Summary#
LaunchList holds two very different kinds of data, and the distinction runs through this whole page.
- Data about you, our customer. Your name, your email, your billing details. We decide how that is used, so we are the controller of it.
- Data about your audience. The people who sign up through your form or page. You decide what is collected and why. We only hold and process it on your instructions, so you are the controller and we are your processor.
We do not sell either kind. We do not use your audience to train models. We do not email your audience on our own behalf. We do not delete a customer's audience, on any plan.
1. Data about you (we are the controller)#
| What | Why | Kept for |
|---|---|---|
| Name, email address, password (stored hashed, never in plain text) | To create and secure your account | While your account exists |
| Workspace and project names, settings, brand assets | To run the product for you | While your account exists |
| Billing name, address and card details | To take payment. Card details go directly to Stripe and never touch our servers | As long as Stripe's records require |
| Last active time | To know when to send an account nudge, and when not to | While your account exists |
| Support messages you send us | To answer you | While your account exists |
| How you found us (campaign tags, referring site, first page) | To learn which channels bring customers | While your account exists |
| Approximate location (country, region, city) and browser at signup, never the IP address | To see where customers are and what they use, in our own analytics | While your account exists |
| Questions you ask the assistant, and its answers | To answer you and to improve the answers | 180 days |
| Server logs (IP address, user agent, request path) | Security, abuse prevention, debugging | A rolling short window |
| If you connect the Webflow app: the ID, name and domains of the sites you approve, your Webflow user ID, and Webflow's access token for those sites (the token is encrypted) | To show you your forms inside the Webflow Designer and to receive signups from them | Until Webflow ends the app's access, or your account is deleted. Details in §6 |
Our lawful bases are performance of the contract with you (running the product you pay for), legitimate interests (keeping the service secure and working), and consent where we ask for it, such as product announcement email.
Security and account email is not optional, because it is how we tell you your card failed or your password changed. Everything else can be switched off in your notification settings.
2. Data about your audience (we are your processor)#
When someone signs up through your form, page, embed or API, we store what your form asked for on your behalf. You choose the fields. A LaunchList form does not require an email address; the identity field can be an email, a phone number, a username, or nothing at all.
Alongside what your form collects, a signup record can carry:
- The identifier the person gave, and the raw form of it as typed.
- Verification state, and the token used to confirm it.
- Referral data: their referral code, who referred them, and how many people they referred.
- Location: country, region, city, postal code, approximate coordinates and timezone, derived at the edge from the connecting IP address.
- The user agent string.
- A hashed IP address. The audience record keeps only a hash of the IP address, never the address itself. It is hashed on the way in, which is enough to spot the same source submitting repeatedly, and not enough to recover the address. The raw address is seen in two other places, both short-lived: the counter that limits recovery emails on a Webflow form (below) holds it for 60 seconds, and our server logs record the address of each request (see the table above).
- Anti-abuse signals used to decide whether a signup is real, including a device fingerprint built in the visitor's browser, and a resulting trust verdict.
A workspace can turn on a privacy mode that keeps the country only and stores no IP hash.
Forms on a Webflow site. A form added by the LaunchList Webflow app is a standard Webflow form. When someone submits it, their browser sends what they typed straight to LaunchList, with the signup data above except the device fingerprint: the app puts no script on the site, so nothing builds one. We also keep the address of the page it was posted from (the site's domain only, not the page path) when it is one of the connected site's own domains. A post that names another site, or none, is a signal we weigh with the others, and what it does depends on the spam setting you chose for the project (it holds the signup for review under the default setting, and does nothing under the relaxed one). Webflow adds its own bot-check token to the form; we discard it unread, never store it and do not use it to protect the form, so that check does not guard this address. When a returning address signs up again and we email it a link to its own spot, a counter keyed on the visitor's IPv4 address (or IPv6 prefix) limits how often that can happen. It is kept for 60 seconds and then gone; our server logs also record the IP address of the request (see the table above). The referral cookie below is cleared whenever a signup is recorded, whether the address is new or already on the list.
