Lemlist procurement policy evidence
Only topics backed by verified findings appear below. Each row preserves the platform's exact policy words and capture provenance.
| Topic | Plan or tier | Risk | Their words | Source |
|---|---|---|---|---|
| DPA, audit rights & data residency | All applicable tiers | low | “ The host serverson which lemlist processes and stores its databases are located exclusivelywithin the European Union. Regarding thetools we use (see article “Third party disclosures” on recipients of thecollected data, concerning our processors), your personal data could betransferred outside the European Union. The transfer of your data within thisframework is secured by the following safeguards: These data are transferred to a country which has been deemed to offer an adequate level of protection by the European Commission.” | Captured 2026-06-08Open source →Finding permalink → |
| DPA, audit rights & data residency | All applicable tiers | low | “ You acknowledge that lemlist processes personal data on your behalf as a processor within the meaning of the GDPR. These terms and conditions incorporate the Data Processing Agreement (DPA). By signing these terms and conditions, the Customer accepts the DPA. You can always ask us to sign a version by contacting our DPO at the following address: privacy@lemlist.com.” | Captured 2026-06-08Open source →Finding permalink → |
| DPA, audit rights & data residency | All applicable tiers | low | “ Or we have concluded with our processors a specific contract governing the transfer of your data outside the European Union, based on the standard contractual clauses approved by the European Commission between a data controller and a processor.” | Captured 2026-06-08Open source →Finding permalink → |
| DPA, audit rights & data residency | All applicable tiers | low | “ making all the declarations necessary to the relative data protection authority,” | Captured 2026-06-08Open source →Finding permalink → |
| Data retention | All applicable tiers | unknown | “ _ga | Used by Google Analytics to register a unique ID that is used to generate statistical data on how the visitor uses the website | 2 years” | Captured 2026-07-03Open source →Finding permalink → |
| Data retention | All applicable tiers | low | “ Your personal data is kept for the periods set out below : Personal data collected for the execution of the services as well as information about how and when you use the services: The time needed to provide to you our services, and in no event no longer than 3 years after closing your account (unless otherwise required by law).” | Captured 2026-06-08Open source →Finding permalink → |
| Data retention | All applicable tiers | unknown | “ ajs_user_id | Used by Segment to identity user | 1 year” | Captured 2026-07-03Open source →Finding permalink → |
| Data retention | All applicable tiers | low | “ Personal data collected in order to send newsletters, requests and direct marketing: 3 years from data collection or last active contact with the prospect.” | Captured 2026-06-08Open source →Finding permalink → |
| Data retention | All applicable tiers | unknown | “ ajs_group_id | Used by Segment to group visits | 1 year” | Captured 2026-07-03Open source →Finding permalink → |
| Data retention | All applicable tiers | unknown | “ amplitude_id | Used by Amplitude for session tracking | Session” | Captured 2026-07-03Open source →Finding permalink → |
| Data retention | All applicable tiers | unknown | “ _hjid | Used by Hotjar to store a unique user ID | 1 year” | Captured 2026-07-03Open source →Finding permalink → |
| Data retention | All applicable tiers | unknown | “ poptin_old_user | Used by Poptin to identify old user | Session” | Captured 2026-07-03Open source →Finding permalink → |
| Data retention | All applicable tiers | unknown | “ hubspotutk | Used by Hubspot to store and track a visitor’s identity | 13 months” | Captured 2026-07-03Open source →Finding permalink → |
| Data retention | All applicable tiers | unknown | “ _gid | Used by Google Analytics to count pageviews | 1 day” | Captured 2026-07-03Open source →Finding permalink → |
| Data retention | All applicable tiers | unknown | “ poptin_referrer | Used by Poptin as original referrer | 2 minutes” | Captured 2026-07-03Open source →Finding permalink → |
| Data retention | All applicable tiers | low | “13.6 Validity Purchased sessions/packages must be used within the validity window stated in the quote (90 days)” | Captured 2026-06-08Open source →Finding permalink → |
| Data retention | All applicable tiers | unknown | “ poptin_session | Used by Poptin to identify user sessions for Poptin display settings | 30 minutes” | Captured 2026-07-03Open source →Finding permalink → |
