Privacy policy.

This policy explains how Push Button Inc (Florida, USA), operating the BusinessList service at businesslist.ai, handles personal information. It covers two distinct groups of people, and the difference between them matters throughout:

• Customers. People who create an account, sign in, and use the service. We hold their account information because they gave it to us.
• Business contacts. People whose business contact details appear in our compiled dataset. They did not give us their information directly, and most of this policy is about what we do with it and how they can control it.

If you are here because your details appear in our dataset and you want them removed, you can do that immediately on the Do Not Sell or Share My Personal Information page. No account and no fee.

1. What information we hold

Business contact records

The core of the service is a compiled dataset of business contact records. A record describes a person in their professional capacity at a business and may contain: full name; job title and, in the LinkedIn corpus, a normalised seniority level; business email address and the type of its domain; business phone and fax numbers; employer name, website and, in the LinkedIn corpus, a public profile URL; business street address, city, county, state, zip and country; industry classification, including SIC and NAICS codes; and coarse revenue and employee bands for the employer. Records also carry our own metadata: the verification status of the email address and when it was last checked.

This is business contact information. We do not knowingly compile government identifiers, financial account numbers, health information, precise geolocation, biometric data, or any other category of sensitive personal information, and we do not want it in the dataset. If you believe such information has ended up in a record, tell us at privacy@businesslist.ai and we will remove it.

Customer account information

For people who use the service we hold: name and email address; a hashed password, never the password itself; the workspace and the teammates in it; the plan, credit balance and credit ledger; billing records from our payment processor, including invoices and the last four digits and brand of a card, but never full card numbers, which we never receive or store; API keys, stored as hashes with a short visible prefix; and a record of activity in the service, such as searches run, contacts unlocked and exports taken, which we need in order to bill correctly, enforce limits and investigate misuse.

Technical information

When you use the site we process ordinary technical information: IP address, browser and device type, pages requested and timestamps. We use a small number of strictly necessary cookies to keep you signed in and to protect the service. We do not use advertising cookies and we do not sell or share this technical information.

On the opt-out form we record the submitted address and a note if you leave one, and we rate-limit submissions by network address to prevent abuse of the form.

2. Where the business contact data comes from

The records in the dataset are compiled from:

• public business filings, registrations and directories;
• publicly accessible company websites and published business listings;
• professional profile information that the individual or their employer has published publicly;
• business data licensed or otherwise obtained from third-party data suppliers and partners; and
• verification results generated by us, when a customer unlocks a contact and the email address is checked against an email verification provider.

We ask our suppliers to represent that they have the right to provide the data to us. We are not able to guarantee the practices of every upstream source, which is one of the reasons the opt-out on this site is unconditional.

3. Why we use it

We use business contact records to:

• operate a searchable business-contact directory for our customers;
• allow a customer to reveal, export and use a specific contact for business-to-business purposes;
• verify email deliverability at the moment a contact is unlocked, and record the result on the record;
• maintain data quality, deduplicate records and correct errors; and
• maintain and apply the suppression list, so that opted-out addresses stay out of results.

We use customer account information to:

• provide the service, authenticate you, and keep your workspace and its unlocked contacts available to you;
• meter and bill credits, and process payments;
• send service messages such as verification emails, password resets, receipts and material changes to this policy;
• enforce rate limits, detect abuse and secure the service; and
• comply with law and enforce our terms of service.

Where the General Data Protection Regulation or a similar law applies, our lawful basis for processing business contact records is our legitimate interest in operating a business-to-business contact directory, balanced against the interests and rights of the individuals in it. The opt-out on this site, and the suppression that follows it, is the practical expression of that balance. For customer account data the basis is performance of our contract with you, and our legitimate interest in securing the service.

4. Who we disclose it to

To our customers. Business contact records are made available to customers of the service. A record is searchable in masked form, and its email address and phone number are revealed to a customer who unlocks it. Under California law, making personal information available in this way is treated as a sale or share, so we describe it that way and we honour opt-out requests accordingly.

To service providers. We use a small number of vendors that process information on our instructions and are bound by contract to use it only to provide their service to us: cloud hosting and database providers; a payment processor for billing; an email provider for transactional messages; and an email verification provider, which receives an email address at the moment a contact is unlocked in order to check deliverability.

For legal reasons. We may disclose information where we believe in good faith that it is required by law, legal process or a governmental request, or where disclosure is necessary to protect our rights, our customers or the public.

In a business transfer. If we are involved in a merger, acquisition, financing or sale of assets, information may be transferred as part of that transaction. Any acquirer remains bound by this policy for information collected under it, including the suppression list.

We do not disclose customer account information to other customers, and we do not sell customer account information. We do not use personal information to train machine-learning models for third parties.

5. California privacy rights

If you are a California resident, the California Consumer Privacy Act as amended by the California Privacy Rights Act gives you the rights set out below. We extend these rights to everyone who asks, regardless of where they live, because it is simpler and fairer than asking people to prove their residency.

