Privacy policy

Explained plainly: which data we process, and what for.

1. Controller

Enes Kurt
Gemminger Str. 33, 75031 Eppingen, Germany
Email: support@listimo.ai

2. Overview: what happens with your data?

3. Legal bases

Processing takes place in order to perform the contract or to take steps prior to entering into a contract (Art. 6(1)(b) GDPR), on the basis of your consent, for example for the newsletter and advertising measurement (point (a)), on the basis of legal obligations such as retention duties under commercial and tax law (point (c)), and on the basis of our legitimate interest in secure, stable operation (point (f)). The basis that applies is stated for each processing operation.

4. Service providers used and other recipients

Most of the service providers named here process data on our behalf (processors). Where a provider is a controller in its own right or a joint controller with us, this is stated for the service concerned.

Supabase (user accounts & database)

Account and balance data, your Academy progress (section 6), the data from the Amazon connection (section 14) and — if you switch it on — your two-factor sign-in (the factor of your authenticator app) are stored with Supabase (Supabase Inc.). The project's data centre is located in the EU (AWS region eu-west-1, Ireland), where these data are stored. Supabase Inc. is based in the USA; where Supabase may in individual cases access data from third countries for operation or support, this is based on the EU standard contractual clauses. A data processing agreement (DPA) is in place with Supabase.

Signing in with Google, Apple, Microsoft or Facebook (optional)

Instead of using an email address and password, you can sign in with an existing account at Google (Google Ireland Limited, Gordon House, Barrow Street, Dublin 4, Ireland), Apple (Apple Distribution International Limited, Hollyhill Industrial Estate, Hollyhill, Cork, Ireland), Microsoft (Microsoft Ireland Operations Limited, One Microsoft Place, South County Business Park, Leopardstown, Dublin 18, Ireland) or Facebook (Meta Platforms Ireland Limited, Merrion Road, Dublin 4, Ireland); the sign-in page shows which of these options are offered. If you choose a provider, you are redirected to its page and sign in there; the sign-in is handled through our database provider Supabase (see above). In doing so, the provider transmits to us your email address, an identifier of your account with that provider and — where stored there — your name and profile picture; we never learn your password with that provider. We store this information in your Listimo account, show the name and profile picture in your profile, and record when, during this sign-in, you accepted the terms and confirmed that you act as a business. A profile picture stored with Google is loaded by your browser, when it is displayed (profile, header bar), directly from a Google server (lh3.googleusercontent.com); Google receives your IP address in the process. If you upload your own picture in your profile, it replaces it. The respective provider learns that you are signing in to Listimo and processes the sign-in under its own responsibility according to its privacy terms; this may involve a transfer to the USA (basis: EU-US Data Privacy Framework). The legal basis is the performance of the user contract or of pre-contractual steps which you yourself initiate by choosing this sign-in route (Art. 6(1)(b) GDPR). Signing in with an email address and password always remains possible as well.

Stripe (payment processing)

When you buy credits you are redirected to Stripe (Stripe Payments Europe, Ltd., Ireland). Stripe processes your payment data as a separate controller or as a processor; we only receive a confirmation of the payment and the details needed for bookkeeping. More at stripe.com/privacy. If you provide a VAT ID, we send it to the European Commission's VAT Information Exchange System (VIES) to check it (Art. 6(1)(c) GDPR in conjunction with § 18e of the German VAT Act, or Art. 6(1)(f) GDPR).

Digistore24 (seller packs & partner attribution)

We sell our large credit packs (“seller pack”) through Digistore24 (Digistore24 GmbH, St.-Godehard-Straße 32, 31139 Hildesheim, Germany). Digistore24 acts as the retailer: the purchase contract is concluded with Digistore24, Digistore24 handles the payment, issues the invoice and is separately responsible for the payment data collected in the process (more at digistore24.com/page/privacy). After a purchase, Digistore24 automatically sends us a purchase notification with your name, your email address, your address and the order data (order number, product, amount, payment method, date). We use this information exclusively to add the purchased credits to your account (or to send you a redemption code if no account exists for your email address), to inform you about this by email, and to book refunds or chargebacks correctly. The legal basis is the performance of the contract (Art. 6(1)(b) GDPR). We also keep the complete purchase notification as evidence towards Digistore24, for example in the event of queries or disputes about a booking (legitimate interest, Art. 6(1)(f) GDPR); name, address and phone number are automatically removed from it after 12 months (section 9). After the purchase, Digistore24 forwards you to our confirmation page and passes on your order number; we use it to show you the status of your credit there (with the email address shown in shortened form). The order number is not additionally stored for this.

On the pages about the seller pack and the Digistore24 partner programme we embed, after your consent (“accept all” in the cookie banner), a script from digistore24-scripts.com (the Digistore24 “promocode”); without consent it is not loaded. It recognises whether you came to us through the referral link of a Digistore24 partner (affiliate) and remembers that attribution in your browser so that the partner receives their commission on a later purchase through Digistore24. For technical reasons, your IP address is transmitted to Digistore24 when the script is loaded; this does not involve any analysis of your behaviour on our pages. The legal basis is your consent (Art. 6(1)(a) GDPR, section 25(1) TDDDG), which you can withdraw at any time with effect for the future. The script is only loaded on those sales and partner pages — not in the tool itself and not on the other pages.

ClickBank (credit packs in US dollars)

We also sell credit packs in US dollars through ClickBank (Click Sales, Inc., 1444 S. Entertainment Ave., Suite 410, Boise, ID 83709, USA). ClickBank acts as the retailer: the purchase contract is concluded with ClickBank, ClickBank handles the payment, issues the payment receipt, processes refunds and is separately responsible for the payment data collected in the process (more in the ClickBank privacy policy). After a purchase, a refund or a chargeback, ClickBank automatically sends us an encrypted purchase notification with your name, your email address, your address and, where applicable, phone number, as well as the order data (order number, product, quantity, amount, payment method, date, identifier of a referring ClickBank partner). We use this information exclusively to add the purchased credits to your account (or to send you a redemption code if no account exists for your email address), to inform you about this by email, and to book refunds or chargebacks correctly. The legal basis is the performance of the contract (Art. 6(1)(b) GDPR). We also keep the complete purchase notification as evidence towards ClickBank (legitimate interest, Art. 6(1)(f) GDPR); name, address and phone number are automatically removed from it after 12 months (section 9).

After the purchase, ClickBank forwards you to our confirmation page and appends the order number, time of purchase, item number, a proof of purchase as well as your name, your email address, your country and your postcode to the address. Name and email address are only displayed in your browser and are then removed from the address bar; only the order number, time of purchase, item number and proof of purchase are sent to our server in order to display the status of your credit, and these are not additionally stored for that purpose. The request itself appears in the server log files like any other page request (see “Hosting”, deleted after 14 days at the latest). If you come through the referral link of a ClickBank partner, ClickBank attributes the commission through its own redirect and its own cookies on ClickBank's pages; we do not embed any ClickBank script on our pages for this. The transfer to the USA takes place on the basis of the EU-US Data Privacy Framework, under which Click Sales, Inc. is certified.

OpenAI (AI generation)

To create the images and copy, the product photos and product details you upload are transmitted to OpenAI (OpenAI, L.L.C., USA — transfer on the basis of the EU-US Data Privacy Framework or standard contractual clauses). If you upload a certificate, test report or manufacturer declaration in the “Proof” step while creating a listing, that document is also sent to OpenAI to be checked; we do not store it and only copy the standard, number and validity it shows into your details. If you upload a photo of a label, data sheet or description in the “Details” step, it is sent to OpenAI to be read; we do not store it and only copy the details it shows into your text field.If you upload files about your corporate design under “Colours & CI” in your brand profile (e.g. a style guide, colour sheet or screenshot) or type colours freely, PDFs, images and free-text details are sent to OpenAI to be read; plain colour codes, SVG, swatch and Office files are read by Listimo itself. We do not store the files, only the colours and font names you confirm. If you enter the address of your brand's website in your brand profile, Listimo fetches the public home page and at most one “About us” page and sends their text together with the brand name to OpenAI to check whether the site belongs to your brand and to suggest a brand text; we do not read legal notice or contact pages. We do not store the pages, only the text you accept and save. If you upload your own photos from a shoot in the “Lifestyle” step, OpenAI checks each photo (what it shows, whether your product is in it, where the face and free space are). Until you start your listing we keep these photos for at most 24 hours; photos that are used are then stored with the listing like your product photos. With the tick box in that step you confirm that you hold the rights to the photos and the consent of the people shown. The same applies to your own photos uploaded for a Brand Story (in My Amazon under A+ or with the A+ in the assistant): they are checked and kept in the same way, and photos that are used are stored with the Brand Story. Under OpenAI's API policies, content submitted through the programming interface (API) is not used to train the AI models. Even so, please do not upload photos showing people or third-party protected content unless you hold the rights to do so.