If you send one of your own Webflow forms to LaunchList, Webflow sends us each submission instead, so we receive no IP address, browser or location for it. Webflow sends the whole submission, so we receive every input and then drop what you did not match to a LaunchList field before anything is stored: only matched inputs are kept. We also drop any input whose name looks like a password or a code (for example password, one-time code, PIN, secret or token), and any input Webflow's own list of your form's fields says is a password right now. We read that list from Webflow again for every submission, never from a saved copy. If Webflow cannot answer, or its answer does not describe your form's fields, we store nothing and ask Webflow to retry; Webflow retries a limited number of times, and a submission it still cannot deliver after those tries is lost, because we do not keep it. Webflow does not label any other kind of credential, so an input with a different name that Webflow does not call a password is treated like any other. A submission from a Webflow form carries no referral, referrer, landing page or campaign tags into LaunchList, whatever it contains.
We process this only to provide the product to you. We do not enrich our own records with it, and we do not contact anyone in your audience except to send the confirmation, campaign or automation email that you configured. The one exception is page-view analytics on hosted pages, described in §3.
If you are in someone's audience#
You signed up with the company or person whose page you used, not with LaunchList. They decide what happens to your data. To see it, correct it, or have it erased, contact them. If you cannot reach them, write to us at contact@getlaunchlist.com and we will pass the request on.
Every marketing email sent through LaunchList carries a working unsubscribe link, including one-click unsubscribe support in mail clients that offer it.
3. Cookies and local storage#
| Name | Purpose | Type |
|---|---|---|
| Session, sign-in and security cookies | Keep you signed in and protect forms from forged requests | Strictly necessary |
appearance |
Remembers light or dark mode | Preference |
sidebar_state |
Remembers whether the sidebar is collapsed | Preference |
ll_lang |
The language a visitor picked on a hosted page | Preference |
ll_consent |
A visitor's answer to a customer's consent banner (browser local storage) | Preference |
ll_attr, ll_attr_last |
How you reached our site (campaign tags, referring site, first page), kept 90 days | Analytics |
launchlist_attribution |
Which referral link or campaign brought a visitor to a hosted page, kept 90 days | Functional |
ll_fp |
A device fingerprint sent with a signup, used to spot repeated or automated signups | Anti-abuse |
ll_status_proof |
Lets a signup reopen their own status page, kept 90 days (browser local storage) | Functional |
launchlist-pricing |
Which of two price displays this browser was assigned, kept for about a year; first party, not used to track you across sites | Functional |
__Host-launchlist_ref |
Set when someone opens a referral link for a project with a form on a Webflow site: remembers the referral code so the signup that follows is credited. Kept on our embed address (embed.getlaunchlist.com), never on the Webflow site itself, for 30 days or until a signup is recorded from that browser, new or returning | Functional |
| PostHog and Google Analytics storage | Our own analytics, described below | Analytics |
| Support chat storage | Keeps a support conversation open between visits | Functional |
Our own analytics. We use PostHog (product analytics, session replay with every input masked, and error reports) in the app and on our marketing site, Umami (web analytics, and session replay with every input masked on our marketing site only) in the app and on our marketing site, and Google Analytics on our marketing site. None of them loads on a customer's hosted page. We run no advertising cookies.
On a customer's hosted page, tags are the customer's choice. A customer can add their own analytics or ad tags (Google, Meta, TikTok, LinkedIn, X, Plausible, PostHog). Where they have turned on the consent banner, the tags that set cookies or feed an ad network (Google, Meta, TikTok, LinkedIn, X) are genuinely withheld until the visitor accepts, not merely hidden. Cookieless Plausible and PostHog load either way. Those vendors are engaged by that customer, and their use is covered by that customer's own privacy policy, which the banner links to.
