Privacy Policy
Effective: 18 October 2026
Shortlist aio Ltd. ("Shortlist AIO", "we", "us") is a corporation incorporated in Manitoba, Canada. This policy explains what personal information we handle, why we handle it, and the choices you have. We are responsible for the personal information described in this policy (in the language of UK and EU law, we are its "controller"), except client data that we handle on a client's behalf, described in §1. We are subject to Canada's Personal Information Protection and Electronic Documents Act ("PIPEDA").
Privacy Officer: Shortlist aio Ltd., Attention: Privacy Officer, 40 Essex Drive, Steinbach, Manitoba R5G 2Y6, Canada · privacy@shortlistaio.com
1. Information We Handle
People who contact us or become clients. Name, business email address, telephone number, company, role, and the contents of our correspondence. Payments are processed by our payment provider; we do not receive or store full card numbers.
People we contact about our services. We contact marketing and business leaders at US business-software companies about our services. For each person we hold business contact information (name, job title, employer, work email address and, sometimes, a work telephone number or professional-profile link) and where we understand the person to work, together with where and when we obtained it, the emails we sent and when, any reply, and any opt-out. We find this information through our own research of company websites, press releases, public professional profiles and business directories, and from business-contact data providers that supply and verify work email addresses. We use only work contact details, never personal addresses, and we contact people only about matters relevant to their role. We do not buy or rent bulk email lists.
Website visitors. Our website itself sets no cookies, uses no analytics, advertising tags or tracking pixels, and has no forms. To deliver a page, our hosting provider, Cloudflare, necessarily receives your IP address, browser type and the address of the page you request, and uses that information to serve the site and protect it against attacks. Our pages also load their typeface from Google Fonts, so your browser sends your IP address, browser type and the address of the page to Google when a page loads; Google states that the Google Fonts service does not set cookies and does not use this information to build profiles of visitors or for advertising. We do not receive or keep logs of individual visits. If Cloudflare's security systems need to check that a visitor is not an automated bot, Cloudflare may set a short-lived, strictly necessary security cookie for that purpose only. The site's only script opens and closes the mobile menu and collects nothing. If you email us from a link on the site, we receive what you send, as described above.
Client business data. Material that a client gives us, or that we access in its systems, to perform our services may contain personal information. We handle it on the client's behalf and only on its instructions, under our contract with that client, which governs it in place of this policy. Please direct any request about that information to the client concerned.
Information we do not collect. We do not knowingly collect personal information from anyone under 18, sensitive categories of personal information, or consumer (non-business) contact information for marketing.
2. Why We Use It
| Purpose | Information used | Legal basis for UK and EU individuals |
|---|---|---|
| Responding to inquiries; providing and billing for our services | Client and inquirer information | Performing a contract with you, or our legitimate interest in performing our contract with your employer |
| Contacting business leaders about services relevant to their role | Business contact information | Our legitimate interest in offering relevant business services to the people whose role they concern |
| Keeping records of our outreach, opt-outs and the basis on which we contacted you | Outreach records; opt-out list | Our legitimate interest in complying with, and demonstrating compliance with, Canadian and US anti-spam laws, and in never contacting you after you opt out |
| Tax, accounting and corporate records | Client and billing records | Our legitimate interest in meeting our Canadian legal obligations |
| Keeping our systems and website secure | Technical data | Our legitimate interest in security |
In Canada, we use client and inquirer information with your consent, which is usually implied when you contact or engage us. PIPEDA does not apply to business contact information that we use solely to communicate with you about your employment, business or profession (PIPEDA s. 4.01). Our outreach email complies with the US CAN-SPAM Act and Canada's Anti-Spam Legislation, and we do not send unsolicited commercial email to people in Canada, the United Kingdom or the European Union.
We do not sell personal information, rent it, or share it for cross-context behavioral advertising, and we do not use it to build profiles of individuals.
3. Our Emails
Our emails do not contain open-tracking pixels or click-tracking links, and we do not record whether you opened a message or which links you followed. We judge whether our outreach works by whether people reply. We do keep a record of which messages we sent to which address and when, because anti-spam law requires us to be able to show why we contacted you, and so that we can honor an opt-out reliably.
4. Answer-Engine Measurement
Our core service queries third-party AI answer engines about companies and products. That process is directed at organizations, not individuals. Answers occasionally name individuals, such as a founder or an executive quoted in public coverage. We do not seek out that information, do not build profiles of individuals from it, and use it only in reporting to the client whose measurement it forms part of. Our published research, including the B2B AI Citation Index, reports on companies and products and does not identify individuals.