If you use features of the Amazon connection that create new content (improving an offer, several at once, a whole variation family, local-language texts for further marketplaces), we transmit content of the offer concerned from your Amazon account to OpenAI for this; section 14 lists exactly which content. This content is not used to train the AI models either. Your sales and traffic figures are not passed to OpenAI for this; only Timo, the AI assistant in “My Amazon”, receives them in aggregated form when you use it (section 14).

Voice input: in longer text fields you can speak instead of typing. Your browser only accesses your microphone once you click the microphone button and allow access. The recording (at most 3 minutes) is sent to OpenAI together with the type of field, its current content and, where applicable, the brand and product name from the form; OpenAI converts it into text and prepares it for the field, and only that text goes into the field. We do not store the recording, not even in logs. Voice input is only available with an account. The legal basis is the performance of the function you request (Art. 6(1)(b) GDPR); the first paragraph applies to the transfer to the USA.

Toolbox: if you use a tool that works with AI, we transmit the input it needs to OpenAI: uploaded images, entered texts and, where applicable, the product data of the ASIN you entered (retrieved through ScraperAPI, see below). Video tools also use EvoLink (below). We keep paid runs and runs with files in your tool history so that you can open the results again later (section 9). In the review reporter we also keep the reviews you mark as reported (product, stars, title, the passage in question and, for seller feedback, the order number) until you reset the mark or delete your account. The legal basis is the performance of the function you request (Art. 6(1)(b) GDPR); the first paragraph applies to the transfer to the USA.

Passing reviews to our partner for a legal review

If you want to have product reviews removed through the review reporter and confirm the sharing, we transmit to emerald green Mediengestaltung e.U., Andreas-Hofer-Straße 9, 6845 Hohenems, Austria: the reviews you selected (stars, title, text, date, variant, Amazon's ID of the review, the AI's assessment and whether you have already reported them yourself), the product (ASIN, marketplace, title), your message and your contact details (name, email address, company and phone number, where provided). We do not have the names of the people who wrote the reviews. emerald green passes your request on to a specialised partner and a law firm for the review and the removal request; emerald green and these recipients process the data under their own responsibility and conclude any order directly with you. We create a case with a number and store the status the partner reports for each review, so that you can see it in Listimo and we can settle the referral with the partner. The legal basis is the performance of the sharing you requested (Art. 6(1)(b) GDPR); insofar as reviews contain information about other people, your and our legitimate interest in having unlawful or non-compliant reviews checked and removed (Art. 6(1)(f) GDPR). If you delete your account, we remove contact details, message and texts from the case; we keep the case number and the number and status of the reviews for settling with the partner (Art. 6(1)(f) GDPR).

Without a Listimo account via the page “Have reviews removed”: if you enter an ASIN there, we load the product page through our data service ScraperAPI (see below); with the Listimo extension the critical reviews come from your browser signed in to Amazon instead, and we read pasted text in the same way. We check the critical reviews free of charge, first in our code and then with the AI of OpenAI (USA, as in the toolbox), so that you can see which ones can be removed; only the reviews (stars, title, text, date, variant) go to OpenAI, without the reviewers' names, which we discard. We keep the result in our server's memory for up to 3 hours so that you can select reviews. If you send the request, this assessment goes into the case file and to emerald green as described above. Your contact details (name, email address, optionally phone number and company) and your message go only to emerald green, not to OpenAI. To prevent misuse we count fetches and requests per IP address and email address in memory only, for at most 24 hours. We inform you of the status by email. We remove contact details, message and texts from the case 24 months after the request, with or without an account; we keep the case number, number and status for settlement (Art. 6(1)(b) and (f) GDPR).

EvoLink (videos, beta)

If you create a video (an ad or product video, a background loop, a video on a model or an idea for an ad video), a photo of your product is transmitted as the starting frame — depending on the method, along with the scene images generated for your video — to the video service EvoLink for animation (EVO GLOBAL TECHNOLOGIES LIMITED, Flat 2304, 23/F Ho King Commercial Centre, 2-16 Fa Yuen Street, Mong Kok, Hong Kong — transfer to a third country without an adequacy decision on the basis of the EU standard contractual clauses). If you use the AI extension in the toolbox's video format converter, your uploaded video goes to EvoLink in the same way so that the AI can fill in the edges in the new format; please only upload videos there for which you hold the rights, including rights relating to any people who can be recognised in them. EvoLink passes the job on to the provider of the video model concerned, currently Kling (Kuaishou), Seedance (ByteDance) and Gemini (Google); the data may also be processed in further third countries such as China or the USA. Under the standard contractual clauses EvoLink must protect the data to an equivalent standard when passing them on. For this, the relevant image or video is made available briefly (no longer than 20 minutes) at an unguessable address on our server so that EvoLink can fetch it; no account data are transferred. According to the provider, the generated clips remain available at EvoLink for 24 hours. The legal basis is the performance of the video you commissioned (Art. 6(1)(b) GDPR). The director's prompt for the video and, depending on the method, the script, scene images and quality check are produced by OpenAI (see above).

ScraperAPI (retrieving public Amazon pages)

We retrieve publicly visible Amazon pages through the service ScraperAPI (ScraperAPI, USA). This happens during the listing check (with and without an account, including when reloading the data and when re-checking a reworked listing), when you use an ASIN or an Amazon link in the listing generator (for example as a reference ASIN) or in the product video, when loading the photos of colour variants, when comparing with the top results of an Amazon search for a search term, for tools in the toolbox that load a listing by its ASIN, and for the analyses behind our email outreach to sellers (section 7). Only the ASIN, the marketplace or Amazon domain, a search term formed from the product data in the case of a search, and the addresses of the retrieved Amazon pages (product page, offer list, seller page) are transmitted. Rank tracking: if you track an ASIN, we search once a week for the search terms you enter yourself or pick from your Brand Analytics data (in the toolbox or in “My Amazon”) and only transmit these terms and the marketplace for this; we keep the positions found in your account for up to 52 weeks. The requests are made from our server; your IP address and your account data are not transmitted to ScraperAPI. The transfer to the USA takes place on the basis of the EU standard contractual clauses. Where the function includes an AI assessment, the retrieved product data (including title, bullet points, images, description) are then passed on to OpenAI (see above). The legal basis is the performance of the function you requested (Art. 6(1)(b) GDPR) or — when used without an account and for seller outreach — our legitimate interest in providing these functions (Art. 6(1)(f) GDPR). Orders from the Amazon connection (section 14) do not trigger any requests through ScraperAPI, except rank tracking that you start yourself (see above); if you yourself open a product from your connected catalogue in the listing check or in the listing generator, this paragraph applies as for any other ASIN.

Product images from Amazon: when we show you images of an Amazon listing, for example in the listing check, in the toolbox or for transfers in “My Amazon”, your browser loads them directly from Amazon's image server (e.g. m.media-amazon.com). As with any image request, Amazon receives your IP address and information about your browser. The legal basis is our legitimate interest in showing you the images without routing them through our server (Art. 6(1)(f) GDPR).

Keepa (price and rank history)

For the price, rank and availability history of Amazon products we use the data service Keepa (retrieved through api.keepa.com). This happens during the listing check (the chapter “The last 90 days” as well as the sales and revenue estimate derived from it), when you use an ASIN in the margin calculator and the restock calculator in the toolbox, when searching for a product by EAN, UPC or GTIN, and as a fallback if an Amazon product page itself cannot be retrieved. Only the ASIN or the EAN, UPC or GTIN code you entered and the marketplace (Amazon domain) are transmitted — no personal data: your IP address and your account data are not transmitted to Keepa, and we keep the retrieved histories for no longer than 24 hours per product, without any link to your account. The requests are made from our server. The legal basis is the performance of the function you requested (Art. 6(1)(b) GDPR) or — for the listing check without an account — our legitimate interest in providing this function (Art. 6(1)(f) GDPR). For the use of Keepa in our browser extension, see section 13. We do not query Keepa for orders from the Amazon connection (section 14); if you yourself open a product from your connected catalogue in the listing check or in the listing generator, this paragraph applies as for any other ASIN.

Hosting

The service is hosted by Hetzner Online GmbH, Industriestr. 25, 91710 Gunzenhausen, in a data centre in Nuremberg (Germany). When the pages are opened, the server automatically processes what are known as server log files: IP address, date and time of access, the page/file requested, the volume of data transferred as well as the browser and operating system used. This serves secure, stable operation and the prevention of attacks (legal basis: legitimate interest, Art. 6(1)(f) GDPR). The log files are deleted automatically after 14 days at the latest. If your browser reports a violation of our content security policy, we store the report (page concerned, rule, blocked address) with your IP address in order to detect errors and attacks (Art. 6(1)(f) GDPR); these reports are also deleted after 14 days at the latest. A data processing agreement (DPA) is in place with Hetzner.

