Privacy Policy

Last updated: 24 October 2026

Who is responsible for your data

Listo is a product of Craftsline, an independent software studio registered in the Netherlands (Chamber of Commerce / KVK no. 42187313). Craftsline is the "data controller" under the EU General Data Protection Regulation (GDPR) for the personal data described on this page. Contact: craftslinegroup@gmail.com.

What Listo is

Listo is an independent tool that turns a phone photo into a marketplace-ready listing (title, description, price suggestion, hashtags, and a share pack) using AI. Listo is not affiliated with, endorsed by, or a partner of Vinted, Marktplaats, WhatsApp, Instagram, or Telegram. Sharing to those destinations happens via your device's native share sheet or by copying text you paste yourself — Listo never posts on your behalf.

What we collect, and why it's lawful

• Account info (an email and password-hash pair, generated automatically for your guest account — passwords are stored only as a salted hash, never in plain text; or your Google account email and name if you sign in with Google) — legal basis: performance of our contract with you, i.e. providing the account you asked for.
• Photos you upload, stored on our server to generate your listing and, if you use Studio cleanup, a cleaned-up version. Photos are resized to keep costs down and used only to produce your listing — legal basis: contract performance.
• Generated listing content (title, description, price suggestion, hashtags, share text) and your edits to it — legal basis: contract performance.
• Usage and quota data (how many listings you've generated, internal cost/performance/error logs) — legal basis: our legitimate interest in enforcing fair-use quotas, billing correctly, and keeping the service reliable and secure.
• Purchase/subscription status (via RevenueCat — whether you're on Free or Pro, renewal dates; RevenueCat, not Listo, receives your payment details from Apple/Google) — legal basis: contract performance.
• Product usage analytics (e.g. which screens you open, whether a listing generation succeeded) via PostHog (EU-hosted) and Firebase — legal basis: our legitimate interest in understanding and improving the app. We do not use this for ad targeting or cross-app tracking, and we don't currently show you an App Tracking Transparency prompt because we don't do that kind of tracking.
• Locale: your selected listing language (Dutch, English, French, or German) — legal basis: contract performance.

The listoapp.me marketing site itself does not currently use cookies, analytics, or tracking pixels.

How your photo becomes a listing

When you generate a listing, your photo and some basic instructions are sent to an AI model to extract details (type, color, condition, etc.) and write listing copy. In production this runs through OpenRouter, which routes the request to an underlying model (currently Google's Gemini models, for both listing text and Studio photo cleanup); during development or when no AI provider is configured, a deterministic placeholder is used instead and nothing leaves our server. We don't invent facts about your item the photo doesn't support — the AI is instructed to flag anything it's unsure about instead of guessing. This is AI-assisted content generation, not a fully automated decision with legal or similarly significant effects on you — you review and can edit everything before you share it.

Who we share data with

We do not sell your data, and we do not share your photos or listings with marketplaces, advertisers, or data brokers. We do use these processors, each acting only on our instructions to run the service:

• OpenRouter (AI provider) — receives your photo and generation instructions solely to produce your listing/Studio image.
• RevenueCat (subscription management) — receives purchase/entitlement events to know whether you're Pro.
• PostHog (EU-hosted) and Firebase (Google) — receive product usage analytics and crash/performance data.
• Google — if you use "Continue with Google," Google authenticates you and shares your email/name with us.
• Cloudflare and DigitalOcean — infrastructure providers that host our servers and store your photos; they do not use your data for their own purposes.

International transfers: some of these providers (OpenRouter, RevenueCat, Firebase, Google) are based outside the EU/EEA, including in the US. Where that happens, we rely on the provider's Standard Contractual Clauses (SCCs) or an equivalent safeguard recognised under GDPR Chapter V.

How long we keep it

We keep your account, photos, and listings until you delete them or delete your account. Deleting your account permanently removes your account row, every listing, every photo (original and any Studio-cleaned version), and associated usage logs from our live database — this happens immediately and cannot be undone.

We take an encrypted daily backup of our database so we can recover from a technical failure. A deleted account can still appear in those backups for up to 7 days, after which they are deleted and overwritten. We do not restore backups to bring back deleted accounts; they exist only for disaster recovery. Photographs are not included in these database backups.

Your rights

• Delete your account and all data: available in-app (Home screen → "Delete account"). This is a real, immediate, permanent deletion — not a soft flag.
• Access, correct, restrict, or export (portability) your data, or object to processing based on our legitimate interest: your listings are editable in-app; for anything else, contact us (below) and we'll respond within one month, as GDPR requires.
• If you're in the EU/EEA or UK, these are your rights under GDPR/UK GDPR, with Listo as the data controller for your account.
• Right to complain: you can lodge a complaint with your local data protection supervisory authority — for example the Dutch Autoriteit Persoonsgegevens (autoriteitpersoonsgegevens.nl) if you're in the Netherlands, or your own country's equivalent.

Security

Passwords are hashed (never stored in plain text). Access to your listings and photos requires your login token — other accounts cannot read or list your data. We run on a single small server with a locked-down firewall; databases are never exposed to the public internet.

Children

Listo is not directed at children under 16 and we don't knowingly collect data from them.

Changes to this policy

If this policy changes materially, we'll update the date at the top of this page.

Contact

Questions or data requests: craftslinegroup@gmail.com