Privacy Policy

Last Updated: March 31, 2026

2.1 Introduction

This Privacy Policy explains how ListLabs ("we", "us", or "our") collects, uses, discloses, and protects personal information when you use our website and related services (collectively, the "Services").

We aim to comply with applicable privacy and data protection laws, including, where relevant, the California Consumer Privacy Act ("CCPA"), as amended by the California Privacy Rights Act ("CPRA"), and the EU General Data Protection Regulation ("GDPR").

2.2 Scope

This Privacy Policy applies to:

  • visitors to our website;
  • individuals who interact with us through email, forms, or other channels related to our Services (for example, by joining a waitlist or newsletter, applying for roles, or requesting investor-relations conversations); and
  • users of our Services (as defined in our Terms).

It does not apply to third-party websites, services, or applications that we do not control.

2.3 Personal Information We Collect

The types of personal information we may collect include:

  • Identifiers and contact information: name, email address, phone number, company name (if applicable), and similar identifiers.
  • Form and submission information: information you provide when you fill out forms on the site (for example, to request information, join a waitlist or newsletter, apply for roles, or request investor-relations conversations).
  • Usage and device information: IP address, browser type, device type, operating system, referring URLs, pages viewed, approximate session duration, and other usage data collected via cookies, pixels, and similar technologies.
  • Analytics information: information about how visitors interact with the site, including via cookies and analytics tools.
  • Marketing and communications preferences: your choices about receiving marketing and other communications.
  • Communications and inquiry records: records of your messages and our correspondence.

We may also collect other information that you choose to provide to us.

2.4 How We Collect Personal Information

We collect personal information:

  • Directly from you when you browse the website, complete forms (for example, to join a waitlist or request investor-relations conversations, apply for roles, or upload content), or otherwise communicate with us;
  • Automatically through cookies, pixels, and similar technologies when you visit or use the Services; and
  • From third parties such as analytics and advertising providers, and other service providers we use to operate and improve the Services (if applicable).

2.5 How We Use Personal Information

We use personal information for the following purposes:

  • Providing and operating the site: running the website and handling waitlist/newsletter sign-ups and inbound form requests.
  • Communicating with you: responding to questions, sending administrative messages, confirming requests where applicable, and providing basic support.
  • SMS communications: delivering verification codes, platform access notifications, account activity alerts, and other transactional or informational messages via text message to the phone number you provide (see Section 2.12 for full details).
  • Marketing and waitlists: managing newsletters, waitlists, and other marketing programs, including sending updates you have requested about our offerings or availability.
  • AI and automated tools to process submissions: reviewing, organizing, managing, and flagging information you submit for review and quality control; AI outputs are not guaranteed and may be reviewed by humans where appropriate.
  • Improving and personalizing the site: tailoring content and features and understanding how visitors use the site.
  • Advertising and outreach (where permitted by law): supporting paid ads and advertising optimization, including measuring performance and, where permitted by law, using analytics and similar tools to refine campaigns.
  • Security, compliance, and protection: monitoring for and addressing fraud, security, or technical issues, complying with legal obligations, enforcing our Terms, and protecting our rights and the rights of others.

We will only use personal information for the purposes described above (or compatible purposes), unless we obtain your consent for other uses as required by law.

2.6 Legal Bases for Processing (GDPR)

Where the GDPR applies, we rely on one or more of the following legal bases:

  • Contract / pre-contract steps: to provide the Services and respond to your inquiries or submissions.
  • Legitimate interests: to operate the Services, improve the site, secure our systems, and run analytics—balanced against your data protection rights.
  • Consent: where we rely on consent (for example, for certain marketing communications, SMS messaging, or non-essential cookies), you can withdraw consent at any time.
  • Legal obligations: to comply with legal or regulatory requirements.

2.7 How We Share Personal Information

We may share personal information with:

  • Service providers and vendors who perform services on our behalf (for example, hosting, analytics, CRM/email delivery, SMS delivery, marketing automation, customer support, and other infrastructure and operational vendors), subject to appropriate contractual safeguards;
  • Business partners where you choose to interact with or connect our Services to their services;
  • Professional advisors (such as lawyers, accountants, and auditors) when necessary for the services they provide to us;
  • Authorities and law enforcement when required by law or to protect our legal rights, users, or others; and
  • Successors or acquirers in connection with a merger, acquisition, reorganization, or sale of assets, subject to applicable safeguards and law.

Sell / Share (CCPA/CPRA): We do not sell or share personal information for cross-context behavioral advertising at this time.

If, in the future, we begin selling or sharing personal information as described in the CPRA (for example, for cross-context behavioral advertising), we will provide the required opt-out mechanism(s) and update this Privacy Policy as required by law.

We do not knowingly sell the personal information of children under 16.

2.8 Cookies and Similar Technologies

We use cookies, pixels, and similar technologies to:

  • enable core functionality of the website and Services;
  • remember preferences and settings;
  • understand how you interact with the Services; and
  • support marketing and advertising efforts where permitted by law.

Depending on your location, you may see a cookie banner or controls that allow you to manage your cookie preferences. You can also adjust your browser settings to block or delete cookies, but this may affect the functionality of the Services.

2.9 Data Retention

We retain personal information for as long as necessary to fulfill the purposes described in this Privacy Policy, unless a longer retention period is required or permitted by law.