Also exclusively on this server, we determine the country of origin from your IP address when the homepage is opened — using a locally stored country database (GeoLite2 by MaxMind). Your IP address is not transmitted to anyone for this and is not stored beyond the server log files mentioned above; the result serves solely to redirect visitors outside Germany, Austria and Switzerland to the English version of the homepage (/en/) and to offer the free onboarding only to accounts from these three countries (section 2). A language choice made with the DE | EN switch always takes precedence (section 8). The legal basis is our legitimate interest in showing you the site in a language you understand (Art. 6(1)(f) GDPR). This website includes GeoLite2 data created by MaxMind, available from www.maxmind.com.

Cloudflare Turnstile (captcha)

We protect the account functions with the captcha service Turnstile by Cloudflare (Cloudflare, Inc., 101 Townsend St, San Francisco, CA 94107, USA). It is used when you register, when you sign in (with an email address or with a user name), when the confirmation email is sent again, when you request a new password, and when you change your email address or your password in your profile. When the sign-in page and your profile are opened, a script from Cloudflare is loaded for this; in the process your IP address as well as device and browser characteristics are transmitted to Cloudflare so that Cloudflare can assess whether the request comes from a human. On the sign-in page you see a verification field for this, which usually resolves without any action on your part; in your profile the check runs invisibly and only appears if Cloudflare needs input from you. The sole purpose is to fend off bots and misuse, such as automated waves of registrations and the guessing of passwords; we do not use Turnstile for advertising or reach measurement. The legal basis is our legitimate interest in protection against automated attacks (Art. 6(1)(f) GDPR). The transfer to the USA takes place on the basis of the EU standard contractual clauses or the EU-US Data Privacy Framework. More in Cloudflare's privacy policy.

Brevo and STRATO (email delivery)

For our optional newsletter we use Brevo (Sendinblue GmbH, Köpenicker Straße 126, 10179 Berlin, Germany). You only receive the newsletter if you have expressly signed up for it — by ticking the box during registration or using the switch in your profile (legal basis: consent, Art. 6(1)(a) GDPR; the time of your sign-up is logged). For this we transmit your email address, your display name and your language setting to Brevo. To improve our newsletters, we evaluate whether emails are opened and links are clicked. You can unsubscribe at any time — using the unsubscribe link in every email or the switch in your profile; your data are then removed from the distribution list. You can therefore withdraw your consent at any time with effect for the future. A data processing agreement (DPA) is in place with Brevo. More at brevo.com/legal/privacypolicy.

Reminders about unused credits: If there are credits in your account and you have not been to Listimo for a while, we remind you by email — once after 5, 10 and 15 days, and not again after that. To tell whether you have been back in the meantime, we look at your last sign-in, your last credit or debit, your last action in the tool and the time of your last page view while signed in; we store that time per account for this purpose (date and time only — no IP address and no record of which page you opened). We tailor the content of the reminder to whether you have already created or checked a listing, and it may name the title of the listing you checked last. You only receive these reminders if you have consented to our newsletter (consent, Art. 6(1)(a) GDPR) or have already purchased from us (direct marketing for our own similar services, Section 7(3) UWG in conjunction with Art. 6(1)(f) GDPR). Every one of these emails contains an unsubscribe link; if you object, we will not contact you again.

We also send service- and contract-related emails through Brevo, for example replies to your support and enterprise enquiries (including acknowledgements of receipt), completion notices for your orders (including those from the Amazon connection, section 14), your Academy certificate (section 6) and notifications about the partner programme. The legal basis for this is the performance of the contract or our legitimate interest in communicating with you (Art. 6(1)(b) or (f) GDPR); separate consent is not required for this. If Brevo does not accept an email or sending through Brevo is suspended, we send it through our mailbox at the email provider STRATO AG (Berlin, Germany); only the reminders about unused credits are sent exclusively through Brevo. Emails to Amazon sellers and creators are never sent through Brevo but through our mailbox at STRATO (section 7).

Morning briefing by email (only with your consent): if you turn on the morning briefing by email in your profile, we send you a short email between 8 and 9 am (German time) on days when something in “My Amazon” needs you (watchdog alerts, orders you can request reviews for), with the number and a link, at most once a day. It contains no product names, item numbers or sales figures. If you use the Listimo app with the morning briefing turned on, you only get it there. The legal basis is your consent (Art. 6(1)(a) GDPR); we store the time and version of the consent text and every opt-in and opt-out. You can withdraw your consent at any time with effect for the future, using the switch in your profile or the unsubscribe link in every email (no sign-in needed). Delivery as above via Brevo or STRATO.

Push notifications in the Listimo app (Expo, Apple)

If you turn on notifications in the Listimo app for iPhone, we store a push identifier (Expo push token) for your device, the app language, the device's time zone and your choice of which notifications you want and whether quiet hours apply. We use it to tell you about events in your account: watchdog alerts from the Amazon connection (section 14), finished or failed jobs, credits added, a low balance and a discount that ends soon, replies from support, sign-ins on an unknown device, redeemed invitations, an expired Amazon authorisation, the result of a main image test and, on Mondays, a prompt for your weekly review. We only send news about new features if you expressly turn it on in the app.

Notifications only name the type of event (such as “Top seller out of stock · amazon.de” or “Your listing is ready”), the number of credits for a credit and the browser and operating system for a new sign-in. They never contain product names, SKUs, ASINs, revenue or the content of support messages. For delivery we pass the push identifier and the text of the notification to Expo's push service (650 Industries, Inc., USA), which forwards it to Apple's Push Notification service; Apple delivers it to your device. According to Expo, it is certified under the EU-U.S. Data Privacy Framework; transfers to the USA rely on this or on EU Standard Contractual Clauses. More: expo.dev/privacy and apple.com/legal/privacy.

The legal basis is the performance of the contract or our legitimate interest in informing you about events in your account (Art. 6(1)(b) or (f) GDPR); we only send news about new features with your consent (Art. 6(1)(a) GDPR), which you can withdraw in the app at any time. You can turn off each type of notification in the app under Account → Notifications or switch notifications off completely in your iPhone settings.

Google Ads conversion measurement (consent mode)

We use the Google Ads tag of Google Ireland Limited (Gordon House, Barrow Street, Dublin 4, Ireland) in order to measure whether visitors who come to us through a Google ad subsequently register or buy credits (for a purchase including the amount and an order identifier). In doing so we use Google Consent Mode v2; the extent of the processing depends on your choice in the cookie banner:

The data may also be transferred to servers in the USA (transfer on the basis of the EU-US Data Privacy Framework). You can change your selection at any time: reset cookie selection — the banner then appears again. More in Google's privacy policy.

Google Analytics 4 (consent mode)

We also use Google Analytics 4, a web analytics service of Google Ireland Limited (Gordon House, Barrow Street, Dublin 4, Ireland), in order to understand how our pages are used — for example which pages are opened and at which point visitors abandon the registration or purchase process. Google Consent Mode v2 applies here too; the extent of the processing depends on your choice in the cookie banner:

Here too the data may be transferred to servers in the USA (EU-US Data Privacy Framework). More in Google's privacy policy.

TikTok pixel

We also use the TikTok pixel of TikTok Technology Limited (10 Earlsfort Terrace, Dublin 2, Ireland) in order to measure whether our advertising on TikTok works and to be able to reach visitors of our website there later with relevant ads (retargeting). Like the Google services, the TikTok pixel is only loaded if you choose “accept all” in the cookie banner — without your consent, TikTok is not contacted from our site at all. With consent, TikTok sets cookies and records your page views as well as events such as a completed registration or a purchase. We and TikTok are joint controllers for collecting these data and transmitting them to TikTok (Art. 26 GDPR); TikTok alone is responsible for what it does with the data afterwards. The details are set out in TikTok's terms for its business products. The legal basis is your consent (Art. 6(1)(a) GDPR, section 25(1) TDDDG), which you can withdraw at any time with effect for the future (reset cookie selection). The data may also be transferred to servers outside the EU (including the USA; transfer on the basis of the EU-US Data Privacy Framework or standard contractual clauses). More in TikTok's privacy policy.

