Privacy Policy

This Privacy Policy applies to the websites, applications, and services operated by Levanto Labs, Inc.(“Levanto,” “we,” “us,” or “our”), including Sage, our closed-ended decision / inference API and related customer dashboard (collectively, the “Services”), and our marketing site at levanto.ai, documentation, and related pages.

Levanto Labs, Inc.
131 Continental Drive, Suite 305
Newark, New Castle, Delaware 19713
United States

For privacy inquiries, contact us at team@levanto.ai.

This Policy covers personal data processed in connection with Sage inference and the Services that support it (account authentication, billing, usage metering, customer dashboard, documentation, and our marketing website). Other Levanto products or features, if any, that are not part of Sage inference are outside the scope of this Policy until separately described.

Depending on how you interact with us, we may process the following categories of data:

• Account and identity data. When you sign in with Google OAuth, we receive identifiers necessary to create and maintain your account (for example, email address, Google subject identifier, and display name), and we store session information associated with your authenticated use of the dashboard.
• Billing and customer profile data. Name, company, billing email, mailing address, country, tax identification information where required, payment and invoice metadata, and related Stripe customer identifiers. Payment card data is processed by our payment processor; we do not store full payment card numbers on our systems.
• Usage and metering data. Technical and commercial records of API use (for example token counts, decision-kind counts, search counts, cost, model identifiers, and related metering metadata). Usage records do not include the content of prompts, questions, grounding context, or model results.
• Inference inputs and outputs (transient). Content, questions, and optional grounding context you submit to Sage, and the decisions / results returned. As described in Section 5, these are subject to zero data retention for ordinary inference.
• Diagnostic logs (limited). On failed or abnormally slow requests, we may temporarily log request and response payloads for debugging, as described in Section 5.
• Website and analytics data. Standard device and usage information collected via Google Analytics and Vercel Analytics on our marketing site (for example pages viewed, approximate location derived from IP, device/browser information, and interaction events).
• Communications. Information you send us by email or other correspondence.

We process personal data for the following purposes:

• Providing the Services — authenticating users, routing and completing Sage inference requests, operating the dashboard, metering usage, and processing payments (performance of a contract; and where applicable our legitimate interests in operating a secure commercial service).
• Security, abuse prevention, and debugging — protecting the Services, investigating failures, and resolving support issues (legitimate interests; and, where required, compliance with legal obligations).
• Billing, accounting, and tax compliance — issuing invoices, collecting amounts due, and retaining records as required by law (contract; legal obligation; legitimate interests).
• Improving and understanding our website — analytics on the marketing site via Google Analytics and Vercel Analytics (legitimate interests; and consent where required by applicable law).
• Communications — responding to inquiries and service-related notices (contract; legitimate interests).

Where EU/UK GDPR or similar laws apply and we rely on consent, you may withdraw consent at any time without affecting the lawfulness of processing before withdrawal.

Inference and results — zero data retention. For ordinary Sage inference, we do not retain the content of prompts, questions, optional grounding inputs, or model results after the response is returned to you. Inference inputs and outputs are processed to fulfill the request and are not stored as customer content in our systems for later use.

Fail / slow diagnostic logs — 30 days. If a request fails or exceeds our slow-request threshold, we may temporarily retain full request and response payloads (with authentication credentials redacted) solely for debugging and reliability purposes. Such diagnostic logs are retained for thirty (30) days and then deleted.

Billing and usage records — 10 years. Account, billing, payment, invoice, and usage/metering records (which do not include prompt or result content) are retained for ten (10) years, or longer if required for legal, tax, accounting, or dispute-resolution purposes.

Account data. Account and authentication data are retained for as long as your account remains active and for a reasonable period thereafter as needed for security, fraud prevention, and legal compliance, unless a shorter or longer period is required by law.

Website analytics. Analytics data is retained in accordance with the retention settings and policies of Google Analytics and Vercel Analytics.

We do not use customer Sage inference inputs or outputs to train, fine-tune, or otherwise improve foundation or decision models, whether our own or those of third parties. Zero data retention for ordinary inference is consistent with this commitment: customer prompt and result content is not retained for model training or product improvement datasets.

We do not sell personal data. We share personal data with service providers that process data on our behalf, subject to appropriate contractual and technical safeguards, including:

• Google — authentication via Google OAuth only.
• Amazon Web Services (AWS) — proxying of Sage inference traffic and hosting of dashboard, billing, and usage APIs and related infrastructure.
• Vercel — hosting of our marketing website and related frontend infrastructure; Vercel Analytics.
• Google Analytics — website analytics on the marketing site.
• Mintlify — hosting and delivery of product documentation.
• Brave — web search used for optional grounding of Sage requests when you enable that feature.
• Stripe — payment processing and related billing operations (where you purchase or top up credits).

We may also disclose personal data if required by law, legal process, or governmental request; to protect the rights, property, or safety of Levanto, our customers, or others; or in connection with a merger, acquisition, financing, or sale of assets, subject to appropriate confidentiality protections.

Levanto is established in the United States. If you access the Services from the European Economic Area, the United Kingdom, or another jurisdiction with data transfer restrictions, your personal data may be transferred to and processed in the United States and other countries where we or our subprocessors operate. Where required, we implement appropriate safeguards for such transfers (for example, Standard Contractual Clauses or other lawful transfer mechanisms).

We implement technical and organizational measures designed to protect personal data against unauthorized access, loss, alteration, or disclosure, including access controls, encryption in transit where appropriate, and least-privilege practices for production systems. No method of transmission or storage is completely secure; we cannot guarantee absolute security.

Depending on your location and applicable law (including the EU/UK GDPR and certain U.S. state privacy laws such as the California Consumer Privacy Act as amended), you may have the right to:

• request access to personal data we hold about you;
• request correction of inaccurate personal data;
• request deletion of personal data;
• request restriction of, or object to, certain processing;
• request portability of personal data you provided to us;
• withdraw consent where processing is based on consent; and
• opt out of “sale” or “sharing” of personal information for cross-context behavioral advertising, to the extent those concepts apply (we do not sell personal data for money).

To exercise these rights, email team@levanto.ai. We may need to verify your identity before fulfilling a request. You may also have the right to lodge a complaint with a supervisory authority in your place of residence or work, or where an alleged infringement occurred.

Because ordinary Sage inference inputs and outputs are not retained, we generally cannot retrieve historical prompt or result content after a successful response has been delivered.

Our marketing website uses cookies and similar technologies in connection with Google Analytics and Vercel Analytics to measure traffic and product-interest events. The customer dashboard may use cookies or similar storage for authentication sessions. You can control cookies through your browser settings; disabling certain cookies may affect site functionality.

The Services are not directed to children under 16 years of age (or the minimum age required in your jurisdiction). We do not knowingly collect personal data from children. If you believe a child has provided us personal data, contact us and we will take appropriate steps to delete it.

We may update this Privacy Policy from time to time. The “Effective date” at the top of this page will be revised when changes take effect. Material changes may be communicated by posting on this page or by other reasonable means. Continued use of the Services after an update constitutes acceptance of the revised Policy to the extent permitted by law.

For questions about this Privacy Policy or our privacy practices, contact:

Levanto Labs, Inc.
131 Continental Drive, Suite 305
Newark, New Castle, Delaware 19713
United States
Email: team@levanto.ai