4. Who else processes data#
We use these sub-processors to run the product:
| Sub-processor | Purpose | What it reaches |
|---|---|---|
| Laravel Cloud | Application hosting, database, cache, queue workers, file storage | All customer data, including exports, imports and uploaded media |
| Cloudflare | Network edge in front of the product, and storage for database backups | Requests to the product, and a daily database backup kept 30 days |
| Stripe | Subscription billing | Account holder billing details. Not audience data |
| SendGrid | Email to your audience (confirmation, campaigns, automations) and our product notifications | Recipient address and message content |
| ZeptoMail | Account email to our customers (sign-in, security, billing) | Customer's address and message content |
| PostHog | Product analytics, session replay and error reports | Account holder name, email and plan, and activity in the app |
| Google Analytics | Analytics on our marketing site | Page views and sign-up events |
| Umami, which we run ourselves on Netlify and Hetzner | Web analytics, session replay on our marketing site, and sign-up and revenue reporting | Account holder name and email, page views, sign-up and payment events with amounts, and location and browser at signup. Not audience data |
| Laravel Nightwatch | Request and error monitoring | Request details and error reports from the product |
| Fernand | Support chat | Account holder name, email, plan and workspaces, and the conversation |
| OpenRouter and the model providers behind it, and Cohere | AI features (the assistant, page writing, search over our docs) | Your question and the page or project text you are working on. Not audience data |
| Telegram | Internal alerts to our team | Account holder name, email, workspace and payment amount |
| Sign in with Google, and fonts on hosted pages | Your Google identity if you use it. A hosted page visitor's IP address when a font loads | |
| Approximated | TLS certificates and proxying for customer-connected custom domains | Every request to that domain, including a signup submission. Only for workspaces that connect a custom domain |
| Proofy | Email validation | An email address, and nothing else |
Approximated is engaged per custom domain, not per workspace. A certificate for a hostname we do not own has to be issued and terminated at an edge that answers for it. Customers who serve their pages only on a LaunchList URL never touch it.
If a customer turns on a human check with their own Turnstile, reCAPTCHA or hCaptcha keys, that vendor is engaged by the customer.
If a customer connects Slack, the messages they choose (new signups, milestones and digests) are posted to their own Slack workspace. Slack is engaged by that customer, not by us. Names and email addresses are sent only to a private channel that is not shared with another organization, and the customer can hide them there too. When a signup is erased, we delete our messages about them in Slack where Slack lets us. After a customer disconnects Slack, we cannot delete messages already posted.
If a customer connects Google Sheets, they connect their own Google account, and the signup details they choose are added to a spreadsheet in their own Google Drive, one row for each new signup. Google is engaged by that customer, not by us. We ask Google only for access to the spreadsheets LaunchList creates or the customer picks, and nothing else in their Drive. We store the Google account's email address and the access tokens Google gives us, and the tokens are stored encrypted. We do not keep a copy of the spreadsheet's contents. Disconnecting revokes LaunchList's access, and the customer can also remove it in the "Third-party access" section of their Google Account. When a signup is erased, we delete their row in the spreadsheet while Google Sheets is connected. After a customer disconnects, stops syncing a project or changes to another spreadsheet, we cannot delete rows already in the old one. LaunchList's use and transfer to any other app of information received from Google APIs will adhere to the Google API Services User Data Policy, including the Limited Use requirements. We use that information only to provide this feature. We do not sell it, use it for advertising, or use it to train AI models.
AI assistants you connect. You can connect an AI assistant to your account, such as ChatGPT, Claude, Codex or Cursor. You choose to, and you approve one workspace. What the assistant can read and change is what you ask it to do through LaunchList's tools: your projects, pages, signups and contact details, stats, segments and emails. That data then goes to the assistant's provider, under the provider's own terms and privacy policy, not ours. The provider is engaged by you, not by us, and we do not choose what you ask the assistant. Our tools tell the assistant to publish a page, send a broadcast or invite people only after you confirm in the chat, and publishing and sending are also two steps on our side: the second step is refused without the single-use confirmation the first one returns. For this use we keep the connection (which assistant, which workspace, when you approved it and when it was last used), a daily count of tool calls per tool and per assistant, and for 90 days a record of each tool call: which tool, which project and item it acted on, whether it worked and how long it took. We do not record what you asked or what the tools returned. To disconnect an assistant, go to Account settings, Security, Authorized agents, or to Embed & API, AI assistants. It stops the next time it tries. We cannot delete data the provider already holds.