Meta pixel

We use the Meta pixel of Meta Platforms Ireland Limited (Merrion Road, Dublin 4, Ireland) in order to measure whether our advertising on Facebook and Instagram works and to be able to reach visitors of our website there later with relevant ads (retargeting). As with the TikTok pixel, there is no cookieless variant here: the Meta pixel is only loaded if you choose “accept all” in the cookie banner — without your consent, Meta is not contacted from our site at all. With consent, Meta sets cookies and records your page views as well as events such as a completed registration or a purchase (for a purchase, also the amount). Meta also processes this data for its own purposes; in that respect we and Meta are joint controllers (Art. 26 GDPR), with the details set out in Meta's controller addendum. The legal basis is your consent (Art. 6(1)(a) GDPR, section 25(1) TDDDG), which you can withdraw at any time with effect for the future (reset cookie selection). The data may also be transferred to servers outside the EU (including the USA; transfer on the basis of the EU-US Data Privacy Framework or standard contractual clauses). More in Meta's privacy policy.

OpenAI pixel (advertising in ChatGPT)

We advertise in ChatGPT and use the measurement pixel of OpenAI Ireland Limited (1st Floor, The Liffey Trust Centre, 117–126 Sheriff Street Upper, Dublin 1, D01 YC43, Ireland) to measure whether our ads in ChatGPT work. As with the TikTok pixel and the Meta pixel, there is no cookieless variant: the OpenAI pixel is only loaded if you choose “accept all” in the cookie banner — without your consent, OpenAI is not contacted from our site at all. With consent, the pixel stores the click identifier of an ad in ChatGPT (URL parameter “oppref”) in a cookie and transmits events such as a completed free listing check, a registration or a purchase (for a purchase, also the amount) together with technical information about your browser and your IP address. To match conversions better, the pixel may detect information entered on the page, such as your email address, and make it unrecognisable in your browser (hashed, SHA-256) before sending it; OpenAI does not receive the address itself. OpenAI processes this data as an independent controller, also for its own purposes, for example to measure and improve advertising and to show more relevant ads; the details are set out in OpenAI's Ad Tools Data Processing Addendum. For visitors from the United Kingdom, this is OpenAI OpCo, LLC (1455 3rd Street, San Francisco, CA 94158, USA). The legal basis is your consent (Art. 6(1)(a) GDPR, section 25(1) TDDDG), which you can withdraw at any time with effect for the future (reset cookie selection). The data may also be transferred to servers outside the EU (including the USA); according to OpenAI, a valid transfer mechanism is used for this. More in OpenAI's privacy policy.

Anonymous usage statistics

To improve our offering, we count page views and a small number of feature events (for example “registration completed”) in anonymous form: without cookies, without storing IP addresses and without user-related identifiers — we assign neither a user nor a device identifier for these statistics. For each event we record only the time, the type of event, the page opened, the language setting, the rough device category (mobile or desktop — derived from the browser identifier, which is itself not stored) and the origin details described below. It is therefore not possible to draw conclusions about individual persons or to combine the data into a user profile (legal basis: legitimate interest in improving our offering, Art. 6(1)(f) GDPR).

We also determine how many different visitors open our pages on a given day. For this, an irreversible check value is formed from the IP address, the browser identifier and a random value newly generated each day; it exists only in memory and is discarded when the day changes. Only the total per day is stored — neither the check value nor the IP address. Recognition beyond that day is therefore technically impossible (legal basis as above: Art. 6(1)(f) GDPR).

For each of these events we additionally count how the visit reached us:

This information describes the route to the page, not the person: it contains no features identifying you and is not assigned to any user account. Whether it is remembered in your browser beyond the individual visit depends solely on your consent (section 8).

5. Partner programme and payouts

If you take part in our voluntary referral and partner programme, we process the data required to run it: your personal referral code, the qualified referrals attributed to you, and the resulting credits and commissions. Referred customers are only shown to you in aggregated form; we do not disclose personal data of referred customers to you. The exception are sellers you look after yourself in phone outreach: for them you see whether they opened your link, signed up and made a purchase (section 15).

So that you can judge how your links perform, we also count how often your referral links are opened. Only the referral code, the day and the number of views are recorded — on request separated by a campaign label you assign in the link (for example “youtube”), which names the channel, not the person opening it. Details about the person clicking — IP address, browser identifier or other identifiers — are neither transmitted nor stored for this count; it is therefore not possible to draw conclusions about individual visitors (legal basis: performance of the participation agreement with the referrer, Art. 6(1)(b) GDPR).

The discount and the revenue share only apply to new customers (programme terms, section 3). For customers who arrive through a referral link or code, we therefore check two things: whether a Listimo account has ever existed with the same email address — for this we use a non-reversible check value of the email address, which we keep anyway for the one-time welcome bonus and which survives an account deletion — and whether another Listimo account has already paid with the payment card used for a purchase. For the second check we store, for every card payment, a non-reversible check value of the card attribute that Stripe sends us with each payment (not the card number), together with a non-reversible check value of your account ID. If either applies, the discount and the revenue share end for that account. The legal basis is our legitimate interest in preventing misuse of the programme (Art. 6(1)(f) GDPR).

If you request a cash payout, we additionally process the billing details you have provided — your name, your company where applicable, your address, your tax status (small business or liable to VAT), your VAT identification number or tax number where applicable and, depending on the method chosen, your IBAN and the name of the account holder or your PayPal address. We use this information exclusively to process the payout (SEPA transfer or PayPal) and to create the credit note (tax statement under the self-billing procedure) that we send you by email. If we pay out via PayPal, PayPal (PayPal (Europe) S.à r.l. et Cie, S.C.A., 22–24 Boulevard Royal, L-2449 Luxembourg) receives your PayPal address and the amount and processes the payment as a controller in its own right. We check a VAT ID you provide through the EU Commission's VAT Information Exchange System (VIES). Payout requests and credit notes are accounting records and are kept with the details they contain for 10 years (section 147 of the German Fiscal Code) — even if you delete your account. The legal basis is the performance of the participation agreement (Art. 6(1)(b) GDPR) and the fulfilment of our obligations under tax and commercial law (point (c)). The terms of participation for the referral programme apply in addition.

Payouts via Stripe: If we pay out your commission via Stripe, you set up a payout account with Stripe from the partner page (Stripe Payments Europe, Ltd., Ireland). The setup happens directly at Stripe: Stripe asks for the details it needs, such as name, address, date of birth, ID and bank details, checks them and processes them as an independent controller under its own terms, which you accept during setup. From Stripe we only receive the ID of your Stripe account, your country and the setup status (for example whether payouts are enabled or details are still missing). For each approved payout we send Stripe the amount, your Stripe account ID and the number of the payout request; Stripe then pays the amount out to your bank account. Stripe may also transfer data to the USA, based on the EU-US Data Privacy Framework or EU standard contractual clauses. More: stripe.com/privacy. The legal basis is the performance of the participation agreement (Art. 6(1)(b) GDPR).

Partner interface: if you apply in your profile for access to the interface, we store your application (including company, website, intended use and billing address). Of your key we store only a non-reversible check value, plus, per analysis, the ASIN, marketplace, time and price, as well as any IP addresses you have specified from which the key is valid; invoices are created by Stripe using your billing address (Art. 6(1)(b) and (c) GDPR).

Rules for Digistore24 partners: if you confirm our partner rules before your partnership is approved (page “Rules for Listimo partners” or the link in our email), we store your Digistore24 ID, your email address, the language, the time and the version of the rules you confirmed, so that we can prove your consent. Your IP address is not part of this. If we invite you by email, we use the Digistore24 ID and the email address from your partnership request for this. We keep this data for as long as the partnership exists and afterwards until the limitation period for possible claims has expired (three years from the end of the year) (Art. 6(1)(b) and (f) GDPR).

Phone outreach for approved partners: if you request access to phone outreach, we store the details from your request (name, company where applicable, phone or email for sellers' questions, languages, countries, your experience and your message) together with the email address of your account, as well as our decision and any reply. When you confirm the rules of phone outreach, with your request or later for a new version, we store the time, version and language of each confirmation and send ourselves an email with these details and the wording of the rules, so that we can prove your consent; your IP address is not part of this. While you have access, we store which sellers you take over or add yourself, your calls with result and note, the email consents you log, your analyses, the code you chose and daily counters for the daily limits. Your contact detail for questions appears in the analyses you send to sellers. We email you about our decision on your request and when a seller from your contacts signs up or makes a first purchase (sent via Brevo or STRATO, section 4). The legal basis is the performance of the participation agreement (Art. 6(1)(b) GDPR) and our legitimate interest in being able to prove and check compliance with the rules (Art. 6(1)(f) GDPR). How we process the data of the sellers who are called is described in section 15.

6. Listimo Academy and certificates

You can use parts of our free training (“Listimo Academy”) entirely without an account; in that case we process no data other than for any other page visit (sections 4 and 8). If you use the Academy with your free account, we store your progress: your quiz results per lesson (lesson, score, time) as well as passed final exams per learning track (track, score, certificate code, time). The purpose is to show you your progress across devices, to provide your certificate and to ensure the one-off credit award per track. Storage is with our database provider Supabase (section 4); the legal basis is the performance of the contract (Art. 6(1)(b) GDPR).

Certificate with public verification: if you pass the final quiz of a track (at least 80 %), we create a certificate with an individual verification code and send it to your account's email address as a PDF (delivered via Brevo or STRATO, section 4). The certificate shows the name you enter for it before submitting the quiz — pre-filled with the name or user name from your profile; if the field is left empty, we use that, or failing that the part of your email address before the @. At listimo.ai/academy/zertifikat/ anyone you give the code to (for example a client) can check that it is genuine and download the certificate as a PDF — the track, the date it was passed, the name on the certificate and (in the PDF) your score in per cent are shown. Without the code no retrieval is possible; only pass the code on if you want it to be displayed. The legal basis is the performance of the contract (Art. 6(1)(b) GDPR). When your account is deleted, progress and completions are deleted; your certificate can then no longer be retrieved.

7. Email outreach to Amazon sellers and creators

We contact individual Amazon sellers as well as potential partners by email in order to introduce them to Listimo or to our partner programme: creators (for example YouTube or TikTok channels about selling on Amazon), agencies and service providers for Amazon sellers, trade media, event organisers, course providers and associations. This section is addressed to the people we contact: where we got the information, what we do with it and how you can object.

Sellers — whom we contact: since 30 September 2026 we only contact sellers whose business address is in the United States, the United Kingdom, France, Belgium or Ireland — in the United Kingdom only companies (such as Ltd, LLP, PLC), in Belgium only general company mailboxes (such as info@ or sales@), in Ireland only addresses that are recognisably used for business. We no longer contact sellers based in Germany, Austria or Switzerland by email; we keep earlier records only in order to respect objections (see retention). Since 19 October 2026, sellers based in Germany may be called by our partners (section 15).

Sellers — origin of the data: the starting point is publicly available information on Amazon: product data of an offer (ASIN, brand, category, title, images, review counts) as well as the name, seller identifier, business address and country of the seller; until September 2026 we partly compiled them with the market-data tool Helium 10. The contact details — email address, business name, legal form and, where applicable, phone number — are read from the public seller page on the respective Amazon marketplace (amazon.com, amazon.co.uk, amazon.fr, amazon.com.be, amazon.ie; amazon.de until 30 September 2026 and since 19 October 2026 for phone outreach, section 15), retrieved through ScraperAPI (section 4). If the seller page shows no email address, we read the publicly stated contact address from the brand's website (contact page or legal notice); in individual cases we enter it by hand. In order to check whether a brand sells its own offer, we also record the names of the other sellers of that offer.

Sellers — what we store and send: for every seller contacted we store the information mentioned, an automated analysis of the public listing, the text of the email, the date, subject and recipient address of each send, the processing status (for example “contacted” or “declined”) and, where applicable, a personal form of address. The text of the email is drafted by OpenAI's AI (section 4); for this we transmit the brand, company, product title, ASIN, category, analysis values and the form of address, which may contain a name. The email contains an image card with the analysis and a personal link to the full assessment, valid for 30 days; it is sent from a mailbox of our domain listimo.eu at the email provider STRATO AG (Berlin, Germany). If an account is created through that link, we note this in the seller record. If the email goes unclicked, a single reminder may follow after a few days.

Creators and other potential partners — origin of the data and sending: we use publicly available information on the channel or company (name, channel or company name, platform or type of business, address of the channel or website, for channels subscriber, video and view counts, main topic, country) and the publicly stated contact or collaboration address from the channel description, the website or the legal notice; where someone publicly invites collaboration requests there, we store where we found it (page address and the text excerpt) as evidence. We store our assessment of whether the channel is a fit for Listimo, the processing status and, per email, the date, address and subject. These emails are sent from a fixed template through the same mailbox at STRATO; we do not use AI for them. We only contact potential partners if they publicly invite collaboration, advertising or sponsorship requests and state exactly the address we write to (then in any country), or if their business address is in one of the countries listed above for sellers (then under the same rules as for sellers).

Open and click measurement: we evaluate whether our emails are opened and links are clicked. For emails to sellers, an email counts as opened when the embedded image card is loaded from our server, and as clicked when the assessment is opened through the personal link. Emails to creators and other potential partners contain an invisible counting pixel (an image file at listimo.ai/p/…) and a click link (listimo.ai/k/…) that redirects to our website. In each case only the number of retrievals and the time of the first and the last retrieval are stored — no IP address and no browser identifier (apart from the short-lived server log files, see section 4, Hosting). Some email programs load images automatically and security filters open links in advance; the figures are therefore only a rough indication. If your email program does not load images automatically, no open measurement takes place.

Legal basis and objection: we process these data on the basis of our legitimate interest in introducing Listimo to business users and initiating collaborations (Art. 6(1)(f) GDPR). You can object to this processing at any time without giving reasons (Art. 21 GDPR) — using the unsubscribe link in our email, by replying to the email, or informally to support@listimo.ai. After an objection we add your email address (on request your entire domain as well) to a block list that is checked before every send; seller records are additionally set to “declined”.

Retention: no automatic deletion period is currently set for this information. We keep it for as long as it is needed for outreach and for traceability of our contacts, and delete it on request. We keep the block list entry (email address or domain, reason and date) even after that, because it is the only way we can make sure not to contact you again.

8. Cookies & local storage

We use technically necessary cookies and local browser storage (localStorage) for your login session (plus the cookie “lst_g” with a random value by which we recognise, for up to one year, a device that has already been signed in to your account — only in this way can we warn you when an unknown device signs in; with two-factor sign-in turned on, additionally the cookie “lst_zf” with a random value, which marks your device as confirmed for 30 days after you enter the code; both are only sent to our interface), for settings such as dismissed notices and for your local learning comfort in the Listimo Academy (unlocked chapters and checklist ticks, values “ak-kap:…” and “ak-cl:…” — they stay in your browser and are not transmitted to us) — all of this is required for the function you are using (section 25(2) TDDDG) and does not require consent. Also without consent, we record your decision from the cookie banner itself (value “consent_marketing” with the content “ja” or “nein”) — only in this way can we respect your choice on every further visit instead of asking you again. In the same way we record your choice in the DE | EN language switch in the cookie “siteLang” (content “de” or “en”, lifetime one year): the site then appears in your language on your next visit, and the language routing by country of origin (section 4, Hosting) does not override your choice.

If you use the free listing check without an account, your browser generates a random device identifier once and stores it locally (localStorage value “listimoGeraet”); it also remembers the time of your last free analysis (“lst_free_check”). The device identifier is transmitted to our server during an analysis so that the free analysis can be limited to one per device — even where several devices share an IP address, for example in an office or on a mobile network. It contains no information about your person and is required for this function you are using (section 25(2) TDDDG); the legal basis for the processing is our legitimate interest in a fair limitation of the free offering (Art. 6(1)(f) GDPR). You can remove both values by clearing the website data in your browser.

Only with your consent to advertising measurement, up to three further local values are added which record your origin: “lst_k” (the code of the campaign through which you came to us), “lst_q” (the origin channel, for example “ads” or “direkt”) and “lst_m” (the medium, for example “cpc”). They serve solely to attribute a later registration to the channel through which you found us (section 4) and expire automatically 30 days after the visit during which they were created. Without your consent they are not stored; the origin is then only evaluated within the individual page request.

We only set advertising and analytics cookies (Google Ads, Google Analytics 4, the TikTok pixel, the Meta pixel and the OpenAI pixel, see section 4) if you expressly agree in the cookie banner; without agreement the corresponding scripts are not loaded at all. You can change your agreement at any time: reset cookie selection, or use the “Cookies” link in the footer of our pages. We do not currently use any other analytics or advertising services.

On the pages about the seller pack and the Digistore24 partner programme, the Digistore24 script embedded there after your consent (section 4) stores a partner identifier in your browser (cookie “ds24c.v1”) if you came through the link of a Digistore24 partner. It contains no information about your person, only the identifier of the referring partner, and serves solely to attribute commission on a purchase through Digistore24 (consent, Art. 6(1)(a) GDPR, section 25(1) TDDDG). Digistore24 determines the lifetime; more at digistore24.com/page/privacy.

For our own referral programme (section 5): if you open our pages through the referral link of a Listimo user (address with “?ref=…”), we store the referral code it contains in your browser for 30 days (cookie and localStorage value “lst_ref”). It contains no information about your person, only the referrer's code, and serves solely to attribute a later registration to the referrer and to grant you any benefits from the referral (for example a discount) (legitimate interest or steps prior to a contract, Art. 6(1)(f)/(b) GDPR). In addition, your browser remembers only for the duration of the session that opening the link has already been counted (sessionStorage value “lst_ref_klick”) — so that reloading the page is not counted twice in the anonymous click count in section 5; this value expires when the browser is closed.