| Data retention | All applicable tiers | unknown | “ __stid | Used by ShareThis to store and track audience reach | 1 week” | Captured 2026-07-03Open source →Finding permalink → |
| Data retention | All applicable tiers | unknown | “ cookieconsent_status | To store cookie consent preferences | Session” | Captured 2026-07-03Open source →Finding permalink → |
| Data retention | All applicable tiers | unknown | “ intercom-id-* | Used by Intercom (Support) to identify users | 9 months” | Captured 2026-07-03Open source →Finding permalink → |
| Data retention | All applicable tiers | unknown | “ gac * | Used by Google Analytics and Google Ads to store and count pageviews | 90 days” | Captured 2026-07-03Open source →Finding permalink → |
| Data retention | All applicable tiers | unknown | “ cfmrk_cic | Used by Cloudfare to route user traffic for this site | 3 months” | Captured 2026-07-03Open source →Finding permalink → |
| Data retention | All applicable tiers | low | “ If you exercise your right to object to direct marketing: we keep this information for 3 years. The information allowing the management of your requests to exercise your rights under the GDPR will be kept for 3 years from the date of the request.” | Captured 2026-06-08Open source →Finding permalink → |
| Data retention | All applicable tiers | low | “ Personal data collected for evidentiary purposes: Duration of the statutory limitation period (generally 5 years).” | Captured 2026-06-08Open source →Finding permalink → |
| Data retention | All applicable tiers | unknown | “ __hstc | Used by Hubspot to store time of visit | 13 months” | Captured 2026-07-03Open source →Finding permalink → |
| Data retention | All applicable tiers | unknown | “ intercom-sessions-* | Used by Intercom (Support), to identify user sessions | 1 week” | Captured 2026-07-03Open source →Finding permalink → |
| Data retention | All applicable tiers | unknown | “ poptin_user_ip | Used by Poptin to save user IP address | 1 year” | Captured 2026-07-03Open source →Finding permalink → |
| Data retention | All applicable tiers | unknown | “ _hjTLDTest | Used by Hotjar to determine generic cookie path | Session” | Captured 2026-07-03Open source →Finding permalink → |
| Data retention | All applicable tiers | unknown | “ __stidv | Used by ShareThis to determine the pages visited, amount of time spent, etc | 6 months” | Captured 2026-07-03Open source →Finding permalink → |
| Data retention | All applicable tiers | unknown | “ _hjAbsoluteSessionInProgress | Used by Hotjar to store unique visits | Session” | Captured 2026-07-03Open source →Finding permalink → |
| Data retention | All applicable tiers | unknown | “ ajs_anonymous_id | Used by Segment to store last visit | 1 year” | Captured 2026-07-03Open source →Finding permalink → |
| Data retention | All applicable tiers | unknown | “ poptin_c_visitor | Used by Poptin to anonymously track visitors to display popups with better accuracy | 1 year” | Captured 2026-07-03Open source →Finding permalink → |
| Data retention | All applicable tiers | unknown | “ refiner_cookie_uuid | Used by Refiner to understand who our customers and visitors are | 1 year” | Captured 2026-07-03Open source →Finding permalink → |
| Data retention | All applicable tiers | low | “ Personal data collected as part of your data subject’s rights: If we ask you for proof of identity, we only retain it for the time necessary to verify your identity. Once the verification has been carried out, the proof is deleted.” | Captured 2026-06-08Open source →Finding permalink → |
| Data retention | All applicable tiers | low | “ 6.3 Consequences of the termination Upon expiration or termination of your account for any reason whatsoever, all amounts still owed by You, shall become due and payable immediately. We will not refund any prepaid fees. You are advised that as of the effective termination date of your account, You will cease to have access to your account and to the Data stored therein. We shall use commercially reasonable efforts to (A) securely destroy all documents and tangible materials (and any copies) containing, reflecting, incorporating or based on the other Party's Confidential Information within thirty (30) days post termination, (B) permanently erase all of the other Party's Confidential Information from its computer systems (unless such backup copies cannot be reasonably deleted or otherwise must be maintained pursuant to such party’s reasonable document retention policy in which case those undeleted backups shall be subject to the confidentiality provision of this Agreement until they are deleted) and (C) upon request, verify in writing to You that it has complied with the requirements of this clause 6.3, ” | Captured 2026-06-08Open source →Finding permalink → |