In the twelve months before the date of this policy we collected the categories of personal information described in section 1 — identifiers, professional and employment-related information, commercial information, and internet or network activity information — from the sources described in section 2, for the purposes described in section 3, and disclosed them as described in section 4. We sold or shared identifiers and professional and employment-related information, in the sense of making business contact records available to our customers. We do not sell or share sensitive personal information, and we do not knowingly sell or share the personal information of anyone under 16.

Do Not Sell or Share My Personal Information

You may direct us to stop selling or sharing your personal information. Submit the address on the Do Not Sell or Share My Personal Information page. The address is added to our suppression list and stops being returned by search, by unlock, in exports and through the API. The suppression is permanent and survives future data updates. We retain the address itself on the suppression list solely so that we can keep honouring your request, and for no other purpose.

Right to know and to access

You may ask what personal information we hold about you, the categories of sources, the purposes, the categories of third parties to whom it was disclosed, and to receive a copy of the specific pieces of information. Email privacy@businesslist.ai from the address in question or from an address we can reasonably associate with the record.

Right to delete

You may ask us to delete the personal information we hold about you. We will delete it, except where we are permitted or required to retain it — for example, records we need to complete a transaction, to comply with a legal obligation, to detect security incidents, or to keep the address on the suppression list so that your opt-out continues to be honoured. Deletion of a contact record and suppression of the address are usually done together.

Right to correct

You may ask us to correct inaccurate personal information. Tell us what is wrong and what it should say, and we will correct the record or, if we cannot verify the correction, remove the field.

Right to limit the use of sensitive personal information

We do not collect or use sensitive personal information as that term is defined by California law, so there is nothing to limit. If you believe we hold such information about you, tell us and we will remove it.

Right of non-discrimination

We will not deny you service, charge you a different price, or provide a different level of quality because you exercised any of these rights. We do not offer financial incentives for personal information.

How to submit a request, and authorised agents

Use the opt-out form for Do Not Sell or Share. For every other request, email privacy@businesslist.ai. To protect you, we need enough information to match you to a record — usually the business email address in question. We will not ask you to create an account. We acknowledge requests promptly and respond within 45 days; if we need the additional 45 days the law allows, we will tell you why within the first period. You may use an authorised agent, in which case we may ask for written proof of their authority and may contact you to confirm it.

If we deny a request, we will tell you why, and you may appeal by replying to our response. Requests submitted through the opt-out form are honoured automatically and are not subject to review.

6. Other state and international rights

Residents of other US states with comprehensive privacy laws — including Virginia, Colorado, Connecticut, Utah and Texas — have comparable rights to access, correct, delete and opt out of targeted advertising, sale and certain profiling. We handle those requests through the same channels described above and do not require you to identify which law you are relying on.

If you are in the European Economic Area or the United Kingdom, you have rights of access, rectification, erasure, restriction, data portability and objection, and you may object at any time to processing based on legitimate interests. Contact privacy@businesslist.ai. You also have the right to complain to your local supervisory authority. We operate in the United States and information we hold is processed there; where we transfer personal information out of the EEA or the UK, we rely on the standard contractual clauses or another lawful transfer mechanism.

7. How long we keep information

Business contact records are kept while they remain useful to the service and are updated or removed as the data is refreshed. Records matching a suppressed address are removed from results immediately and permanently. Suppression list entries are kept indefinitely, because deleting one would allow a future data update to reintroduce the address.

Customer account information is kept for as long as the account is open and for a reasonable period afterwards, and billing records are kept for as long as tax and accounting law requires, typically seven years. Usage logs used for billing and abuse prevention are kept for a rolling period and then aggregated or deleted. If you close your account and ask us to, we will delete your account information subject to those legal retention obligations.

8. Security

We take reasonable technical and organisational measures appropriate to the risk. Traffic to the service is encrypted in transit; passwords are stored using a modern one-way hashing algorithm and are never recoverable; API keys are stored as hashes and the full value is shown only once, when created; access to production systems is restricted to the people who need it; and payment card data is handled entirely by our payment processor and never reaches our servers. No system is perfectly secure, and we cannot guarantee absolute security. If a breach affects your personal information we will notify you and the relevant authorities as required by law.

9. Children

The service is intended for business use by adults. It is not directed to children, we do not knowingly collect personal information from anyone under 16, and we do not knowingly sell or share the personal information of anyone under 16. If we learn that we hold such information, we will delete it. A parent or guardian who believes we hold information about a child should contact privacy@businesslist.ai.

10. Changes to this policy

We may update this policy. When we do, we will change the effective date at the top of the page. If the change is material we will give notice through the service or by email to account holders before it takes effect. Changes never reduce the protection we give to information already collected without your consent, and they never undo a suppression request.

11. How to contact us

Privacy requests and questions about this policy: privacy@businesslist.ai
Everything else: hello@businesslist.ai

Push Button Inc is the business responsible for the personal information described in this policy and is located in Florida, USA. We will provide a postal address on request.