9. Retention periods

10. Your rights

You have the right of access (Art. 15 GDPR), rectification (Art. 16), erasure (Art. 17), restriction of processing (Art. 18), data portability (Art. 20) and objection (Art. 21). Where we process data on the basis of our legitimate interest (Art. 6(1)(f) GDPR), you can object on grounds relating to your particular situation; you can object at any time and without giving reasons to processing for direct marketing purposes — such as our email outreach (section 7) or calls by our partners on our behalf (section 15) — (Art. 21(2) and (3) GDPR). Where processing is based on your consent, you can withdraw it at any time with effect for the future (Art. 7(3) GDPR). Simply contact support@listimo.ai or open a support ticket. You also have the right to lodge a complaint with a data protection supervisory authority.

You can download a large part of your data (profile, brand profiles, listing copy, transactions, invoice links and support tickets) yourself as a file at any time in your profile under “Your data” (Art. 20 GDPR).

11. No automated decision-making

Automated decision-making producing legal effects concerning you within the meaning of Art. 22 GDPR does not take place. The AI used merely generates the images and copy you request; it does not take decisions about you as a person. The traffic lights, priorities and hints of the Amazon connection (section 14) and Timo's answers are likewise evaluations of your offers and figures, not decisions about you; only what you confirm yourself is transferred.

12. Obligation to provide data

Providing an email address and password is required in order to create an account; without them the service cannot be used. All further details are voluntary.

13. Browser extension “Listimo for Chrome”

Our browser extension shows key figures, the listing check and an FBA calculator on Amazon product and search pages. It only works while you are signed in to Listimo. To do so, the extension reads the Amazon page you currently have open (e.g. ASIN, price, best sellers rank, reviews, dimensions) — exclusively in your browser.

What we receive: when you start a listing check we receive the ASIN and marketplace of the listing; processing corresponds to the listing check on the website. When you visit a product page on amazon.de while signed in, we receive the product's ASIN, best sellers rank, category and price, plus the ranks the extension noted in your browser on your earlier visits to this page during the last 30 days, for the sales estimate that the extension shows above the product — not the address of the page. We need the ASIN to retrieve the product's rank history, average price and Amazon's purchase figure of the last 30 days from the data service Keepa; Keepa receives only the ASIN, nothing about you. We keep that data for up to 24 hours per ASIN — without any link to your account; we do not store which products you looked at. The bar above the product can be switched off in the extension; this request then only happens when you open the panel. If you switch Listimo off on Amazon entirely (switch in the panel, in the toolbar window or in the settings), the extension no longer requests anything on Amazon. The extension also retrieves your credit balance and your previous analyses from your account. Requests from the extension are marked as such so that we can count its usage. The legal basis is Art. 6(1)(b) GDPR (performance of the user agreement).

With your Amazon account connected (section 14): the extension first asks, without any product details, whether your Amazon account is connected. Only then does it send us the ASIN and marketplace on product pages of the European Amazon marketplaces (including the UK and Turkey) and of amazon.com, so that we can match them against your catalogue from “My Amazon”; for amazon.com we only match if you have connected a seller account in North America, otherwise we reply without a match. If it is your own product, it shows you your sales and traffic figures of the last 30 days, which we already store under section 14. We do not store the match itself. If you request Amazon's fees in the calculator, we retrieve Amazon's fee estimate for this ASIN through your connection (for amazon.com through your North American connection, from Amazon's servers in the USA, section 14); Amazon receives the ASIN, marketplace, the price from the calculator and the fulfilment method, and we keep the result together with your account ID, the ASIN, price and fulfilment method in our server's memory for up to six hours, so that a repeated request does not burden Amazon again. Like “My Amazon”, both require signing in with a second factor.

Directly from Amazon, not through us: in the “Market” tab and on search pages, the extension retrieves Amazon's search suggestions for a search term — directly from Amazon, from within the open Amazon page, just like the page's search box. If you download product images, the extension fetches them from Amazon's image server. What customers say about a product according to Amazon and which other products the page recommends are read from the open page. None of this reaches us.

Briefing for the generator: if you send a briefing to the generator with “A better listing than this one”, the extension hands it over in your browser to the listimo.ai tab it opens for this. It contains the ASIN, title, brand, category and prices of the Amazon page, Amazon's summary of customer reviews including the criticised and praised points, and the search suggestions. Until the tab collects it, it sits in the extension's session storage (it expires after ten minutes and is deleted when you close the browser at the latest); after that in that tab's session storage until you close the card, for two hours at most. Our server only receives any of it once you take details from it into a field of the generator — we then process them like any other input there (e.g. for niche detection).

Review reporter: if you click “Fetch all critical reviews” in the review reporter, the extension opens Amazon's page with the critical reviews (1 to 3 stars) of this product in a new tab. Only in this tab does it read the reviews: stars, title, text, date, variant, whether it is a verified purchase or a Vine review, and Amazon's ID of the review. It does not read the name of the person who wrote it. It reads further pages only if you open them there yourself. It hands the reviews over in your browser to the listimo.ai tab in which you started the fetch; from there they go to our server for the free pre-check and, if you start the check, to OpenAI as in the toolbox (section 4). The legal basis is the performance of the function you request (Art. 6(1)(b) GDPR); insofar as reviews contain information about other people, your and our legitimate interest in being able to report reviews that break Amazon's rules (Art. 6(1)(f) GDPR).

Review radar: “Fetch all critical reviews” in the review radar works the same way. The page takes the stars, title and text of the reviews into the field “Paste your own reviews”; they only go to our server and to OpenAI (section 4) when you click “Analyse reviews”. The legal basis is the performance of the function you request (Art. 6(1)(b) GDPR); insofar as reviews contain information about other people, your and our legitimate interest in analysing the criticism of your product (Art. 6(1)(f) GDPR).

Rank tracking: If you click “Track every week” in the “Market” tab, the extension sends us the ASIN and marketplace of the product and the search terms you entered; we process them like rank tracking on the website (section 4). To show you your ranks, alerts and listing protection status, the extension fetches your own lists from our server while the panel is open and looks up the product in them itself; this does not tell us which product is currently open. The legal basis is the performance of the function you request (Art. 6(1)(b) GDPR).

Stored only in your browser: the history (rank, price and reviews per visited product page), your saved list, your calculator inputs, your settings and the evaluation of search pages. Of this, only what is listed above under “What we receive” reaches us – from the history, just the remembered ranks of the product currently open, for the sales estimate. You can delete this data at any time in the extension's account sheet or settings; removing the extension deletes it as well. To sign you in, the extension takes over your short-lived session token from listimo.ai and keeps it in the browser's memory only (Sec. 25(2) no. 2 TDDDG: strictly necessary for the service you requested). Of your visits to Amazon, we only learn the ASIN of the amazon.de product pages on which the sales estimate is shown to you and – only with your Amazon account connected – the ASIN of product pages of European Amazon marketplaces and of amazon.com for matching against your catalogue; we store neither with your account. We learn nothing about any other pages – such as your searches or your basket.

14. Amazon connection (Selling Partner API)

You can voluntarily connect your Amazon seller account to Listimo. You can then see your catalogue from your European marketplaces, Amazon's complaints and your sales figures in Listimo, have offers improved and transfer changes that you have checked and confirmed beforehand. You can keep using Listimo unchanged without the connection. We are unlocking it step by step; as long as it has not been unlocked for your account, we do not process any data from your Amazon account.

Connecting: you grant the authorisation yourself at Amazon: we forward you to Amazon Seller Central, where you sign in and give your consent. We never learn your Amazon password. We receive your seller identifier (Selling Partner ID) and an access right through Amazon's Selling Partner API, which you can revoke at any time. To protect your seller account, we require for connecting and for every access to “My Amazon” that your Listimo account is secured with two-factor sign-in and that you are signed in with the second factor; you can disconnect without it. Amazon is the source of this data and processes it under its own responsibility according to its terms and its privacy notice: for the European marketplaces Amazon Services Europe S.à r.l., 38 avenue John F. Kennedy, L-1855 Luxembourg, for the US, Canada and Mexico Amazon.com Services LLC, 410 Terry Avenue North, Seattle, WA 98109, USA. If you connect a seller account in North America, the requests for it go to Amazon's servers in the US.

