Privacy Policy

This privacy policy covers listedai.app and explains how the Listed AI mobile application — available on iOS (Apple App Store) and Android (Google Play Store) — published by WIL7 (we, our), collects, uses, stores, and protects the personal data of its users.

1. Data Controller

• Company: WIL7 (Sole Proprietorship)
• SIRET: 882 668 072 00011
• Address: 173 Les Quatre Maillons, 43400 Le Chambon-sur-Lignon, France
• Email: hello@listedai.app

2. Data Collected

• First name, last name
• Email address
• Username
• Images uploaded by the user
• Authentication provider (e.g., Apple, Google, email)
• System language
• Listing history
• Technical data (timestamps, logs, crash reports if enabled)
• Optional PostHog usage-analytics events on iOS and Android, only after your explicit choice, as described in section 6
• Referral program data – generated referral codes and the identifiers of the code owner and redeemer, the time of redemption, and reward duration. No names or contact details of referred friends are collected until they create an account
• Device-level signals used to enforce account creation limits (no personally identifiable information is stored beyond what is necessary to prevent abuse)
• Background Remover usage counters (iOS only): a local counter tracks your free-tier edits and is mirrored to your user profile in Firestore. The background-removal processing itself is performed on-device using Apple's Vision framework; your original photos are NOT transmitted to our servers for this feature.
• Limited-Time Discount Offer state (iOS only): status (not seen / active / expired / purchased), exposure, dismissed and resurface counters, and the corresponding timestamps (first seen, expires at, last shown, cooldown until). This state is used solely to throttle the offer, prevent abuse, and sync eligibility across your devices.

3. Purpose of Data Processing

• Automatically generate listings from photos
• Display and sync listing history
• Improve service quality (UX, detection, speed)
• Enable cross-device experience
• Generate aggregated and pseudonymous usage statistics
• Conduct commercial and product improvement analysis
• Display personalized advertising through third-party services
• Manage the referral program (validating codes and allocating rewards)
• Enforce device-level account creation limits to prevent fraud and abuse

4. Legal Basis for Processing

• Your consent (when creating an account or uploading photos)
• Your separate optional consent for PostHog usage analytics on iOS and Android; this collection is off until you explicitly enable it
• Contract performance (delivery of the Listed AI service)
• Our legitimate interests (service improvement, security, analytics)
• Processing referral program data is based on legitimate interests (to operate and improve the service) and, where necessary, the user's consent

5. Data Sharing

Your data is not sold, but may be shared with trusted technical partners:

• Firebase (Google Cloud) for secure hosting and analytics
• PostHog Cloud, configured in its EU region, for optional usage analytics on iOS and Android after your explicit consent (see section 6)
• Google (Gemini 2.5 Flash) as the primary AI provider, and OpenAI (GPT-4o) as a fallback, solely for processing the images you upload to generate listings (no personal data is sent). As part of generation, Gemini may use Google Search grounding to verify product identity and real-time second-hand market prices.
• Google AdMob for in-app advertising (banner, interstitial, rewarded video, and native ads), with Meta Audience Network as a bidding mediation partner
• Unity Ads for displaying advertisements
• Meta SDK for advertising campaign measurement and optimization
• Apple (App Store) and Google (Google Play), when you request a refund for a purchase: at their request we provide data limited to that purchase, namely whether the service was delivered correctly, the extent to which you used it (for example the number of listings generated after purchase) and the age of your account, solely so that the platform can decide on your request

AdMob and its mediation partners (including Meta Audience Network) may collect technical data (device type, advertising identifiers, IP address) to personalize ads in compliance with GDPR.

The technical partners used for these purposes are described above. Optional PostHog analytics has its own consent choice and does not receive your listing content.

6. Analytics (Firebase Analytics and optional PostHog)

Listed AI uses Firebase Analytics to collect usage data and improve user experience. Paragraphs a–f below describe Firebase; optional PostHog on iOS and Android is described separately in paragraph g, and website analytics in paragraph h:

a) Types of data collected

• App interaction events (listing creation, onboarding, etc.)
• Device information (model, operating system, app version)
• IP address (for approximate geolocation)
• Advertising identifiers (IDFA on iOS, Google Advertising ID on Android) if authorized by the user
• Performance and crash data (if enabled)

b) Purposes

• Improving user experience and app performance
• Analyzing usage trends and most-used features
• Detecting and resolving technical issues
• Optimizing performance and stability

c) Legal basis

We rely on our legitimate interests to measure and improve service performance. Where local law requires consent for analytics, we rely on your consent collected via our consent tool (e.g., Google UMP). Otherwise, we limit analytics to strictly necessary, aggregated/pseudonymized measurements.

