Privacy Policy: How we protect & handle your data
At Getlist, we believe in privacy by design. This policy outlines how information is collected, processed, and safeguarded across both our founder platform and public waitlist pages.
Two Distinct Roles
We distinguish between Getlist Founders (account owners) and Waitlist Participants joining public waitlists.
Secure Payments
Stripe and Chapa process billing. We never store or receive full credit card numbers or security codes.
Zero Ad Trackers
No third-party advertising pixels, session recording tools, or invasive behavioral trackers.
Privacy & Control
Founders and participants maintain rights to access, manage, export, and delete personal data.
Introduction & Roles
Welcome to Getlist. This Privacy Policy explains how [LEGAL ENTITY NAME]("we", "us", or "our") collects, uses, and protects information when you use our waitlist management platform, APIs, dashboard, and public waitlist surfaces (collectively, the "Service").
To maintain clarity and accuracy regarding data responsibilities, Getlist operates under two distinct relationships:
For businesses, creators, and individuals who register accounts on Getlist to build, configure, and manage waitlists, we act as the Data Controller.
For prospective customers joining waitlists created by Founders, Getlist acts as a Data Processor (Service Provider) on behalf of the Founder who controls that waitlist.
Dual Operational Model
Information We Collect
We only collect personal information that is genuinely necessary to provide, optimize, and secure our services. We do not collect extraneous data.
A. From Founders (Account Holders)
- Identity & Account Data: Name, email address, encrypted password hash, optional profile avatar, and account status.
- Authentication & Security Records: Google OAuth identifiers (if signing in via Google), Two-Factor Authentication (TOTP) status, device session tokens, IP address, and browser user agent for active session security.
- Company & Workspace Profile: Company name, industry, description, team size, website URL, country, and billing contact details.
- Billing & Transaction Identifiers: Subscription tier (Starter, Pro), billing cycle, provider transaction IDs, and receipt references. We do not store or process complete credit card numbers or CVVs.
- Uploaded Branding & Assets: Brand logos, visual theme settings, custom copy, and waitlist configuration parameters.
B. From Participants (Waitlist Subscribers)
- Contact Credentials: Email address submitted to reserve a spot on a waitlist.
- Waitlist Position & Referral Identifiers: Unique referral codes, attributed referrer ID, referral count, streak milestones, team memberships, and priority boost status.
- Custom Questionnaire Responses: Answers provided to custom survey or onboarding questions configured by the specific Founder.
- Technical & Anti-Fraud Telemetry: Anonymized or hashed IP address (used strictly for referral fraud and abuse prevention), browser name, device category, country code derived from GeoLite2 database lookup, and referral source attribution.
How We Use Information
We process collected data strictly for specific, legitimate business purposes:
Core Service Provision
Hosting waitlists, computing dynamic queue positions, attributing referral rewards, and delivering participant access codes.
Transactional Notifications
Dispatching transactional verification emails, waitlist position updates, password reset links, and cohort invitations. We never send spam.
Monetization & Paid Priority
Facilitating "Skip the Line" priority passes and Pre-Order Deposits through integrated secure payment gateways (Stripe & Chapa).
Security & Fraud Prevention
Detecting fake referral spikes, bot attacks, and manipulated ranking entries using hashed IP signatures and rate limiting.
Third-Party Services
The Getlist application interfaces with reputable external service providers to deliver robust functionality:
Payment Processors (Stripe & Chapa)
Process subscription payments and waitlist monetization transactions. All payment handling adheres to PCI-DSS standards governed by Stripe and Chapa's independent privacy notices.
Email Delivery (Resend / SMTP)
Used to dispatch transactional emails, email confirmations, access invitations, and password resets.
Media & File Storage (Cloudinary)
Stores brand logos, uploaded company imagery, and campaign visual assets.
Identity & Single Sign-On (Google OAuth)
Provides optional federated login credentials for Founders wishing to sign in with their Google profile.
Security & Data Retention
We employ industry-standard administrative, physical, and technical safeguards designed to protect personal data from accidental loss, unauthorized alteration, disclosure, or misuse.
- Strong cryptographic one-way hashing for user authentication passwords.
- HTTPS transmission encryption for all public and private API endpoints.
- Timed expiration and single-use invalidation for password reset and email verification tokens.
- Database relational cascades allowing comprehensive account and waitlist deletion.
Data Retention Policy
Your Privacy Rights
Depending on your jurisdiction, you may have statutory rights regarding your personal information, including:
Access & Portability
Request a copy of the personal data we hold concerning your account.
Correction & Rectification
Update incomplete or inaccurate contact or company data through your profile settings.
Erasure ("Right to be Forgotten")
Request the permanent deletion of your account and associated waitlist data.
Withdrawal of Consent
Unsubscribe from non-essential waitlist status notifications at any time.
Participants:Because Getlist processes participant submissions on behalf of Founders, requests for deletion or correction of answers submitted to a creator's waitlist should be directed to that Founder first.
Children's Privacy
Our Service is intended for businesses, entrepreneurs, and adults over the age of majority. We do not knowingly collect or solicit personal data from children under the age of 13 (or under 16 where required by local legislation).
If we become aware that a child has provided us with personal information without verified parental consent, we will take prompt measures to delete such records from our databases.
International Data Transfers
Getlist provides a global platform. As such, information collected through our Service may be transferred to, stored, and processed in cloud data centers located outside of your state, province, or country of residence.
We ensure that cross-border service providers maintain adequate contractual and technical data protection standards consistent with standard data protection principles.
Changes to This Privacy Policy
We may update this Privacy Policy periodically to reflect changes in our legal obligations, product capabilities, or operational practices.
When significant revisions occur, we will update the "Effective Date" at the top of this document and provide noticeable announcement banners on the platform or direct email notifications to active Founders.
Contact Us
If you have questions, feedback, or data privacy requests regarding this policy or our data practices, please reach out directly to our dedicated privacy contact: