Privacy Policy

01Who We Are

PrepLists is a B2B logistics services marketplace operated by TechnoFrog LLC, a company registered at 8 The Green STE A, Dover, DE 19901, United States. Our operations are based in Spain, and our servers are located within the European Union (Spain).

PrepLists connects businesses with prep centers, warehouses, and transport services across the United States. This Privacy Policy explains how we collect, use, store, and protect your personal and business information when you use our platform at preplists.com.

For any privacy-related inquiries, you can reach us at [email protected].

02Data We Collect

Account Information

When you register for a PrepLists account, we collect the following personal data:

• Email address
• Password (stored as a bcrypt hash — we never store plain-text passwords)
• First name and last name (optional)
• Phone number (optional)
• User role (Partner, Logist, Transportist, or User)

Business Information

If you register as a business partner, we additionally collect:

• Company name and description
• Company email, phone number, and website
• Business type (prep center, warehouse, transport service)
• Tax identification: EIN, tax number, country of registration
• Legal address: street address, city, state, ZIP code, country

Location Data

For business listings, we collect:

• Location name, address, and geographic coordinates
• Working hours and contact information
• Services offered and pricing information
• Photos and descriptions of the facility

Automatically Collected Data

When you visit our website, we may automatically collect:

• IP address and approximate geographic location
• Browser type, operating system, and device information
• Pages visited, time spent, referral source
• Error logs and performance data (via Sentry)

03How We Use Your Data

04Legal Basis for Processing

Under the General Data Protection Regulation (GDPR), we process your data based on the following legal grounds:

05AI-Powered Features

PrepLists offers an AI-powered onboarding assistant that helps you set up your company profile, configure locations, and select services. When you use this feature:

• Your conversation messages and company/location data are sent to our AI processing provider (OpenRouter / OpenAI) to generate responses and execute actions on your behalf
• Data sent includes: company name, description, contact information, location details, services, and your chat messages
• AI providers process this data solely to provide the service and do not use it for training their models

Important: Do not share sensitive information such as passwords, full bank account numbers, social security numbers, tax certificates, or other confidential documents through the AI chat. Any data you voluntarily submit to the AI assistant is processed by third-party AI providers and PrepLists cannot guarantee its retrieval or deletion from those systems. You are solely responsible for the content you share in AI conversations.

By using the AI onboarding feature, you acknowledge and consent to this data processing as described in our Terms of Service. You may choose not to use the AI assistant and configure your profile manually instead.

06Third-Party Services

We share data with the following third-party service providers who process it on our behalf:

We do not sell, rent, or trade your personal data to third parties for their marketing purposes.

07Payments

Payment processing on PrepLists is handled by trusted third-party payment processors. We currently support:

We store only transaction references (payment IDs, subscription status, plan details) — never your full payment credentials. All payment data is handled exclusively by the respective payment processor.

08File Uploads & Storage

You may upload files to our platform for the following purposes:

All uploaded files are stored on secure cloud storage (AWS S3 or Cloudinary) with access controls. Verification documents are never shared publicly or with other users. You may request deletion of any uploaded file at any time.

09International Data Transfers

Our primary servers are located in Spain (EU), ensuring that most data processing occurs within the European Economic Area (EEA).

However, some of our third-party service providers are based in the United States, which means your data may be transferred outside the EEA in the following cases:

• Google Analytics — anonymous usage data processed by Google LLC (US). Google participates in the EU-US Data Privacy Framework (DPF).
• Sentry — technical error data processed by Functional Software, Inc. (US).
• OpenRouter / OpenAI — AI onboarding data processed in the US. Used only when you actively engage with the AI assistant.
• Stripe / Payoneer — payment data processed by US-based payment processors with adequate safeguards.

For all transfers outside the EEA, we rely on appropriate legal mechanisms including Standard Contractual Clauses (SCCs), adequacy decisions, or the EU-US Data Privacy Framework to ensure your data receives an adequate level of protection.