d) Retention period

Analytics data is retained for 14 months by default, in accordance with Firebase Analytics settings. Aggregated and anonymized reports may be retained longer.

e) International transfers

Data may be transferred to Google (United States) with appropriate safeguards, including EU Standard Contractual Clauses.

f) Opt-out

You can disable analytics through app settings or by contacting us. Core app functionality remains available.

g) Optional PostHog usage analytics (iOS and Android)

In iOS and Android versions that offer this option, we use PostHog only if you explicitly enable Usage analytics. This choice is off by default and is separate from advertising consent, Apple App Tracking Transparency on iOS, and Firebase Analytics. Declining does not prevent you from using Listed AI. We do not collect or backfill PostHog events from before your choice.

We use these events to understand onboarding, sign-in, listing generation and copying, app reliability, return usage, quotas and subscription purchase flows. Events contain predefined categories and limited counts or durations, rather than the content of your listings.

• A random analytics identifier for signed-out activity; iOS also sends session identifiers. When you sign in, a project-specific pseudonymous identifier derived from your account identifier associates events with your account. The original Firebase account identifier is not sent to PostHog.
• Predefined interaction and outcome categories, such as the onboarding step, sign-in method, generation mode, copy field, selected marketplace, paywall source, selected subscription plan and purchase result.
• On iOS, limited technical context: event timestamps, app and analytics SDK versions, iOS version, device model/type, interface language and whether your current app access is free or PRO. This access state may include temporary or rewarded PRO access and does not itself establish a paid subscription.
• On Android, limited technical context: app version and build, interface language, platform and environment markers, analytics schema version and whether your current app access is free or PRO. This access state does not itself establish a paid subscription.

This PostHog integration does not send photos, listing titles or descriptions, listing prices, email addresses, names, usernames, custom prompts, receipt or transaction identifiers, advertising identifiers, device names, or raw error messages. Session replay, automatic screen/interaction capture and automatic crash capture are disabled. GeoIP enrichment is disabled and no IP address or location is added to analytics event properties. As with other online services, network connections expose a source IP address to the service infrastructure.

The events are sent over HTTPS to our PostHog Cloud project in the EU region. Pseudonymous identifiers are not anonymous data: they allow events to be associated with the same account or analytics installation. We do not use this PostHog integration to combine activity across other companies' apps or websites for advertising.

You can withdraw your PostHog choice at any time in Settings → Analytics → Usage analytics. This stops further collection and prevents events still pending under the withdrawn choice from being sent. Signing out or switching accounts resets analytics identity for subsequent activity.

Withdrawing consent or deleting your Listed AI account does not automatically erase events already received by PostHog. To request access or erasure of previously collected analytics data, contact support@listedai.app. The Firebase retention period stated above does not describe PostHog retention. Our current PostHog free plan provides event retention of up to one year; this is separate from Firebase’s retention period. See PostHog's privacy notice for its own practices.

h) Optional website analytics (listedai.app)

Website analytics is off until you select Accept analytics. This website choice is separate from the choices in the mobile apps. Declining does not affect access to the website or download buttons, and we do not backfill visits or clicks from before your choice.

After consent, PostHog measures visits to public pages, download-button clicks (including button position and chosen store), page exits, scroll depth, and page-speed metrics. Events include page paths, language, browser/device type, timestamps, random browser and session identifiers, referring domains, and limited campaign tags (UTM source, medium, campaign, content and term). A store-button click does not tell us whether you installed the app.

We strip URL query strings and fragments from captured URLs and retain only validated campaign labels separately. Authentication, email-verification and password-reset pages are excluded. Session replay, automatic interaction capture, advertising identifiers and person profiles are disabled. We do not connect website identifiers to your mobile account. Events use our EU PostHog project with GeoIP enrichment disabled; the service infrastructure still receives the source IP for network connections.

Your browser stores this analytics choice for 180 days. If you accept, PostHog also uses local storage and session storage for random identifiers and session information; no PostHog analytics cookies are configured. You can reopen Privacy choices on public pages and select Decline to stop further collection and clear the SDK’s stored analytics identity. A later acceptance starts a new analytics identity. If browser storage is unavailable, your choice may last only for the current page.

