PushList Privacy Policy

Version 1.0 — Effective as of April 2026

1. General Provisions

1.1. This document (hereinafter referred to as the "Policy") outlines how the PushList platform (https://pushlist.net) (hereinafter referred to as the "Platform", "We", "Us") collects, uses, stores, and protects personal data.

1.2. PushList is a service managed by an individual (the platform owner) and is not registered as a legal entity. We operate in good faith and in compliance with the applicable laws of our country of residence.

1.3. By using the Platform (registration, balance top-up, launching campaigns, placing code on websites), you acknowledge that you have read this Policy and agree to its terms. If you do not agree, please cease all use of the Platform.

2. Data Subject Categories

Within the scope of the Platform's operation, we identify three categories of subjects whose data may be processed:

• Advertiser: an individual or entity placing advertising campaigns via PushList;
• Webmaster (Publisher): an individual or entity placing PushList code on their websites to build a subscriber audience;
• End User: a visitor to the Webmaster's website who has subscribed to push notifications and/or interacts with advertising materials.

3. Data We Collect

3.1. Advertiser and Webmaster Data:

• Email address, login, password (encrypted);
• Payment details (wallet numbers, cryptocurrency addresses) — solely for deposits and withdrawals;
• IP address, browser type, operating system, language, time zone — for security purposes and fraud prevention;
• Transaction history (deposits, debits, withdrawals);
• Advertising campaign data (creatives, bids, targeting settings);
• Security Inspection Data & Input Payloads: real-time character sequences, request parameters, submitted payloads, and text entered into any interactive form fields or textareas on the Platform by any User, regardless of role or account status. This data is processed dynamically for automated security inspection and Threat Detection (IDS) to protect the Platform against code injection and cyberattacks. Clean payloads are processed in-memory and not persistently stored; payloads matching security attack signatures are logged alongside IP address, account ID, browser metadata, and timestamps for security audit and account restriction purposes.

3.2. End User Data (Push Notification Subscribers):

• Subscription data (endpoint, public key, authentication token) — required to deliver notifications;
• Technical information: IP address, country, browser language, device type, screen resolution, OS version;
• Notification interaction data (impressions, clicks, closes) — for statistical purposes;
• Data collected via Session Replay (Webvisor) and Heatmaps (as described in Section 6).

4. Purposes of Data Processing

• Provision of Platform functionality (notification delivery, statistics, reporting);
• Fulfillment of contractual obligations to Advertisers and Webmasters;
• Prevention of fraud, scams, and unfair use of the service;
• Service improvement and technical support;
• Compliance with legal requirements (upon request by authorized authorities).

5. Legal Basis for Processing

5.1. We process personal data based on the following grounds:

• Performance of a Contract: fulfillment of the terms of service with the Advertiser or Webmaster;
• Legitimate Interest: fraud prevention, security maintenance, and service performance analysis;
• User Consent: in cases where required, such as data collection via Session Replay tools.

5.2. If you are located within the European Economic Area (EEA), you have rights provided under the GDPR. You may request access to your data, its rectification or erasure, restriction of processing, or object to processing. To do so, contact us at the email provided in Section 11.

5.3. Limitation of Role: We provide the technical infrastructure but do not act as the primary data controller for data collected by Advertisers or Webmasters. Responsibility for the legality of such processing lies with the party that activated the respective tools.

5.4. Transparency: We always warn users about the risks of collecting sensitive data and require explicit consent from end users when Session Replay and Heatmaps are utilized.

5.5. Flexibility: We reserve the right to update this Policy to comply with new legal requirements and data protection best practices.

6. Session Replay and Heatmaps — Special Conditions

6.1. The PushList Platform provides Advertisers and Webmasters with the ability to activate Session Replay (recording of user sessions) and Heatmaps (collection of data on clicks, scrolls, and mouse movements). These tools operate on the Webmaster's website or the Advertiser's landing page.