Email validation. Every address is checked before we email it, to confirm it can receive mail and to keep our sending healthy. A customer's settings decide only whether they see the result. A check reaches our validation provider, which receives the email address and nothing else. Basic checks run inside our own infrastructure and reach no third party.
If we add a sub-processor that materially changes this picture, we will update this page.
5. International transfers#
Our infrastructure and our sub-processors operate in more than one country, so your data may be processed outside the country you are in. Our main database and application run in the United States. Where a transfer involves personal data covered by the GDPR, we rely on the transfer terms our sub-processors publish, which for the major ones incorporate the standard contractual clauses. We have accepted those standard terms, not negotiated our own.
6. How long we keep things#
- Your account data: while your account exists. Closing your account deletes it, and your workspaces, immediately. There is no recovery window.
- Your audience: for as long as you keep it. We do not apply a retention limit to a customer's audience on our own initiative, because deleting a customer's list is not a decision that is ours to make. A contact you remove, or a project you delete, is kept in a recoverable state until you erase it or ask us to purge it.
- Automatic erasure, if you turn it on: each workspace can set a retention clock (180 days, or 1, 2 or 3 years) that applies to every project in it and is measured from each signup's own creation date. The default is off. When it runs it erases rather than hides, because the point is not holding the data any more.
- Webflow connection data: until Webflow ends the app's access or your account is deleted. We find out that Webflow ended it when Webflow refuses our token: the next daily check, or sooner if the Designer panel or another call meets the refusal first. Until we find out, forms the app placed keep taking signups, so uninstalling the app in Webflow stops them in about a day (when our check can reach Webflow), not at that moment; once we know, they answer with a "no longer connected" page and store nothing. Disconnecting a site in LaunchList stops its forms at once but keeps Webflow's access until you uninstall the app in Webflow, so you can connect again without approving again. Your Webflow user ID link is kept for as long as a connected site you (or anyone using your Webflow account) authorized still exists, including after someone else authorized the same site later. It is deleted when the last such site is deleted (Webflow ended access, or the workspace was deleted) or your account is deleted.
- Backups: data can persist in our daily database backups for up to 30 days after deletion.
7. Your rights#
If the GDPR, UK GDPR or a comparable law applies to you, you have the right to access your data, to correct it, to have it erased, to restrict or object to processing, and to receive it in a portable format.
For your own account data, write to contact@getlaunchlist.com.
For audience data, the product gives you the tools to answer these requests yourself, because the request belongs to you as controller:
- Access and portability. The contact's own record shows everything held about that person, and the audience export is a plain CSV you can filter down to them. There is no one-click subject-access package, so assembling the response is a couple of manual steps rather than a single download.
- Erasure. Erasure is distinct from removal. Removing a contact takes them off your list; erasing them destroys their personal data while keeping the referral graph intact, so the people they referred do not silently lose their positions. The one thing kept is the email address on your project's do-not-email list, so that a later import cannot email that person again.
You also have the right to complain to your data protection authority.
8. Security#
Passwords are hashed. The IP address kept with a signup is hashed rather than stored (short-lived rate-limit counters and server logs are described above). Traffic is served over TLS. API keys are stored hashed, scoped, and can be revoked. Team access is controlled by role, and every write is checked against that role on the server. Public endpoints carry rate limits and layered anti-abuse checks.
No system is perfectly secure. If we discover a breach affecting your personal data, we will notify you and the relevant authority as the law requires.
To report a vulnerability, write to contact@getlaunchlist.com.
9. Children#
LaunchList is not intended for children under 16, and we do not knowingly collect their data. If you believe a child has given us personal data, contact us and we will delete it.
10. Changes#
We may update this policy. If a change materially affects you, we will tell you by email or in the product, and the date at the top of this page will change.
11. Contact#
Privacy questions, data requests and vulnerability reports: contact@getlaunchlist.com.
Questions about this document? contact@getlaunchlist.com