3. Where your data goes
We use a small set of processors to run the service. Each has a role limited to what we ask of them:
- OpenAI — AI processing of your photos and prompts to generate listing content. Inputs sent through the API are not used to train OpenAI models.
- Supabase (EU region) — database, authentication and file storage for your account and listings.
- Stripe — subscription billing and payment processing.
4. How long we keep data
| Data | Retention |
|---|---|
| Generated listings and photos | 24 months after last activity, then deleted |
| Account data | Deleted within 90 days of account closure |
| Billing records and invoices | Retained as required by French tax and accounting law (typically 10 years) |
| Server and error logs | 30 days |
5. Your rights
Under the GDPR you have the right to:
- Access — obtain a copy of the personal data we hold about you
- Rectification — correct inaccurate or incomplete data
- Erasure — ask us to delete your data
- Restriction — limit how we use your data
- Portability — receive your data in a portable format
- Objection — object to processing based on legitimate interest
- Withdraw consent — where processing is based on consent
- Not be subject to automated decisions with legal effect
To exercise any of these rights, email contact@listly.business. We respond within 30 days.
6. International transfers
Your account, listings and photos are stored in the European Union. When we use OpenAI for AI processing, data is transferred to the United States under the European Commission's Standard Contractual Clauses (SCCs).
7. Security
Data is encrypted in transit (TLS 1.2+) and at rest. Access to production systems is restricted, logged, and requires strong authentication. We keep our stack patched and follow least-privilege principles.
9. Complaints
You have the right to lodge a complaint with the CNIL, the French data protection authority, at cnil.fr. We would appreciate the chance to address your concerns first — please contact us at contact@listly.business.
10. Contact
Listly EURL — Paris, France — contact@listly.business