LevyAI Trust, Privacy & Security Policy

Scope & Roles

• This policy applies to LevyAI’s website, apps, APIs, and managed deployments ("Services").
• For end-user or business data you send to LevyAI, you are the Data Controller and LevyAI is the Data Processor under GDPR. For our own website analytics, billing records, and account data, LevyAI is the Data Controller.

Data We Process

How We Use Data

• Provide the Services: execute prompts, generate responses, store and retrieve content, maintain session state.
• Secure and improve reliability: detect abuse, debug issues, maintain audit trails, and improve system performance.
• Customer support and billing: resolve tickets, manage subscriptions, send essential service communications.
• Optional model quality improvements (opt-in only): anonymized samples may be used to improve product features. You can opt out at any time.

Data Ownership & Segregation

• You own your Customer Content. LevyAI obtains a limited license to process it solely to provide and secure the Services.
• Customer Content is logically isolated per tenant; enterprise plans support dedicated environments and private networking.

AI & Model Policy

• No training on your private data by default. Foundation models used by LevyAI are not trained on your Customer Content unless you opt in.
• Third-party models: when you enable third-party LLMs, we route requests under strict data processing terms; we configure vendors to not train on your data whenever such controls are available.
• Safety: content filters, rate limiting, and abuse detection; continuous hardening against prompt-injection, data exfiltration, and jailbreak attempts.

Security Controls (Overview)

Compliance & attestations: If you require formal evidence (e.g., SOC 2 Type II, ISO/IEC 27001), please contact our security team for our latest status, reports (under NDA), and control mapping. We align our controls to these frameworks and provide customer security questionnaires on request.

Data Retention & Deletion

• Default retention (configurable):

• Customer Content: retained for your workspace lifecycle or as you configure.
• System logs: typically 30–90 days (shorter/longer by plan and region).

• Deletion: You may delete content via the product or request deletion; backups roll off on a scheduled cycle. We also honor right-to-erasure requests.
• Export: You may export your data in a machine-readable format upon request or via product features.

Data Residency & Transfers

• Regional hosting options (e.g., US, EU) available on qualifying plans.
• When data is transferred internationally, we use appropriate safeguards (e.g., Standard Contractual Clauses for EEA/UK).

Subprocessors

We use vetted providers to deliver the Services (cloud infrastructure, telemetry, email, authentication, payments). We contractually require privacy and security commitments and least-privilege access. For the current list, please contact our team or see levyai.com/subprocessors (if available). You will be notified of material changes as required by your DPA.

Government & Legal Requests

We only disclose data when required by law and after reviewing the validity and scope of the request. We will notify you before disclosure unless legally prohibited and will seek to narrow the request to the minimal required data.

Incident Response & Notifications

We maintain a formal incident response plan with 24/7 on-call. Following confirmation of a security incident impacting your data, we will notify your designated contacts without undue delay and share remediation details and corrective actions. For GDPR-reportable breaches, we follow the applicable notification timelines.

Your Responsibilities

• Maintain the security of your endpoints, identity provider, and admin accounts (e.g., SSO/MFA).
• Configure retention and data-sharing settings to match your policies.
• Ensure you have a lawful basis to process personal data you send to LevyAI and provide required notices to your end users.

End Users; Children’s Data

LevyAI is not directed to children under 16, and we do not knowingly collect children's personal data. If you believe a child has provided personal data, please contact our privacy team for prompt deletion.

Your Privacy Rights

Depending on your location, you may have rights to access, correct, delete, restrict, or port your personal data, and to object to certain processing. To exercise these rights, please contact our privacy team. California residents also have rights under the CCPA/CPRA; LevyAI does not "sell" personal information.

Cookies & Analytics

We use strictly necessary cookies for session management and security. With your consent (where required), we may use analytics to improve product performance. You can manage preferences via your browser or our in-product controls.

Enterprise Features (Available on request/plan)

• Private networking: VPC peering/PrivateLink, egress allow-listing.
• Data controls: Workspace-level retention policies, DLP patterns, PII redaction, domain restrictions.
• Auditability: Immutable audit logs, SIEM exports, Admin Activity Reports.
• Key management: BYOK (customer KMS) and dedicated tenant encryption contexts.
• Model routing: Regional model endpoints and “no-train” enforcement for third-party LLMs.

HIPAA/PHI & Regulated Data

By default, LevyAI is not intended to process PHI or other highly regulated categories unless explicitly contracted. If you need to handle PHI, PCI, or similar regulated data, please contact our security team to discuss a restricted deployment, additional agreements (e.g., BAA), and controls.

Changes to This Policy

We may update this policy to reflect changes to our Services or legal requirements. We’ll post the new version with a revised “Last updated” date and, for material changes, provide advance notice through the Service or email.

Contact

For any security, privacy, or support inquiries, please contact us through our website or support portal.

Attachments & Linked Terms (on request)

• Data Processing Addendum (DPA)
• Information Security Overview / Pen-Test Summary (NDA)
• Business Continuity & Disaster Recovery Summary
• Acceptable Use Policy (AUP)
• Subprocessor List