Privacy Policy

To organize your inbox, Listo connects to your email provider through Nylas using OAuth. We process the new messages needed to classify them. Wherever possible, we work with metadata (sender, subject, timing), classification decisions, and vector embeddings rather than retaining full email bodies.

We store your account profile, subscription status (via Stripe), a reference to your mailbox connection (a Nylas grant id — not your provider password), and per-message classification decisions with their confidence and signals. We do not, by design, store complete email content unless it is strictly necessary; if that ever changes we will update this policy and minimize and protect any such data.

Your data is used to classify and organize your mail, to improve the accuracy of your own results over time, and to operate your subscription. Listo is designed not to sell your data or use it to train third-party models for unrelated purposes.

Listo’s use and transfer to any other app of information received from Google APIs will adhere to the Google API Services User Data Policy, including the Limited Use requirements. We use Gmail data only to provide and improve the email organization features you see in Listo; we do not use it for advertising, we do not sell it, and people at Listo do not read it unless you ask us to for support, it is needed for security purposes, or the law requires it.

Listo sets only the cookies it needs to work: your sign-in session and its timing (so a session ends after inactivity), and short-lived security cookies while you sign in with Google or Microsoft or connect a mailbox.

We measure how our website is used with our own analytics, without cookies and without third parties: the pages viewed, which parts of a page are seen and for how long, how far it is scrolled, which buttons and links are clicked (including starting to sign in or a subscription payment), how fast pages load, the referring site or campaign, and general device details (device type, browser, operating system, screen size, language and time zone). Your browser keeps a random visitor identifier and session identifier in its local storage; they are not linked to your account, your email address or your mailbox, and we do not store your IP address. It never runs on your dashboard or account pages. Listo stores this data itself and deletes it after 400 days. Nothing is measured if your browser sends a Do Not Track or Global Privacy Control signal.

With your consent, we also use Google Analytics to understand how visitors find and use our website (pages viewed, referring site, device and browser type, and approximate location) and which visits lead to creating an account, starting or completing a subscription payment, or connecting a mailbox. For those steps Google Analytics receives only that the step happened, with the plan and its list price or the mailbox provider (Google or Microsoft). Creating an account and connecting a mailbox are reported by our server, linked to the Google Analytics cookie in your browser, so they are only sent if you accepted. Google Analytics sets the _ga and _ga_<id> cookies, which last up to 13 months. It does not load until you accept, never runs on your dashboard or account pages, and never receives your email address, the content of your email or any data from your mailbox. Advertising features and Google signals are turned off. Google processes this data on our behalf under its own privacy policy.

Your answer is saved in your browser’s local storage, and we ask again after six months. You can change it at any time with “Cookie settings” in the site footer or here. Declining removes these cookies from your browser.

Payments are processed by Stripe. We do not store full card details; Stripe handles card data under its own PCI-compliant systems. We retain your Stripe customer and subscription identifiers to manage billing.

You can disconnect your mailbox at any time from your dashboard. Doing so revokes Listo’s Nylas grant, after which we can no longer access your email. You may also manage or cancel your subscription through the Stripe customer portal.

You may request deletion of your account and associated data by contacting us. On deletion we remove your profile, mailbox connections, and classification records, subject to limited retention required for legal, security, or accounting purposes.

Listo is built with security in mind: OAuth-based access, server-side handling of secrets and tokens, signed and verified payment webhooks, input validation, and hardened HTTP security headers. No system can be guaranteed perfectly secure, and we make no such guarantee; we work to reduce risk and respond responsibly to issues.

Questions about privacy? Email support@listotech.ai.