Website analytics events have the same current PostHog free-plan retention of up to one year. Withdrawing consent does not erase events already received. Contact support@listedai.app for access or erasure requests. We do not use website analytics to track you across other companies’ sites for advertising.

7. Advertising & Attribution (Meta SDK)

Listed AI uses the Meta SDK (Meta Events Manager) to measure and optimize advertising campaigns:

a) Data collected

• Device information (model, operating system, app version)
• IP address for geolocation
• Advertising identifiers (IDFA on iOS, Google Advertising ID on Android) if authorized
• App event signals (listing creation, onboarding, etc.)
• Attribution and campaign measurement data

b) Purposes

• Measuring advertising campaign effectiveness
• Attributing conversions to Meta campaigns
• Optimizing audiences and advertising targeting
• Analyzing advertising performance

c) Legal basis

Processing is based on your consent for personalized advertising and attribution. You can withdraw your consent at any time.

d) International transfers

Data may be processed outside the EEA (e.g., United States) by Meta Platforms and its affiliates. Such transfers are carried out with appropriate safeguards, including EU Standard Contractual Clauses. Please refer to Meta's Privacy Policy for up-to-date processing locations and practices.

e) Retention period

Attribution data is retained for a maximum of 24 months. Aggregated reports may be retained longer.

f) User controls

You can withdraw your consent through app settings or your device's system settings. See Meta's privacy policy for more information.

8. Referral Program Data

Listed AI operates a Referral Program. This section explains how data related to this feature is collected, stored, and used.

a) Referral program data

When you generate a referral code or redeem one, we store the generated referral code, the identifiers of the code owner and redeemer, the time of redemption, and reward duration. No names or contact details of referred friends are collected until they create an account and sign up for Listed AI.

b) Storage and processing

Referral logs are stored in Firebase Firestore within the European Union. They are kept separate from user profile information, used solely to run the referral program, and may be aggregated to prevent fraud.

c) Privacy protections

WIL7 does not collect personal data of referred friends or send them marketing messages. Only the referrer sends the code to their friends. This approach aligns with GDPR guidance that organizations should not collect or contact referred friends without their consent.

d) Legal basis

Processing of referral data is based on our legitimate interests (to operate and improve the service) and, where necessary, the user's consent. For more details, see section 4 (Legal Basis for Processing).

9. Push Notifications

Listed AI may send push notifications to keep you informed:

a) Data collected

• Notification token (APNs on iOS, FCM on Android) - unique device identifier
• Notification preferences (authorized types)

b) Types of notifications

• Transactional notifications: listing generation complete, account updates
• Promotional notifications: new features, special offers (with your consent)

c) Legal basis

Transactional notifications are necessary for service operation. Promotional notifications require your explicit consent via the system prompt (iOS or Android).

d) Notification management

You can disable notifications at any time via your device settings (iOS or Android) or the app. The notification token is deleted when you disable notifications or delete the app.

e) Retention period

The notification token is retained only while notifications are enabled. It is automatically deleted when disabled or when the app is uninstalled.

10. Consent Management

Listed AI uses several mechanisms to manage your consent:

a) Google User Messaging Platform (UMP)

In the EU/EEA, we use Google UMP to request your consent for personalized advertising and tracking.

b) App Tracking Transparency (ATT) & Android Consent

On iOS, we request ATT authorization before any cross-app tracking, in accordance with Apple's requirements. On Android, advertising identifier access is managed via the Google Advertising ID and the user's device settings.

c) Withdrawing consent

You can withdraw your consent at any time via:

• App settings
• Your device's system settings
• By contacting us at support@listedai.app

d) Impact of refusal

You can refuse personalized advertising and continue using the app. Ads will be less relevant but the app will function normally.

e) Separate PostHog choice (iOS and Android)

Optional Usage analytics uses a separate choice that is off by default. Advertising consent or ATT authorization on iOS does not enable PostHog. You can decline or switch this option off in Settings → Analytics → Usage analytics and continue using the app. Continued use of Listed AI or acceptance of this privacy policy does not grant this analytics permission.

11. International Data Transfers

Some of our technical partners may process your data outside the European Economic Area (EEA):

• Google (Firebase, Gemini AI, Google Search grounding): United States - with EU Standard Contractual Clauses
• Meta Platforms: outside the EEA (e.g., United States) - with EU Standard Contractual Clauses
• OpenAI: United States - with appropriate protection measures

All international transfers are made with appropriate safeguards to protect your data, in accordance with GDPR.