10Data Retention

We retain your data for the following periods:

10bReview Invitations & Email Communications

Service providers on PrepLists may invite their customers to leave a review. These invitations may be sent through our platform via email, or generated as a public/QR link or embeddable widget shared by the partner directly. The following describes what we collect and how it is used:

• What we send: When a partner enables email delivery, we send a single transactional email to the address they supply. The email contains the partner's name, the location name, and a link to leave a review. Each email includes a one-click unsubscribe link.
• What we store: The email address, an invitation token, the partner who created the invitation, send/delivery timestamps, and view/use metrics. Reviews submitted through invitations are linked to the invitation record for audit purposes.
• Verified Customer badge: Reviews left through a personal invitation are tagged "Verified Customer" — this only attests that the review came from a direct invitation by the location owner; it is not an independent verification of the underlying transaction.
• Your right to opt out: Click the "Unsubscribe" link in any review invitation email, or visit /unsubscribe with the signed link from your email. Unsubscribed addresses are added to a suppression list and will not receive further invitations.
• Anti-abuse measures: We apply rate limits to prevent partners from using the system for mass marketing. Partners must agree in our Terms of Service that invitations may only be sent to genuine customers in connection with services rendered.
• Guest accounts: If you submit a review through an invitation without an existing account, we create a minimal "guest" record so we can attribute the review. Guest accounts cannot be logged into and have no access to other features. You may convert a guest record into a full account during the review submission, or request deletion at any time.

11Your Rights

Depending on your location, you have the following rights regarding your personal data:

To exercise any of these rights, contact us at [email protected]. We will respond to your request within 30 days. We may ask you to verify your identity before processing your request.

We do not sell your personal data. PrepLists is a B2B platform and we do not engage in the sale of personal information to third parties.

12Communications

We send the following types of email communications:

Transactional Emails (always sent)

• Email verification upon registration
• Password reset requests
• Account security notifications

Platform Notifications (configurable)

• New messages from other users (throttled to max 1 email per 24 hours per conversation)
• Quote requests for your services
• Reviews and comments on your listings
• Location claim status updates
• Subscription and billing updates
• Team member invitations

You can manage your notification preferences in your account settings. Transactional emails related to security and account management cannot be disabled as they are essential for the operation of your account.

We also use real-time WebSocket notifications within the platform for instant updates on messages, quotes, and status changes. These do not involve email and only function while you are actively using the website.

13Children's Privacy

PrepLists is a business-to-business platform intended for use by individuals who are at least 18 years of age. We do not knowingly collect personal information from anyone under the age of 18.

If we become aware that we have collected personal data from a person under 18, we will take steps to delete that information promptly. If you believe that a child under 18 has provided us with personal data, please contact us at [email protected].

14Security

We implement appropriate technical and organizational measures to protect your data, including:

• Encryption in transit — all data transmitted between your browser and our servers is encrypted via TLS/HTTPS
• Password hashing — passwords are hashed using bcrypt and never stored in plain text
• JWT authentication — secure token-based session management with automatic expiration
• Access controls — verification documents are restricted to authorized administrators only
• Secure file storage — uploaded files are stored on encrypted cloud storage with access policies
• Error monitoring — Sentry helps us detect and resolve security-related issues in real-time

While we take all reasonable measures to protect your data, no method of electronic transmission or storage is 100% secure. If you discover a security vulnerability, please report it to [email protected].

15Changes to This Policy

We may update this Privacy Policy from time to time to reflect changes in our practices, technology, legal requirements, or business operations. When we make material changes, we will notify you by:

• Posting a prominent notice on our website
• Sending an email notification to your registered email address
• Updating the "Last updated" date at the top of this page

We encourage you to review this page periodically. Continued use of the platform after changes are posted constitutes acceptance of the updated policy.

16Contact Us

If you have any questions about this Privacy Policy, your data, or wish to exercise your rights, please contact us:

If you are located in the EU/EEA and are not satisfied with our response, you have the right to lodge a complaint with your local data protection supervisory authority.