Waiting list and early access: if you put yourself on the waiting list for the connection in your profile, we store in your account when you did so and — as soon as we unlock your account for early access — when that happened; we inform you about the unlocking by email (sent through Brevo or STRATO, section 4). On your first waiting-list entry we notify ourselves once by email with your account email address (sent through Brevo or STRATO, section 4). You can withdraw the entry at any time; we keep the time of the notification so that it is not repeated. As long as Listimo is not listed in Amazon's app directory (Selling Partner Appstore), Amazon only permits a limited number of connected seller accounts. So that we reliably stay within this limit, we keep a count list: for every seller account that has ever been connected to Listimo it contains, instead of the seller identifier, only a check value calculated from it (SHA-256, pseudonymised), the internal identifier of the Listimo account last connected to it, the times of the first and the last connection and of the last disconnection, and the number of connections. Because Amazon does not say whether a disconnected slot becomes free again, the entry remains after you disconnect and after your account is deleted; we delete the list as soon as Listimo has been accepted into Amazon's app directory.

What we read from Amazon:

You start the first sync yourself. After that we repeat it automatically every night (currently between 3 and 6 a.m.) for as long as the connection exists; in addition, you can start it by hand once a day. We do not receive data about your buyers: no individual orders, no names, addresses or messages, no payment or disbursement data. We deliberately did not apply for the Amazon permissions needed for that. The only exception is the seller feedback in the review reporter (next paragraph).

Seller feedback in the review reporter: if you open seller feedback in the review reporter (toolbox or “My Amazon”), we fetch the negative and neutral ratings (1 to 3 stars) from the last 90 days in the selected marketplace from Amazon's seller feedback report (GET_SELLER_FEEDBACK_DATA): date, stars, the buyer's comment, your response and the order number. The report contains no buyer names or email addresses; we discard your response straight away. We do not store the feedback in the database: it stays in our server's memory for up to 30 minutes so that opening it again does not query Amazon again, and it is shown to you. If you have it checked, we send stars, date and comment to OpenAI (section 4), never the order number. What you mark as reported is kept as described in section 4. The legal basis towards you is the performance of the function you requested (Art. 6(1)(b) GDPR), towards your buyers the legitimate interest in being able to check and report feedback that breaks Amazon's rules (Art. 6(1)(f) GDPR).

What we write to your Amazon account — only when you click: title, bullet points, description, search terms, item highlights and images of your offers in the marketplace you choose when transferring (at Amazon, images apply to all marketplaces of the same ASIN); missing compliance attributes such as manufacturer, contact of the responsible person, country of origin, dangerous-goods classification and unit count, taken only from your own offers, from Amazon's catalogue or from what you enter; new offers in further marketplaces with the price you confirm and — for an entirely new listing — with the quantity your home marketplace holds at that moment; a price where an offer in a further marketplace has none yet; A+ content for review by Amazon; and also entirely new products (new ASIN) with the details you enter or confirm, and on request their deletion; through “Delete and clean up offers” also the deletion of other offers of yours that you select and confirm for this (not offers fulfilled by Amazon). We store your master data for this (including manufacturer and contact details, shipping details, GTIN/EAN codes in stock per brand) on our server until your account is deleted. Before changing an existing offer, we back up the previous state of the fields concerned in your history so that you can undo the change; before deleting, we back up the whole offer there so that you can have it recreated within 30 days. For this, we make new images available at an unguessable address on our server, from which Amazon fetches them. Amazon receives what we transfer and processes it under its own responsibility. If your details contain contact data of another person (such as the responsible person under the General Product Safety Regulation), we process it only to carry out, and to be able to undo, the change you requested.

Transfer to OpenAI (AI): our own server calculates the sync, overview, issue display and figures without any AI service. Your sales and traffic figures only go to an AI service if you use Timo (next paragraph). If you have an offer improved — individually, several at once or as a variation family — we transmit the offer's brand, title, bullet points, description and product type, its main image and its price (to compare it with top-selling products) to OpenAI (section 4) so that the AI can create new texts and images from them; the offer's search terms are not included. If you have offers created in a further marketplace with texts in the local language, we transmit the ASIN as well as title, bullet points, description, search terms and further text details (e.g. colour or material) from your home marketplace to OpenAI so that they are translated or rewritten. The transfer to the USA takes place on the basis of the EU-US Data Privacy Framework or standard contractual clauses; OpenAI does not use content submitted through the programming interface to train its models. The new texts are written by an AI. When improving, nothing is transferred until you have checked and confirmed it; for new offers in further marketplaces we show you the new title in advance — you see bullet points, description and search terms afterwards in Seller Central.

Timo, the AI assistant: at the top of “My Amazon”, Timo summarises the state of your account and answers your questions, in writing or by voice. Timo is an AI from OpenAI (section 4), not a person. For the greeting and every answer we transmit to OpenAI a situation summary from your overview: aggregated sales and traffic figures per marketplace for the last 30 days (such as revenue, units, sessions, conversion rate, Buy Box share and how they changed), the number of offers affected for each open task, the title and brand of your most important product families, the titles of up to three products for each “money left on the table” item (such as sold-out bestsellers) with their figures for the last 30 days (revenue, sessions, conversion rate, Buy Box share, stock), your credit balance, the prices of Listimo's features and your first name for the greeting. ASINs, SKUs and your seller ID are not included. Your question and the last few sentences of your conversation are added. If you speak a question, the recording is sent to OpenAI to be converted into text; if you have answers read out, OpenAI generates the voice from the answer text. In a voice conversation (“Talk to Timo”), your browser connects directly to OpenAI after your click and your permission for the microphone: your voice and Timo's answers then travel between your browser and OpenAI without passing through our server, and OpenAI receives your IP address. Such a conversation ends after about 10 minutes at most. We do not store recordings. Only your browser tab keeps the conversation history; what we keep on our server for this and for how long is set out in section 9. The legal basis is the performance of the function you request (Art. 6(1)(b) GDPR); the previous paragraph applies to the transfer to the USA and to training. Timo's answers are evaluations of your figures, not decisions about you (section 11).

ScraperAPI and Keepa: for orders from the connection (improving an offer, several at once, a variation family, local-language texts) we do not retrieve your public product page through ScraperAPI or Keepa and do not pass any data from the connection to these services. If you yourself open a product from your connected catalogue in the listing check or in the listing generator (also via “Check” or “In the generator” in “My Amazon”), the same applies as for any other ASIN you enter (section 4): we then retrieve the public product page through ScraperAPI, or through Keepa as a fallback, and transmit the ASIN and marketplace for this.

Emails: if you improve several products at once, we send you an email at the end with the number of finished versions. For a single product or a variation family we only write to you if you left the page while the content was being created; the subject and text then name the product's title. These emails are sent through Brevo or STRATO (section 4).

Versions in “My listings”: whatever Listimo creates from one of your offers is stored in “My listings” like any generated listing (section 9). For each version we store which offer it is intended for (seller identifier, marketplace, SKU, ASIN), as well as the previous title and the address of the previous main image. The results folder also contains a copy of the main image the AI worked from, and for reworking individual images we keep the working state of the order including the offer texts taken over; we delete both automatically after 90 days.

Where the data is kept and who sees it: we store the data from the connection — access right, catalogue, figures, measurements and the history of your transfers — with our database provider Supabase in its EU data centre (Ireland, section 4) and process it on our server at Hetzner in Germany; “My listings” and the results folders are kept there as well. The access right issued by Amazon is additionally stored encrypted (AES-256-GCM); we keep the key separately on our server in Germany. The database is set up so that only our server can access it. Within Listimo only the operator has access, and only as far as needed for operations, troubleshooting and handling your support requests. In our internal administration we can see whether and since when your account is connected, the last five characters of your seller identifier, whether the same seller identifier is attached to another Listimo account, your marketplaces, whether the last sync succeeded (error messages shortened and without ASIN, SKU or quotations from your offers), whether the authorisation is still valid, how many transfers you triggered in the last 30 days and with what result, and your early-access status; in the internal activity log also connecting and disconnecting (with the last five characters of the seller identifier) and, for improvement orders, the ASIN. The administration does not show us titles, texts or sales figures of your offers. Our server's technical logs may contain the seller identifier, an ASIN, a SKU or a product title for troubleshooting; they are deleted after 14 days at the latest. We do not pass your data on to any recipients other than those named in this section, sell it or combine it with data of other customers.

Country confirmation: before you create offers in a further marketplace for the first time, you confirm that you are registered there for VAT, packaging and extended producer responsibility (EPR). We store the marketplace and the time of this confirmation in your account so that we do not have to ask again for every order and can evidence the confirmation; it remains stored after you disconnect, until your account is deleted.