For optional usage analytics on iOS and Android, our PostHog Cloud project is configured in the EU region. This describes the analytics project configuration; it does not imply that every PostHog support or business operation is confined to the EU.

12. Data Retention

Here is an overview of retention periods for different categories of data:

Additional details:

• Images: Stored as long as the listings exist in the app, then deleted if the account or the listings are removed.
• Personal data: Deleted or anonymized when the account is deleted.
• Generated listings: May be retained in anonymized form for archival or service improvement purposes.

PostHog usage analytics is a separate dataset. Its retention setting is not the Firebase 14-month period. The current PostHog free plan provides retention of up to one year. Contact support@listedai.app to request access or erasure; withdrawing the app choice stops future collection but does not automatically erase server history.

13. Transmission to AI Providers

For listing generation, images you upload are transmitted in base64 format to our AI providers via our Cloud Functions backend. The primary provider is Google Gemini 2.5 Flash; OpenAI GPT-4o is used as a fallback if Gemini is unavailable. A short content-moderation pre-screening runs on Gemini before generation to block prohibited content.

Gemini may additionally use Google Search grounding to verify product identity and real-time second-hand market prices.

No personally identifiable information (name, email, account ID, etc.) is transmitted together with the images.

We do not control how Google or OpenAI may store or process these images beyond their respective data protection agreements and applicable international transfer safeguards.

Background Remover (iOS only): background-removal processing runs on-device using Apple's Vision framework. Your original photos are NOT transmitted to our servers or to any AI provider for this feature.

14. User Rights

In accordance with the General Data Protection Regulation (GDPR), you have the following rights:

• Right to access your data
• Right to rectify inaccurate information
• Right to erasure (right to be forgotten)
• Right to restrict processing
• Right to object
• Right to data portability

You can exercise your rights at any time by contacting us at support@listedai.app

15. Security

• Secure HTTPS connections
• Firebase AppCheck protection (Play Integrity on Android, App Attest on iOS)
• Device-level account creation limits to prevent automated registrations and abuse
• Disposable email address detection to protect service integrity
• Restricted access to stored images
• Firebase authentication with verified email

These measures ensure a high level of data confidentiality and protection.

16. Account Deletion

• Removal or anonymization of personal data (name, email, username)
• Deletion of uploaded images
• Possible retention of generated listings in anonymized form

The app resets PostHog analytics identity after account deletion. Previously received PostHog analytics events are not automatically erased by this reset; contact support@listedai.app to request erasure, as described in section 6.

17. Complaints

If you believe your data rights are not being respected, you may file a complaint with the CNIL (Commission Nationale de lInformatique et des Libertes):

18. Advertising

a) Advertising Partners

Listed AI uses the following advertising services:

• Google AdMob - for displaying banner ads, interstitial ads, rewarded video ads, and native ads (with Meta Audience Network as a bidding mediation partner)
• Unity Ads - for banner ads, interstitial ads, and rewarded video ads
• Meta SDK - for advertising campaign measurement and optimization
• Other advertising partners may be added (AppLovin, IronSource, etc.)

b) Data Collected by Partners

Advertising partners may collect the following data:

• IDFA (Identifier for Advertisers) on iOS 14.5+ / Google Advertising ID on Android - if accepted by the user
• IP Address - for approximate geolocation
• Device Information - model, operating system, app version
• Usage Data - ad interactions, app usage frequency
• Technical Identifiers - session IDs, anonymous advertising identifiers

c) Consent and Preference Management

In compliance with GDPR and local regulations:

• The app uses Google User Messaging Platform (UMP) to request consent in the EU/EEA
• Users can decline ad personalization and receive non-targeted advertisements
• Consent can be withdrawn at any time through device settings or the app
• On iOS, ATT (App Tracking Transparency) authorization is requested before cross-app tracking. On Android, advertising identifier access is managed via the Google Advertising ID settings

d) Partner Privacy Policies

For more information about how our partners use your data:

• Google Privacy Policy
• Unity Privacy Policy
• Meta Privacy Policy
• AppLovin Privacy Policy (if applicable)

19. Data Related to PRO Subscriptions

When you subscribe to Listed AI PRO, we store a unique identifier linked to your Firebase account. This token helps verify your subscription and does not contain personal data.

No payment information is stored or processed by Listed AI — all transactions are handled by Apple (via StoreKit) on iOS and by Google (via Google Play Billing) on Android.

20. Changes

This policy may be updated at any time.

Users will be informed in the event of significant changes.

Continued use of the app after such updates constitutes acceptance of the new policy.