| Data retention | All applicable tiers | unknown | “ poptin_user_id | Used by Poptin to provide a unique visitor ID | 1 year” | Captured 2026-07-03Open source →Finding permalink → |
| Data retention | All applicable tiers | low | “ A shared dashboard with your coach, including documents you'll be able to keep” | Captured 2026-06-08Open source →Finding permalink → |
| Data retention | All applicable tiers | unknown | “ poptin_user_country_code | Used by Poptin to save user country code | 1 year” | Captured 2026-07-03Open source →Finding permalink → |
| Data retention | All applicable tiers | unknown | “ cfmrk_cic | Used by Cloudflare to route user traffic for this Site. | 90 days” | Captured 2026-07-03Open source →Finding permalink → |
| Data retention | All applicable tiers | unknown | “ poptin_session_account_* | Used by Poptin to identity user sessions | Session” | Captured 2026-07-03Open source →Finding permalink → |
| Data retention | All applicable tiers | unknown | “ poptin_c_visitor | Used by Poptin to anonymously track visitors to display popups with better accuracy | 1 day” | Captured 2026-07-03Open source →Finding permalink → |
| Subprocessors & data sharing | All applicable tiers | unknown | “ gclid | Used by GooUsed by Google Adsense to uniquely track individual AdWords clicksgle Adsense to store and track conversions | Session” | Captured 2026-07-03Open source →Finding permalink → |
| Subprocessors & data sharing | All applicable tiers | medium | “ or the third party is asubcontractor or sub-processor of lemlist in the carrying out of services(lemlist uses the services of an Internet provider, a telecommunicationscompany, a host provider, CRM tools, customer support client tools, invoicestools, payment tools, analytics tools).” | Captured 2026-06-08Open source →Finding permalink → |
| Subprocessors & data sharing | All applicable tiers | medium | “ Personal data relating to you collected on ourwebsite are destined for lemlist’s own use and may be forwarded to lemlist’spartner companies so that we may obtain assistance and support in the contextof carrying out our services. lemlist ensures that it has in place clear dataprotection requirements for all its third-party providers. We do not sell or rent your personal data tothird parties for marketing purposes whatsoever. In addition, lemlist does not disclose yourpersonal data to third parties, except if: you (or your accountadministrator acting on your behalf) requests or authorized disclosure thereof.” | Captured 2026-06-08Open source →Finding permalink → |
| Subprocessors & data sharing | All applicable tiers | low | “This data is stored on secure servers and only alimited number of people are authorized to access your contact lists, inparticular for the purpose of providing support services. You are easily able to recover your contactlists from your lemlist account at any time, by clicking on the “export”button. You may also modify and or delete contacts at any time from youraccount. In no case does lemlist sell, share or rent outyour contact lists to third parties, nor does it use them for any purposesother than those set forth in this policy. We will use the information fromyour contact lists only for legal requirements, to invoice and collectsummaries for our own statistics and for the purposes of providing you withcustomer support services. As creator of the contact lists and associatedemail campaigns, you are considered the data controller within the meaning ofthe GDPR, and lemlist is acting only as a data processor. In thiscapacity, you are responsible in particular for: complying with all current regulations in force, including the data protection laws,” | Captured 2026-06-08Open source →Finding permalink → |
| Subprocessors & data sharing | All applicable tiers | medium | “ intercom-sessions-* | Used by Intercom (Support), to identify user sessions | 1 week” | Captured 2026-06-08Open source →Finding permalink → |
| Subprocessors & data sharing | All applicable tiers | medium | “ lemlist is compelled to do soby a government authority or a regulatory body, in the case of a court order, asummons to appear in court or any other similar requisition from a governmentor the judiciary, or to establish or defend a legal application ;” | Captured 2026-06-08Open source →Finding permalink → |
