Privacy Policy

1. Data Controller

List AI is operated by:

2. What We Collect

We do not collect payment information directly. If we introduce paid plans in the future, payments will be handled by a certified third-party processor.

3. Legal Basis for Processing

We process personal data under the following legal bases (GDPR Art. 6):

• Consent — when you submit the waitlist form, you consent to us storing and using your email to contact you about List AI.
• Contract — when you use the List AI SaaS service (future), processing is necessary for performing our service agreement.
• Legitimate interest — for security, fraud prevention, and maintaining service reliability through standard server logs.

4. How We Use Your Data

• Communicating with waitlist subscribers about product availability and early access
• Providing and improving the List AI service (product matching, cart filling, analytics)
• Processing product catalog data through AI models to deliver search and matching features
• Monitoring service performance, security, and preventing abuse
• Complying with legal obligations

5. Third-Party Processors

We share data only with trusted service providers necessary to operate List AI:

Important: OpenAI processes only product catalog data (product names, descriptions, categories) to power our AI matching features. We never send user personal information (names, emails, addresses) to OpenAI.

All processors are bound by data processing agreements. We do not sell your personal data to any third party.

6. Data Retention

• Waitlist data — retained until product launch or until you withdraw your consent, whichever comes first.
• SaaS service data — retained for the duration of your service agreement and deleted per the terms of the agreement upon termination.
• Server logs — retained for 90 days, then automatically deleted.

7. Data Security

We take the security of your data seriously and implement appropriate technical and organizational measures, including:

• Encryption in transit (TLS/SSL) and at rest
• Infrastructure hosted within the EU (AWS eu-north-1)
• Access controls and authentication for all internal systems
• Regular security reviews and monitoring

8. Your Rights

Under the General Data Protection Regulation (GDPR), you have the right to:

• Access — request a copy of your personal data
• Rectification — correct inaccurate or incomplete data
• Erasure — request deletion of your personal data
• Portability — receive your data in a structured, machine-readable format
• Restriction — restrict how we process your data
• Objection — object to processing based on legitimate interest
• Withdraw consent — at any time, without affecting the lawfulness of prior processing

To exercise any of these rights, contact us at support@gladmade.com. We will respond within 30 days.

9. Supervisory Authority

If you believe your data protection rights have been violated, you have the right to lodge a complaint with the Estonian Data Protection Inspectorate:

10. Cookies

The gladmade.com website uses only essential cookies necessary for the website to function (e.g., session management). We do not use tracking cookies, advertising cookies, or third-party analytics cookies.

If this changes in the future, we will update this policy and implement appropriate consent mechanisms.

11. Changes to This Policy

We may update this Privacy Policy from time to time. Material changes will be communicated via email to waitlist subscribers or through a notice on our website. The "Last updated" date at the top of this page will always reflect the most recent revision.

12. Contact Us

If you have any questions about this Privacy Policy or how we handle your data, reach out to us: