This policy explains what information Media List collects, how we use it and the choices you have.
1. Information you give us
- Account: your name, email address, company and password (stored hashed).
- Billing: handled by Stripe and PayPal. We receive your plan and billing status, never your full card number.
- Mailboxes: if you connect a mailbox to send campaigns, we store its server settings and passwords encrypted. We use them to send the campaigns you create and, with your agreement, to read that mailbox's inbox over IMAP for replies and delivery failure notices to those campaigns, so we can show you who answered and stop follow-ups. We never change or delete anything in your mailbox, and we do not keep other mail.
- Your work: searches, saved lists, exports, campaigns and messages you send us.
2. Information we collect automatically
We use our own cookies and server logs, including IP addresses and browser details, to keep you signed in, protect accounts and understand how visitors find and use the site. We may link this to your account or email address when you sign up or click a link in one of our emails. Campaign emails you send may include open and click tracking, which you can turn off per campaign.
3. How we use it
To run the service, process payments, send account and billing emails (including a reminder before a free trial ends), answer support requests, prevent abuse and improve the product. We do not sell your personal information.
4. Who we share it with
Service providers that help us run Media List, such as payment processors, hosting, email delivery, support chat and an AI provider (OpenAI) that turns search requests you type into filters, only as needed to provide their service. If you connect Asana, Notion, Pipedrive, Webflow or Zoho CRM, we share the contacts in a list with that service when you start a send, as described in section 5. We may also disclose information if the law requires it.
5. Integrations you connect
You can connect Media List to Asana, Notion, Pipedrive, Webflow and Zoho CRM so a saved list can be sent to the tool you already use. Connecting is your choice, and you can disconnect at any time from that integration's page in Media List. This section explains what happens to your information.
- What we receive and store. When you connect, the other service gives us an access token (and a refresh token where it provides one) so Media List can act for you there. We also store what we need to run your sends: your name or account name, and the name and ID of the workspace, team, site, company or organization you choose. For Webflow, that is the site you share, and we ask only for the scopes cms:read, cms:write and sites:read. We never receive your password for any of these services. Webflow access tokens do not expire, and if you remove Media List from inside Webflow we are not told, so the stored token stays until you disconnect in Media List.
- What we send. Only when you start a send, we copy the contacts in the list you picked: name, job title, outlet, outlet website, location, contact type, topics, a Media List ID for each contact, and the contact's email address only if you have already unlocked it in Media List. We also send the name of your list. Asana receives a project and one task per contact. Notion receives a database with one row per contact. Pipedrive receives a person per contact, an organization per outlet and a note. Webflow receives a new CMS collection with one item per contact. Zoho CRM receives an account per outlet and a contact per person.
- What we read and change. To run a send we read the workspaces, teams, sites or companies you can choose from. Asana, Pipedrive and Zoho CRM are also searched so we do not add a contact that is already there, and Asana and Notion are searched to find items Media List created earlier. If you send the same list again, Asana, Pipedrive and Zoho CRM skip contacts already there (Asana fills in an email you have unlocked since), while Notion and Webflow create a new database or collection each time. In Notion we add a page named Media List exports inside the page you shared. We do not otherwise change your other content, and we do not sell this information.
- What we keep. The tokens until you disconnect. The connection record, which holds the account name and the workspace, site or company names and IDs. A history of your sends with the list name, destination name and ID, how many contacts were sent, skipped and failed, a link to the result, any error message, the time and the status. We keep the connection record and the history while your account is open and for as long as needed for billing and legal records afterwards, as described in Security and retention below. Contacts we have sent stay in your account at the other service, where that service's own terms and privacy policy apply. We do not delete them when you disconnect.
- When you disconnect. We delete the tokens we stored, mark the connection as revoked, cancel any sends still waiting, and ask the other service to revoke the connection. That last step is a best effort, and if the other service cannot be reached the tokens are already gone from our side and we cannot use them. The connection record stays with the date it was revoked. For Asana we also keep the link between a list and its project, and for Zoho CRM a short-lived record that helps avoid duplicates is deleted after two days. You can also remove Media List from inside the other service at any time.
6. People in the database
The media contacts in Media List are professional details (name, job title, outlet, work email and public profiles) collected from publicly available sources, used so that relevant stories reach the people who cover them. If you are listed and want your details removed or corrected, email support@medialist.com and we will act on it.
7. Security and retention
We use encryption in transit, encrypted storage for mailbox passwords and limited staff access. We keep account data while your account is open and for as long as needed for billing and legal records afterwards. We keep the text of AI search requests, and the filters made from them, for 90 days. Your AI search chats, with the email addresses, phone numbers and links we detect removed, are saved to your account while it is open so you can come back to them, and our support team may view them to help you. When you delete a chat it is removed from your view, and we keep a copy in our records.
When you ask our research team to find contacts you could not find, we keep that search, its filters and any message you add with your account, so we can work on the request and reply to you.
8. Your choices
You can view and update your details on your Account page, unsubscribe from marketing emails with the link in each one, and ask us to access, export or delete your personal information at support@medialist.com.
9. Contact
Questions about this policy: support@medialist.com.