Privacy policy

Who we are

LaLista (“we”, “us”) provides software that connects your vehicle inventory to advertising workflows on social platforms. For the purposes of applicable data protection law, we act as the controller of personal data described in this policy, except where we process personal data strictly on behalf of a customer — in those cases we act as a processor, as set out in our agreement with that customer and, where required, our DPA.

What this policy covers

This policy applies to visitors to our marketing sites, users of the LaLista application, and individuals who contact us or receive communications from us. It does not govern third-party sites or services you link to from our product (for example Facebook or Instagram), which have their own policies.

Personal data we process

Depending on how you use LaLista, we may process the following categories of information:

• Account and billing. Name, work email, company name, authentication identifiers, subscription and payment-related records (payment processing may be handled by a payment provider; we typically receive limited billing metadata rather than full card numbers).
• Content you or your organization provide. URLs and data from crawled public listings (for example vehicles), text and media used in creatives, campaign settings, and similar operational content needed to run the service.
• Integration and advertising platform data. OAuth tokens, technical identifiers, and configuration for connected accounts (for example ad account, Page, or catalog identifiers) as authorized by you in each platform’s settings.
• Usage and technical data. Log data, approximate location derived from IP where available, device and browser type, timestamps, error reports, and in-product analytics needed to operate and improve the service.
• Communications. Messages you send via forms (for example Contact), email, or support channels, and records we keep to resolve requests.
• Marketing preferences. Where permitted, records of consent or opt-out for marketing communications.

Instagram publishing (optional)

If you choose to enable LaLista’s Instagram publishing feature, you connect your business’s Instagram professional account to LaLista by sharing it with Lalista Ltd in Meta Business Suite and confirming in LaLista. Lalista Ltd then publishes posts, carousels and stories about your vehicles to that account on your behalf, following the schedule and approval settings you choose. Nothing is published unless you have enabled the feature, and you can pause or stop it at any time in LaLista.

What we access and store. Through Meta’s Instagram API we read basic information about the connected account (its account ID and username), the posts we published through LaLista (IDs, links and publishing status) and the account’s publishing limit, so that we can schedule posts and show you what was published. We also read performance numbers for the posts we published, such as the number of likes and comments, reach, views, saves and shares. We use these numbers only to show you how your posts performed and to improve scheduling. We keep them while your Instagram connection is active and delete them when you disconnect or ask us to, as described under Data deletion. We store the content we publish (images, captions and the vehicle details they are based on), the schedule and status of each post, and the technical identifiers and access credentials needed to publish. We do not read the content of comments or direct messages, we do not read or store personal data of your followers, and we do not use data received from Instagram for advertising, profiling or sale to third parties.

Control and deletion. You can stop publishing at any time in LaLista and remove Lalista Ltd’s access to your Instagram account in Meta Business Suite (Business settings, Instagram accounts). Posts we have published remain on your Instagram account unless you delete them there. To have the data we hold deleted, see Data deletion.

Meta’s role. Instagram is a service of Meta Platforms, which processes data under its own policies. Our use of information received through Meta’s APIs follows Meta’s Platform Terms.

Purposes and legal bases (including GDPR)

Where the GDPR or similar law applies, we rely on one or more of the following legal bases:

• Performance of a contract — to provide LaLista, authenticate users, sync content you choose to connect, publish content to accounts you connect, and bill for paid plans.
• Legitimate interests — to secure the service, prevent abuse, debug and improve features, analyze aggregated usage, and communicate with you about service-related matters, where those interests are not overridden by your rights.
• Consent — where required for non-essential cookies, certain marketing messages, or other processing we expressly ask you to agree to. You may withdraw consent at any time without affecting the lawfulness of processing before withdrawal.
• Legal obligation — to comply with applicable law, regulation, or lawful requests from public authorities.

How we share personal data

We do not sell your personal data. We may share it in these situations:

• Service providers (subprocessors). Hosting, email delivery, analytics, customer support tooling, security monitoring, and similar vendors that process data on our instructions. See Subprocessors.
• Advertising platforms. When you connect accounts, data needed to publish campaigns is transmitted according to your configuration and each platform’s terms. Those platforms process data under their own policies as independent controllers or as specified in your agreement with them.
• Professional advisers. Lawyers, accountants, or auditors where necessary and subject to confidentiality.
• Business transfers. In connection with a merger, acquisition, or sale of assets, subject to appropriate safeguards and notice where required.
• Legal and safety. When we believe disclosure is required to comply with law, enforce our terms, or protect rights, safety, and security.

International transfers

We may process and store data in the EU/EEA, the United Kingdom, the United States, or other countries where we or our subprocessors operate. Where we transfer personal data from the EU/EEA, UK, or Switzerland to countries not deemed adequate by the relevant authority, we use appropriate safeguards such as Standard Contractual Clauses or equivalent mechanisms, together with supplementary measures where appropriate. You may request more detail via Contact.

Retention

We keep personal data only as long as needed for the purposes above, including legal, accounting, and dispute-resolution needs. Retention periods vary by data type: for example, account data is kept for the life of the account and a reasonable period after closure; logs may be retained for a shorter rolling window unless longer retention is required for security investigations. Specific retention rules may also be set out in your agreement with us.

Security

We implement technical and organizational measures appropriate to the risk, including access controls, encryption in transit where applicable, and vendor review. No method of transmission or storage is completely secure. See Security & trust for a high-level overview.

Your rights

Depending on where you live, you may have the right to access, rectify, or erase your personal data; restrict or object to certain processing; request portability of data you provided; withdraw consent where processing is consent-based; and lodge a complaint with a supervisory authority. To exercise these rights, contact us at the details below. We may need to verify your request and may decline requests that are manifestly unfounded or excessive.

Cookies and similar technologies

Our websites and app may use cookies and similar technologies. See Cookie policy for categories and choices.

Children

LaLista is not directed at children under 16 (or the age required in your jurisdiction). We do not knowingly collect personal data from children. If you believe we have collected such data, contact us and we will take steps to delete it.

Automated decision-making

We do not use personal data for solely automated decisions that produce legal or similarly significant effects concerning you within the meaning of the GDPR.

Changes to this policy

We may update this policy from time to time. We will post the revised version on this page and update the effective date. Where required, we will provide additional notice (for example by email or in-product notification). Continued use of the service after changes become effective constitutes acceptance of the updated policy where permitted by law.

Contact

For privacy questions, requests, or complaints, use Contact or the contact details we provide for your account. For EU/EEA supervisory authorities, you may contact the authority in your country of residence or workplace.