Ending the connection: you can disconnect at any time in your Listimo profile. We then immediately delete the access right as well as your catalogue, figures, measurements and analyses, and stop retrieving data. We keep the history of your transfers including backups for as long as your Listimo account exists, so that you can still undo changes after reconnecting the same seller account. Versions in “My listings” remain until you delete them or they drop out under section 9. You end the authorisation at Amazon itself additionally in Seller Central under the app / third-party permissions. If you revoke it there or it expires, we can no longer retrieve any data; the data stored up to that point remains until you also disconnect in Listimo or delete your account. When you delete your Listimo account, we delete the connection, catalogue, figures, history and backups, your versions in “My listings”, the working state of your orders as well as your waiting-list entry and country confirmation. Exempt from this are the pseudonymised count list (above), the entries in the internal activity log until they drop out under section 9, the results folders, which like all result files are deleted after 90 days, and the server log files (no longer than 14 days). Disconnecting and deleting your account do not change anything about your offers at Amazon.

Legal bases: connecting, syncing, displaying, creating new content and transferring take place at your request to perform the user agreement (Art. 6(1)(b) GDPR), as do the waiting list and early access as steps prior to unlocking that you initiate yourself. The connection is voluntary. We process contact details of other persons in your offers, the count list, the country confirmation as evidence, the internal activity log and the server log files on the basis of our legitimate interest in carrying out and being able to trace your orders, complying with Amazon's requirements for apps and operating the service securely (Art. 6(1)(f) GDPR).

15. Phone outreach to Amazon sellers by our partners

Since 19 October 2026, selected partners of our partner programme (section 5) call Amazon sellers on our behalf to present a free analysis of their Amazon listing and Listimo. We approve each of these partners individually. This section is addressed to the sellers who are called and their contact persons: where we got the details, who sees them, what we store and how you can object. It supplements section 7.

Sales team: members of a sales team paid a fixed fee by us also call on our behalf (data processing on our behalf, Art. 28 GDPR). They work with the same database and under the same rules as our partners, each person with their own access; everything in this section applies to them in the same way. The differences: they only call sellers with a business address in Germany, Austria or Switzerland, they receive no commission and their link contains no code. They only see a sign-up or purchase if you sign up through the link to the analysis. If you agree an appointment with us during the call, the person enters your name and email address in our Calendly calendar with your consent (provider and transfer to the USA as in section 2); Calendly sends you the confirmation. On the seller entry we store that and when the appointment was entered, for whom, and the appointment's ID (Art. 6(1)(a) and (b) GDPR). So that we can prepare for the appointment, the person can note what you want to achieve and what was discussed, and store files relating to the call, such as a price list. Only that person and we can see this; it does not go to Calendly or into the confirmation (Art. 6(1)(b) and (f) GDPR). If you say you do not want calls, we delete it immediately.

Whom we have called: sellers who sell on Amazon themselves and whose business address is in Germany, the United States, the United Kingdom, France, Belgium or Ireland. Only businesses are called, and only about their Amazon business, never private persons; we select sellers whose listing our analysis finds concrete improvements for. We do not have anyone called who has already been contacted by us by email, who has objected (block list from section 7 or phone block, below) or who cannot change their own listing because Amazon or several sellers sell it. Each seller is only ever with one partner.

Origin of the data: the details come from the same public sources as in section 7: product data of your listings (ASIN, brand, category, title, images, review counts and, where available, an estimated monthly revenue) as well as the name, business address, phone number and, where stated, email address from your public seller profile on the respective Amazon marketplace (amazon.de, amazon.com, amazon.co.uk, amazon.fr, amazon.com.be, amazon.ie), retrieved through ScraperAPI (section 4). If a partner knows a seller from their own business contact or from a public source such as the legal notice of a website, they can also add the seller themselves; the details (product, brand, company, contact person, phone number, email address, website, address) then come from that partner.

Who sees the data: before the takeover, an approved partner only sees the brand, category, town and country as well as figures on your listings (estimated revenue, reviews, number of images and videos), no company name, no phone number, no email address and no postal address. Only once they take you over do they see, as the only partner, the company, the name of the seller account, a contact person where available, the business address, phone numbers, email addresses, website, your products and the analysis. The partners act in our name and under our rules: they may only use the data for the call on behalf of Listimo, must not copy, export or pass it on and must not use it once their access has ended; they committed to this before approval (terms of participation, section 11). Partners based outside the EU and the EEA are only admitted from countries for which an adequacy decision of the European Commission exists (such as the United Kingdom and Switzerland). We remain the controller (section 1).

What we store: for each seller in phone outreach we store which partner took them over and when, every call (time, result such as “Call back” or “Not interested”, a short note by the partner on the conversation and, where applicable, a date for the next call), the analysis (score and the main findings), the partner's code in the link and, if you agreed to receive the analysis by email, who agreed, to which address and when. We mark the seller record as being in phone outreach; it then receives no email from our email outreach (section 7). Only the responsible partner and we see these details.

Analysis and link: for the analysis we retrieve your public product page through ScraperAPI, alternatively through Keepa, and have it assessed by OpenAI's AI (section 4). Only product data of the listing is sent to OpenAI (brand, title, bullet points, description, images), no phone number, no address and no notes. The personal link to the analysis is valid for at least 60 days and contains the partner's code. When it is opened, we count, as in section 7, only the number of visits and the time of the first and last visit; visits from the partner's preview do not count.

Email only after consent: the partner only sends you an email with the analysis if you agreed during the call. They send it from their own mailbox; their email provider then also processes your address. You can withdraw your consent at any time with effect for the future (Art. 7(3) GDPR), for example by replying to the email or informally to support@listimo.ai.

Sign-up and purchase: if you sign up via the link or with the partner's code, we match the email address of your new account against the email addresses and website we know for your business (same address or same company domain, no addresses at free email providers). This lets the partner see on your record whether you opened the link, signed up and made a purchase, each with the date, plus the number of purchases and their commission; when you sign up and make your first purchase, they receive an email with your brand and company. They do not see the email address of your account, your billing details or the content of your account.

Legal basis: we process this data on the basis of our legitimate interest in presenting Listimo personally to businesses that sell on Amazon (direct marketing, Art. 6(1)(f) GDPR). We only have businesses called for which, given the concrete findings on their Amazon listing, we may assume an interest in an improvement. The email with the analysis is based on your consent during the call (Art. 6(1)(a) GDPR). We carry out the matching on sign-up and purchase in order to attribute the partner's commission correctly and to show them what came of their call (Art. 6(1)(b) and (f) GDPR).

Objection: you can object to the calls at any time without giving reasons (Art. 21(2) and (3) GDPR). Just say so during the call and the partner immediately logs “Do not call”: all phone numbers of your business that we know are then blocked for all partners, your email addresses are added to the block list from section 7, and any consent to the email counts as withdrawn. You can also write informally to support@listimo.ai; we then block your numbers and addresses in the same way. For the block we store the number, the reason, the time and the partner who logged it.

Retention: which partner took you over, the calls with notes, details and files for preparing an appointment, the analysis record, the code in the link and your consent to the email are deleted automatically 24 months after the last activity. An activity is the takeover by the partner, a call, an analysis, the partner returning you, or your sign-up or purchase via the link. If a partner added you themselves, we then also remove the contact details they entered (contact person, phone number, email address, postal address). The seller entry keeps only a note without the partner and without anything said in the calls, so that afterwards we neither have you called again nor contact you by email. We store the details from your public seller profile as described in section 7. We delete earlier on request. If a partner does not call a seller they took over within the reservation period (currently 14 days) or returns them without a call, we delete the takeover straight away. Blocks following an objection are kept permanently, because this is the only way we can make sure that nobody calls you again.

Information on the first call: at the start the partner gives their name, says that they are calling on behalf of Listimo and that the number comes from your Amazon seller profile, and on request points to this privacy policy; the email with the analysis contains a link to it. This is how we inform you under Art. 14 GDPR. You can exercise your rights from section 10 (access, rectification, erasure, restriction, objection, complaint to a supervisory authority) directly with us; partners forward such requests to us.

16. Our pages on social networks

Listimo has its own pages on YouTube, TikTok, Instagram and Facebook; the links to them are at the bottom of our pages. They are plain links: the network only receives data from you once you click one of them. If you visit our page there, the network processes your data under its own terms, among other things to show us aggregated statistics about the visitors to our page. We cannot identify individual visitors in them. For our pages on Facebook and Instagram we are joint controllers with Meta Platforms Ireland Limited (Art. 26 GDPR); the details are set out in Meta's Page Insights Controller Addendum, under which Meta is primarily responsible for requests about your rights. YouTube (Google Ireland Limited) and TikTok (TikTok Technology Limited) process the data under their own privacy policies. If you send us a message or a comment there, we process it in order to reply. The legal basis is our legitimate interest in presenting Listimo there and getting in touch with you (Art. 6(1)(f) GDPR). Data may also be transferred to the USA in the process (EU-US Data Privacy Framework).

Last updated: 2 November 2026 · English version added 16 September 2026

This English text is a translation provided for convenience. In case of any discrepancy, the German version at listimo.ai/datenschutz.html is the authoritative one.