5. Who We Share It With
Service providers. We share personal information with service providers, under contract and only as needed to operate our business: website hosting and content delivery (Cloudflare), web fonts (Google Fonts), email and productivity services, email sequencing, business-contact data providers, payment processing, banking, accounting, and our professional advisers. We will provide a list of our current service providers on request.
AI services. We use AI services from providers such as Anthropic, OpenAI, Google and Perplexity in our work. We submit client confidential information or personal information to an AI service only where the provider's terms, or our account settings with it, prohibit it from using that content to train its models.
Other disclosures. We may disclose personal information where required by law, or to a successor in a merger or a sale of all or substantially all of our business, which will be bound by this policy.
6. International Transfers
We are based in Canada. Our service providers process information in Canada, the United States and other countries where they operate. Information held in another country may be accessible to that country's courts, law-enforcement and national-security authorities under its laws. We remain responsible for personal information that our providers handle for us, and we use contracts, including the providers' data-processing terms, to require them to protect it to a comparable standard.
If you are in the UK or the EU: the European Commission and the United Kingdom have each recognized Canada as providing adequate protection for personal information handled by commercial organizations subject to PIPEDA, which includes us, so no additional transfer mechanism is needed for information sent to us. Our onward transfers to service providers are governed by the contractual protections described above.
7. How Long We Keep It
| Information | How long |
|---|---|
| Outreach records (business contact information, emails sent, the source of your address and the basis for contacting you) | Three years after our last email to you, or longer while a complaint, inquiry or claim about our emails is open, so that we can show why we were entitled to contact you |
| Opt-out list | For as long as we send outreach email, limited to your email address and the date you opted out, so that we never contact you again |
| Inquiries that do not lead to an engagement | Two years after our last exchange |
| Client records, contracts and invoices | Six years after the end of the financial year in which the engagement ends, as Canadian tax law requires, or longer while an audit, dispute or claim is open |
| Website request data | We keep no logs of our own. Cloudflare and Google keep request data for the periods set out in their own policies. |
When we no longer need information, we delete it or make it anonymous.
8. Your Choices and Rights
Stopping our emails. Reply "no thanks" or "unsubscribe" to any of our emails, or write to privacy@shortlistaio.com. We stop within 10 business days, and normally the same day, and the opt-out applies to every address we send from.
Your rights. Depending on where you live, you may have the right to ask for access to the personal information we hold about you, to correct it, to delete it, to receive a copy in a portable format, to object to or restrict our use of it, or to withdraw consent you have given. Anyone may ask us to stop contacting them.
To make a request, write to privacy@shortlistaio.com or to our Privacy Officer at the address above. We may ask you to confirm your identity first. We respond within 30 days; if we need longer, as the law allows, we will tell you why within those 30 days. We do not charge for requests unless they are clearly unfounded or excessive, and we do not treat anyone differently for exercising these rights.
If you ask us to delete your information, we keep only what we need to honor your opt-out and to meet our legal record-keeping obligations.
Complaints. Please contact us first, and we will try to put things right. You may also complain to the Office of the Privacy Commissioner of Canada (priv.gc.ca), to the UK Information Commissioner's Office (ico.org.uk), or to the data protection authority where you live or work in the EU.
9. Security
We protect personal information with least-privilege access, encryption in transit, multi-factor authentication on business-critical accounts, and client credentials that are provisioned individually and revoked when an engagement ends. No system is perfectly secure, and we do not claim otherwise. If a breach of our security safeguards creates a real risk of significant harm, we will report it to the Office of the Privacy Commissioner of Canada and notify the affected individuals as PIPEDA requires, and we will meet any other legal notification duty that applies.
10. Other Information
Do Not Track. Our website does not track visitors across other websites, so we do not respond differently to Do Not Track signals. Apart from the hosting and font requests described in §1, we do not allow third parties to collect information about your activity on our site.
Automated decisions. We do not make decisions about individuals by automated means that have legal or similarly significant effects.
California. We are not currently a "business" as defined in the California Consumer Privacy Act. Where we handle personal information as a client's service provider, our contract with that client governs it. In any event, we do not sell or share personal information as that Act defines those terms.
11. Changes
We will post any change to this policy on this page with a new effective date. If we make a material change, we will notify our clients directly and, where the law requires, the individuals affected.