| Subprocessors & data sharing | All applicable tiers | low | “ Hosting provider: The website https://blog.lemlist.com/ is hosted by : The company Webflow, Inc. Head office : 398 11th St., Floor 2, San Francisco, CA 94103. E-mail address: contact@webflow.com” | Captured 2026-06-08Open source →Finding permalink → |
| Subprocessors & data sharing | All applicable tiers | unknown | “ Advertising Cookies may be created not only by our sites but also by other websites and applications that serve ads, announcements, widgets or other elements displayed on the page. These Cookies can be used, among other things, to personalize and measure the effectiveness of advertising or to carry out targeted advertising. We use the following Advertising Cookies:” | Captured 2026-07-03Open source →Finding permalink → |
| Subprocessors & data sharing | All applicable tiers | unknown | “ gcl au | Used by Google Adsense to store and track conversions | 3 months” | Captured 2026-07-03Open source →Finding permalink → |
| Subprocessors & data sharing | All applicable tiers | medium | “ the disclosure is required toprocess transactions or supply services which you have requested (i.e. to checkyou are employing best practices in your mailings or for the purposes ofprocessing an acquisition card with credit-card issuing companies) ;” | Captured 2026-06-08Open source →Finding permalink → |
| Subprocessors & data sharing | All applicable tiers | unknown | “ _fbp | Used by Facebook to deliver a series of advertisement products | 3 months” | Captured 2026-07-03Open source →Finding permalink → |
| Tier differences | All applicable tiers | low | “ 13.1 Lemcoach conditions The following terms (the "Lemcoach conditions") apply only where the Client has subscribed to the Lemcoach offer, as specified in the quotation. If the Client has not subscribed to the Lemcoach offer, the Lemcoach conditions shall not apply.” | Captured 2026-06-08Open source →Finding permalink → |
| Tier differences | All applicable tiers | low | “ Teams on the “Multichannel Expert” plan can connect up to 5 email address to each lemlist seat.” | Captured 2026-06-08Open source →Finding permalink → |
| Tier differences | All applicable tiers | low | “ 10 000 free credits for you to use during the coaching period” | Captured 2026-06-08Open source →Finding permalink → |
| Tier differences | All applicable tiers | medium | “ Article 5. Plans – Financial Terms We offer various options to our Clients, including free and paid plans, with or without a fixed commitment period. You can find these options and the relevant pricing on our website at: https://www.lemlist.com . The applicable pricing will be shown in the currency that corresponds to the country of your billing address. 5.1 Free plans Free plans are non-paid subscriptions subject to use restrictions (maximum limits to the number of daily and monthly emails and support ticket requests, restriction on API calls, etc.); these use restrictions are set forth on our Website. You may at any time terminate your free plan or upgrade to a paid plan. 5.2 Paid plans ("Email", "Multichannel Expert" & "Enterprise") Paid plans have a fixed-term commitment (generally set to 12 months), even lower use restriction limits than our other paid plans and offer more custom solutions. Premium features can also be added as well as Assistance Services. When you subscribe to a paid plan, the financial conditions that are applicable to you (fees, schedule and payment terms) are set forth on the Specific Terms signed by you. Fees for the Service consist of a fixed fee (« Minimum Annual Fee ») and a variable fee («Variable Fee »), if any, depending on the volume of emails processed on behalf of Client. Unless otherwise stated, the Minimum Annual Fee is non-cancelable and non-refundable for any reason whatsoever. ” | Captured 2026-06-08Open source →Finding permalink → |
| Tier differences | All applicable tiers | low | “ Teams on the “Email” plan can connect up to 3 email addresses to each lemlist seat.” | Captured 2026-06-08Open source →Finding permalink → |
| Tier differences | All applicable tiers | low | “ The number of email addresses that may be connected under “Enterprise” plan shall vary in accordance with the specific requirements of the Client and shall be set forth in the applicable contract.” | Captured 2026-06-08Open source →Finding permalink → |
Informational only, not legal advice. Terms can change; verify every cited source and capture date during procurement review.
📢 POLICY UPDATES ALERT
AIRIN Brief
Built for compliance officers, legal counsel, and SaaS founders. Subscribe to the email digest — one short brief when a tracked vendor materially changes its terms, training policy, or risk rating. Prefer in-app? Watch platforms in your alerts inbox instead.