Summary#
LaunchList holds two very different kinds of data, and the distinction runs through this whole page.
- Data about you, our customer. Your name, your email, your billing details. We decide how that is used, so we are the controller of it.
- Data about your audience. The people who sign up through your form or page. You decide what is collected and why. We only hold and process it on your instructions, so you are the controller and we are your processor.
We do not sell either kind. We do not use your audience to train models. We do not email your audience on our own behalf. We do not delete a customer's audience, on any plan.
1. Data about you (we are the controller)#
| What | Why | Kept for |
|---|---|---|
| Name, email address, password (stored hashed, never in plain text) | To create and secure your account | While your account exists |
| Workspace and project names, settings, brand assets | To run the product for you | While your account exists |
| Billing name, address and card details | To take payment. Card details go directly to Stripe and never touch our servers | As long as Stripe's records require |
| Last active time | To know when to send an account nudge, and when not to | While your account exists |
| Support messages you send us | To answer you | While your account exists |
| How you found us (campaign tags, referring site, first page) | To learn which channels bring customers | While your account exists |
| Questions you ask the assistant, and its answers | To answer you and to improve the answers | 180 days |
| Server logs (IP address, user agent, request path) | Security, abuse prevention, debugging | A rolling short window |
Our lawful bases are performance of the contract with you (running the product you pay for), legitimate interests (keeping the service secure and working), and consent where we ask for it, such as product announcement email.
Security and account email is not optional, because it is how we tell you your card failed or your password changed. Everything else can be switched off in your notification settings.
2. Data about your audience (we are your processor)#
When someone signs up through your form, page, embed or API, we store what your form asked for on your behalf. You choose the fields. A LaunchList form does not require an email address; the identity field can be an email, a phone number, a username, or nothing at all.
Alongside what your form collects, a signup record can carry:
- The identifier the person gave, and the raw form of it as typed.
- Verification state, and the token used to confirm it.
- Referral data: their referral code, who referred them, and how many people they referred.
- Location: country, region, city, postal code, approximate coordinates and timezone, derived at the edge from the connecting IP address.
- The user agent string.
- A hashed IP address. We do not store the raw IP address of a signup. It is hashed on the way in, which is enough to spot the same source submitting repeatedly, and not enough to recover the address.
- Anti-abuse signals used to decide whether a signup is real, including a device fingerprint built in the visitor's browser, and a resulting trust verdict.
A workspace can turn on a privacy mode that keeps the country only and stores no IP hash.
We process this only to provide the product to you. We do not enrich our own records with it, and we do not contact anyone in your audience except to send the confirmation, campaign or automation email that you configured. The one exception is page-view analytics on hosted pages, described in §3.
If you are in someone's audience#
You signed up with the company or person whose page you used, not with LaunchList. They decide what happens to your data. To see it, correct it, or have it erased, contact them. If you cannot reach them, write to us at contact@getlaunchlist.com and we will pass the request on.
Every marketing email sent through LaunchList carries a working unsubscribe link, including one-click unsubscribe support in mail clients that offer it.
3. Cookies and local storage#
| Name | Purpose | Type |
|---|---|---|
| Session, sign-in and security cookies | Keep you signed in and protect forms from forged requests | Strictly necessary |
appearance |
Remembers light or dark mode | Preference |
sidebar_state |
Remembers whether the sidebar is collapsed | Preference |
ll_lang |
The language a visitor picked on a hosted page | Preference |
ll_consent |
A visitor's answer to a customer's consent banner (browser local storage) | Preference |
ll_attr, ll_attr_last |
How you reached our site (campaign tags, referring site, first page), kept 90 days | Analytics |
launchlist_attribution |
Which referral link or campaign brought a visitor to a hosted page, kept 90 days | Functional |
ll_fp |
A device fingerprint sent with a signup, used to spot repeated or automated signups | Anti-abuse |
ll_status_proof |
Lets a signup reopen their own status page, kept 90 days (browser local storage) | Functional |
| PostHog and Google Analytics storage | Our own analytics, described below | Analytics |
| Support chat storage | Keeps a support conversation open between visits | Functional |
Our own analytics. We use PostHog (product analytics, session replay with every input masked, and error reports) in the app and on our marketing site, and Google Analytics on our marketing site. Neither loads on a customer's hosted page. We run no advertising cookies.
On a customer's hosted page, tags are the customer's choice. A customer can add their own analytics or ad tags (Google, Meta, TikTok, LinkedIn, X, Plausible, PostHog). Where they have turned on the consent banner, the tags that set cookies or feed an ad network (Google, Meta, TikTok, LinkedIn, X) are genuinely withheld until the visitor accepts, not merely hidden. Cookieless Plausible and PostHog load either way. Those vendors are engaged by that customer, and their use is covered by that customer's own privacy policy, which the banner links to.