6.2. Important Warning (displayed in red within the interface during campaign setup):

Session Replay and Heatmaps record all user actions on the page, including text entered into any form fields (name, phone, email, address, card details, etc.), even if the form was not submitted. This may be considered the collection of sensitive personal data. You are strictly required to obtain explicit user consent for such recording, post a notice on your website, and comply with data protection laws (GDPR, CCPA, etc.). In certain jurisdictions, the use of Session Replay may be restricted or prohibited. Sole responsibility for the legality of data collection via Session Replay and Heatmaps rests with the Advertiser or Webmaster who activated these tools.

6.3. We strongly recommend consulting with a legal professional before using Session Replay and Heatmaps, especially if your audience is located in the EU or California.

6.4. Retention Periods: Session Replay recordings are stored for no longer than 3 (three) hours from the moment of creation; Heatmap data is stored for no longer than 6 (six) hours. After this period, data is automatically deleted without the possibility of recovery. You may export data within this timeframe via the Platform interface.

6.5. PushList does not process data collected via Session Replay and Heatmaps for its own purposes. We only provide the technical capacity for recording and short-term storage. We are not the controller of this data and bear no responsibility for its use by the Advertiser or Webmaster.

7. Data Disclosure to Third Parties

7.1. We do not sell or transfer personal data to third parties for commercial purposes.

7.2. We may disclose data to:

• Payment systems and cryptocurrency gateways — to process transactions (minimum necessary data only);
• Analytics services (e.g., Google Analytics) — in an anonymized form to collect Platform usage statistics;
• Law enforcement agencies — upon a valid legal request in accordance with established procedures.

7.3. We do not control and are not responsible for the actions of third parties who may gain access to data through integrations activated by Platform users. Integrations are enabled by the user, and the responsibility for their legality rests with them.

8. Data Retention Periods

8.1. Account data (email, login, password hash, payment details) are stored for as long as the account is active and for 6 months after closure (to resolve potential disputes).

8.2. Subscriber data (endpoints, keys) are stored until the subscriber unsubscribes or is blocked, but for no more than 6 months after the last activity.

8.3. Session Replay and Heatmap data are stored for no more than 3 hours and 6 hours respectively, after which they are automatically deleted.

8.4. Click and impression logs are stored for up to 90 days for reporting purposes, after which they are anonymized or deleted.

9. Cookies and Similar Technologies

9.1. The Platform uses cookies for user authentication, remembering settings, and collecting usage statistics. You may disable cookies in your browser settings, though this may affect the functionality of certain features.

9.2. Third parties (payment gateways, analytics services) may also set their own cookies — we do not control these.

10. Security Measures

10.1. We implement technical and organizational measures to protect personal data: password encryption, secure servers, restricted data access, and regular software updates.

10.2. However, no data transmission over the internet can be guaranteed 100% secure. You use the Platform at your own risk, though we take all reasonable steps to ensure data integrity.

10.3. Automated Intrusion Detection (IDS) & Security Logging: to preserve system integrity and prevent unauthorized access, PushList employs automated Server-Side Intrusion Detection Systems (IDS) applicable to all platform operations and user roles.

• Automated Analysis: data submitted through any input field, query parameter, or API endpoint by any User is automatically analyzed against dynamic security threat patterns (including, but not limited to, XSS, SQL injection, remote code execution, and path traversal signatures);
• Incidents and Logging: if a security threat or attack payload is detected, the event is automatically flagged as a critical security violation. The system immediately records detailed log entries (including field name, submitted payload, URL, IP address, user agent, user ID, and account status) to document the violation, enforce immediate automated account termination, and prevent further security risks.

11. User Rights

11.1. You have the right to:

• Obtain information about what data we store regarding you;
• Rectify inaccurate data;
• Delete your data (excluding data we are legally required to retain or need for dispute resolution);
• Withdraw consent for processing (where processing is based on consent);
• Lodge a complaint with a supervisory authority in your country.

11.2. To exercise these rights, please contact us at the email provided in Section 12. We will respond within 30 days. In exceptional cases, this period may be extended by an additional 30 days, of which you will be notified.

12. Contact Information

For all inquiries related to the processing of personal data, you may contact us via email at: info@pushlist.net.

13. Policy Changes

13.1. We may update this Policy. The new version becomes effective upon its publication on the website https://pushlist.net. Continued use of the Platform after changes are made constitutes your acceptance of the new version.