Privacy Policy

Two roles: form owners and respondents

If you have a Listel account, we are the controller of that data, and this policy is the full story.

If you filled out a form built with Listel, the person or organization that created the form (the form owner) controls the answers you submitted. We process form responses on the owner's behalf. Requests about your answers (access, correction, or deletion) go to the form owner, and we give owners the tools to honor them.

What we collect

• Account data. Your name, email address, and password. Passwords are stored only as a cryptographic hash. We never keep or see the password itself.
• Forms you build. The questions, logic, settings, and design of your forms.
• Form responses. Answers submitted to forms, including partial submissions. Answers typed into a form are saved as the respondent goes, even if they never press submit.
• Uploaded files. Files respondents attach through a form, stored in Amazon S3.
• Usage analytics. Anonymous, cookieless events such as page views and form views, starts, and completions. We use no advertising trackers and no third-party analytics.
• IP addresses. Processed to limit abuse and block spam. We do not store raw IP addresses; analytics use a truncated hash that rotates daily.

How we use it

• To run the service: hosting your forms, collecting responses, showing you analytics.
• To send email: notifications to form owners about new responses, and (on the Pro plan) an auto-reply the form owner configures, sent to the respondent. Our email system only sends; we never receive or scan mail on your behalf.
• To defend against spam and abuse.
• To understand product usage in aggregate and improve Listel.

We do not sell personal data or show ads.

Cookies

We set one cookie: a session cookie that keeps you signed in to your account. There are no tracking cookies and no third-party cookies. If you only fill out a form and never sign in, we set no cookies at all.

Where your data lives

Listel runs on Amazon Web Services (AWS) in the US East (N. Virginia) region: the database on RDS, uploaded files on S3, and outgoing email through SES. AWS is our subprocessor: a vendor that processes data on our behalf. If you buy a paid plan, Paddle.com, our reseller and Merchant of Record, also receives your data, as a controller in its own right, for the sale of the plan, subscription management and payments, and tax compliance and invoicing. Because we host in the United States, using Listel from elsewhere transfers your data there for processing.

Webhooks

Form owners can configure webhooks that send response data to endpoints they choose. Once delivered, that data is governed by the receiving service. Choosing trustworthy endpoints is the form owner's responsibility.

Payments

Our order process is conducted by our online reseller Paddle.com, which is the Merchant of Record for all our orders. Your card details go directly to Paddle and never touch our servers. We receive only what is needed to activate your plan.

Retention and deletion

• Your whole account. Delete it yourself anytime from settings. This permanently removes your forms, responses, and uploaded files immediately; residual copies in backups are purged within 30 days.
• Individual responses. Form owners can delete single responses or all responses of a form at any time.

Your rights

You can access, correct, delete, and export your data. Form owners can export responses as CSV and manage account data directly in the product; for anything it doesn't cover, reach us through our contact form and we'll help.

If you are a respondent, the form owner controls your answers, so send requests to them first. If you can't reach the owner, contact us and we'll assist within our role as processor.

Children

Listel is not directed at children under 14, or under the higher age your country sets for consenting to online services on your own, and we do not knowingly collect their personal data. If you believe a child has provided us data, contact us and we will delete it.

Changes to this policy

When this policy changes, we update it here along with the date at the top. For material changes, we notify account holders by email.

Contact

Questions about privacy, or about our Terms of Service? Reach us through our contact form.