4. Who else processes data#
We use these sub-processors to run the product:
| Sub-processor | Purpose | What it reaches |
|---|---|---|
| Laravel Cloud | Application hosting, database, cache, queue workers, file storage | All customer data, including exports, imports and uploaded media |
| Cloudflare | Network edge in front of the product, and storage for database backups | Requests to the product, and a daily database backup kept 30 days |
| Stripe | Subscription billing | Account holder billing details. Not audience data |
| SendGrid | Email to your audience (confirmation, campaigns, automations) and our product notifications | Recipient address and message content |
| ZeptoMail | Account email to our customers (sign-in, security, billing) | Customer's address and message content |
| PostHog | Product analytics, session replay and error reports | Account holder name, email and plan, and activity in the app |
| Google Analytics | Analytics on our marketing site | Page views and sign-up events |
| Laravel Nightwatch | Request and error monitoring | Request details and error reports from the product |
| Fernand | Support chat | Account holder name, email, plan and workspaces, and the conversation |
| OpenRouter and the model providers behind it, and Cohere | AI features (the assistant, page writing, search over our docs) | Your question and the page or project text you are working on. Not audience data |
| Telegram | Internal alerts to our team | Account holder name, email, workspace and payment amount |
| Sign in with Google, and fonts on hosted pages | Your Google identity if you use it. A hosted page visitor's IP address when a font loads | |
| Approximated | TLS certificates and proxying for customer-connected custom domains | Every request to that domain, including a signup submission. Only for workspaces that connect a custom domain |
| Proofy | Email validation | An email address, and nothing else |
Approximated is engaged per custom domain, not per workspace. A certificate for a hostname we do not own has to be issued and terminated at an edge that answers for it. Customers who serve their pages only on a LaunchList URL never touch it.
If a customer turns on a human check with their own Turnstile, reCAPTCHA or hCaptcha keys, that vendor is engaged by the customer.
If a customer connects Slack, the messages they choose (new signups, milestones and digests) are posted to their own Slack workspace. Slack is engaged by that customer, not by us. Names and email addresses are sent only to a private channel that is not shared with another organization, and the customer can hide them there too. When a signup is erased, we delete our messages about them in Slack where Slack lets us. After a customer disconnects Slack, we cannot delete messages already posted.
If a customer connects Google Sheets, they connect their own Google account, and the signup details they choose are added to a spreadsheet in their own Google Drive, one row for each new signup. Google is engaged by that customer, not by us. We ask Google only for access to the spreadsheets LaunchList creates or the customer picks, and nothing else in their Drive. We store the Google account's email address and the access tokens Google gives us, and the tokens are stored encrypted. We do not keep a copy of the spreadsheet's contents. Disconnecting revokes LaunchList's access, and the customer can also remove it in the "Third-party access" section of their Google Account. When a signup is erased, we delete their row in the spreadsheet while Google Sheets is connected. After a customer disconnects, stops syncing a project or changes to another spreadsheet, we cannot delete rows already in the old one. LaunchList's use and transfer to any other app of information received from Google APIs will adhere to the Google API Services User Data Policy, including the Limited Use requirements. We use that information only to provide this feature. We do not sell it, use it for advertising, or use it to train AI models.
Email validation. Every address is checked before we email it, to confirm it can receive mail and to keep our sending healthy. A customer's settings decide only whether they see the result. A check reaches our validation provider, which receives the email address and nothing else. Basic checks run inside our own infrastructure and reach no third party.
If we add a sub-processor that materially changes this picture, we will update this page.
5. International transfers#
Our infrastructure and our sub-processors operate in more than one country, so your data may be processed outside the country you are in. Our main database and application run in the United States. Where a transfer involves personal data covered by the GDPR, we rely on the transfer terms our sub-processors publish, which for the major ones incorporate the standard contractual clauses. We have accepted those standard terms, not negotiated our own.
6. How long we keep things#
- Your account data: while your account exists. Closing your account deletes it, and your workspaces, immediately. There is no recovery window.
- Your audience: for as long as you keep it. We do not apply a retention limit to a customer's audience on our own initiative, because deleting a customer's list is not a decision that is ours to make. A contact you remove, or a project you delete, is kept in a recoverable state until you erase it or ask us to purge it.
- Automatic erasure, if you turn it on: each workspace can set a retention clock (180 days, or 1, 2 or 3 years) that applies to every project in it and is measured from each signup's own creation date. The default is off. When it runs it erases rather than hides, because the point is not holding the data any more.
- Backups: data can persist in our daily database backups for up to 30 days after deletion.
7. Your rights#
If the GDPR, UK GDPR or a comparable law applies to you, you have the right to access your data, to correct it, to have it erased, to restrict or object to processing, and to receive it in a portable format.
For your own account data, write to contact@getlaunchlist.com.
For audience data, the product gives you the tools to answer these requests yourself, because the request belongs to you as controller:
- Access and portability. The contact's own record shows everything held about that person, and the audience export is a plain CSV you can filter down to them. There is no one-click subject-access package, so assembling the response is a couple of manual steps rather than a single download.
- Erasure. Erasure is distinct from removal. Removing a contact takes them off your list; erasing them destroys their personal data while keeping the referral graph intact, so the people they referred do not silently lose their positions. The one thing kept is the email address on your project's do-not-email list, so that a later import cannot email that person again.
You also have the right to complain to your data protection authority.
8. Security#
Passwords are hashed. Signup IP addresses are hashed rather than stored. Traffic is served over TLS. API keys are stored hashed, scoped, and can be revoked. Team access is controlled by role, and every write is checked against that role on the server. Public endpoints carry rate limits and layered anti-abuse checks.
No system is perfectly secure. If we discover a breach affecting your personal data, we will notify you and the relevant authority as the law requires.
To report a vulnerability, write to contact@getlaunchlist.com.
9. Children#
LaunchList is not intended for children under 16, and we do not knowingly collect their data. If you believe a child has given us personal data, contact us and we will delete it.
10. Changes#
We may update this policy. If a change materially affects you, we will tell you by email or in the product, and the date at the top of this page will change.
11. Contact#
Privacy questions, data requests and vulnerability reports: contact@getlaunchlist.com.
Questions about this document? contact@getlaunchlist.com