Where required by law (including California), we retain personal information based on criteria such as:

  • the type of data,
  • the purpose for which it was collected,
  • whether we still need the data for business purposes described in this Privacy Policy,
  • legal, regulatory, accounting, and reporting obligations, and
  • whether retention is needed to resolve disputes or enforce agreements.

When personal information is no longer needed, we delete or anonymize it in accordance with applicable law and our retention practices.

2.10 Your Rights (GDPR and CCPA/CPRA)

Depending on your location and applicable law, you may have rights with respect to your personal information, including:

  • Access and portability: request access to or a copy of personal information and, in certain circumstances, receive it in a portable format;
  • Correction: request correction of inaccurate personal information;
  • Deletion: request deletion in certain circumstances;
  • Objection and restriction/limitation: object to certain processing or request limitations in certain circumstances;
  • Withdraw consent: withdraw consent where processing is based on consent (without affecting processing already completed before withdrawal).

GDPR: If GDPR applies, you may also have the right to lodge a complaint with your local supervisory authority.

CCPA/CPRA (California): If CCPA/CPRA applies, you may also have rights such as:

  • know/access,
  • delete and correct (subject to exceptions),
  • opt out of certain data sharing for cross-context behavioral advertising (if/when we engage in such sharing as defined by CPRA), and
  • non-discrimination for exercising your privacy rights.

We may need to verify your identity before responding to certain requests, as required by law.

2.11 Email Marketing and Opt-Out

If you receive marketing emails from us, you can opt out at any time by:

  • clicking the "unsubscribe" or "opt-out" link in the email; or
  • contacting us at legal@list-lab.org.

Even if you opt out of marketing communications, we may still send you non-promotional messages related to your requests or communications with us (for example, administrative messages or confirmations related to waitlist/newsletter requests).

2.12 SMS / Text Messaging Privacy

2.12.1 What We Collect

When you provide your mobile phone number during registration or through the Services, we collect:

  • Your mobile phone number;
  • Your SMS opt-in consent and the date/time it was given;
  • Records of messages sent and received (content, timestamps, delivery status); and
  • Opt-out requests and dates.

2.12.2 How We Use Your Phone Number and SMS Data

We use your phone number and related SMS data solely to send recurring messages for the following purposes:

  • Delivering one-time verification codes to authenticate your identity;
  • Sending platform access notifications (e.g., when your account is activated or a new feature becomes available to you);
  • Sending account activity alerts relevant to your account;
  • Sending administrative or security-related messages; and
  • Maintaining records of consent, opt-out status, and message delivery for compliance purposes.

We do not use your phone number or SMS opt-in data for promotional or marketing messaging unrelated to your account activity.

2.12.3 How We Share SMS Data

We do not sell, rent, or share your phone number or SMS consent data with third parties for their marketing or promotional purposes.

We may share your phone number with:

  • SMS service providers (e.g., LeadConnector/GoHighLevel or similar platforms) solely to deliver messages on our behalf, subject to contractual data processing obligations; and
  • Authorities or legal process only where required by law or legal obligation.

Our SMS service providers are contractually prohibited from using your phone number or message data for any purpose other than delivering messages on our behalf.

2.12.4 Opt-Out and Data Deletion

You may stop receiving SMS messages at any time by replying STOP to any message. Upon opt-out:

  • We will send one confirmation message and cease all further SMS communications;
  • Your phone number will be flagged as opted-out in our systems; and
  • You may request deletion of your phone number by contacting legal@list-lab.org.

Opting out of SMS does not affect your account status or access to the Services through other channels.

2.12.5 Retention of SMS Data

We retain your phone number and SMS consent records for as long as your account is active or as required to comply with legal and regulatory obligations (including carrier and TCR record-keeping requirements). Message delivery logs are retained for up to 12 months for troubleshooting and compliance purposes and then deleted or anonymized.

2.12.6 Carrier Disclosure

Message and data rates from your wireless carrier may apply to messages you send or receive through the SMS Program. ListLabs is not responsible for carrier charges. Carriers are not liable for delayed or undelivered messages.

2.13 Data Security

We use reasonable technical and organizational measures designed to protect personal information from unauthorized access, use, or disclosure. However, no method of transmission over the internet or method of electronic storage is completely secure, and we cannot guarantee absolute security.

If a data breach occurs that must be reported under applicable law, we will notify you and/or the appropriate authorities as required by law.

2.14 International Data Transfers

If you access the Services from outside the country where our servers or service providers are located, your personal information may be transferred to, stored, and processed in other jurisdictions with different data protection laws than your country.

Where required by law (for example, under GDPR), we implement appropriate transfer safeguards, such as standard contractual clauses.

2.15 Children's Privacy

The Services are not directed to children under 16, and we do not knowingly collect personal information from children under 16. If we learn that we have collected personal information from a child under 16, we will take reasonable steps to delete it as required by law.

2.16 Automated Decision-Making

We do not use your personal information to make automated decisions that produce legal effects or similarly significant effects about you, unless we clearly notify you and provide any required choices or safeguards.

2.17 Changes to This Privacy Policy

We may update this Privacy Policy from time to time. When we do, we will revise the "Last Updated" date at the top of this Privacy Policy and, where required by law, provide additional notice.

Your continued use of the Services after the updated Privacy Policy becomes effective indicates your acceptance of the changes.

2.18 How to Contact Us

If you have any questions, concerns, or requests regarding this Privacy Policy or our privacy practices, including GDPR or CCPA/CPRA-related requests, please contact us at legal@list-lab.org or at:

1968 South Coast Highway #2253 Laguna Beach, CA 92651.