Privacy Policy

This Policy is issued by 〈legal entity name〉, registered at 〈registered address〉 ("Leptex", "we", "us").

It applies to the Leptex platform: the seller workspace, share links used by buyers, the cross-merchant buyer portal, and this website.

It does not apply to a seller's own website or to any third-party site a sponsored card links to.

We are a controller for account and billing data, website analytics, buyer portal accounts, and sponsored-placement measurement. For these we decide the purposes and means, and this Policy is the notice for them.

We are a processor for the knowledge documents a seller uploads and the conversation content produced under that seller's share links. The seller is the controller of that data; we act only on their documented instructions under a data processing agreement.

If you are a buyer who contacted a seller through a share link, that seller is the controller of your conversation with them. Direct access and deletion requests to that seller. We will assist them in responding, and we will not use that content for our own purposes. 〈confirm the DPA template and its execution route with counsel〉

Account data — name, email address, hashed password or federated identifier, tenant membership, role, and authentication events. Collected from you when you register or are invited.

Billing data — plan, subscription state, invoices, and payment identifiers held by our payment processor. We do not store full card numbers.

Customer content (processor role) — documents a seller uploads, their derived text chunks and vector embeddings, and the messages exchanged in conversations. Buyers may include personal data in messages; sellers decide what to upload.

Usage and metering data — per-call token counts, model name, and computed cost. These records contain no message bodies.

Abuse-prevention data — truncated one-way SHA-256 hashes of identifiers and IP addresses, held transiently in our cache with a time-to-live tied to the rate-limit window. We do not store plaintext IP addresses for this purpose.

Placement measurement — impressions and clicks on sponsored cards, recorded against a one-way hash of the viewer, never against a name or email.

Providing the service (account data, customer content) — performance of a contract, Art. 6(1)(b) GDPR; for customer content, processing on the controller's instructions under Art. 28.

Billing and tax records — performance of a contract and compliance with a legal obligation, Art. 6(1)(b) and (c).

Security, abuse prevention and rate limiting — legitimate interests, Art. 6(1)(f), in keeping the service available and costs bounded. We have balanced this against your interests and use only hashed, short-lived identifiers.

Sponsored-placement measurement — legitimate interests, Art. 6(1)(f), in billing advertisers accurately. Measurement is aggregate and pseudonymous; we do not build advertising profiles.

Service communications — legitimate interests. Marketing email — consent, withdrawable at any time.

〈confirm the lawful-basis mapping against the jurisdictions you will actually operate in〉

We never target advertising using buyer conversation content. Sponsored cards in the buyer portal are rotated deterministically by a hash of the viewer; no transcript, document, or inferred buyer stage is an input to that selection.

We never retrieve one tenant's knowledge base for another. The cross-merchant buyer assistant is structurally prevented from retrieving any seller's knowledge base; it can only replay transcripts the buyer already received.

We never sell personal data, and we do not share it for cross-context behavioural advertising as those terms are defined under the CCPA/CPRA.

We never use customer content to train third-party foundation models. Our model providers are contractually bound not to train on data we send them.

We use sub-processors for hosting, model inference, email delivery, and payments. A current list with each one's location and role is maintained at 〈sub-processor list URL〉, and we give 〈notice period, typically 30 days〉 notice before adding or replacing one.

We disclose personal data to public authorities only where legally compelled, and where lawful we will tell the affected customer first.

In a merger or acquisition, data may transfer to the successor entity, which remains bound by commitments no less protective than these.

Our infrastructure is hosted in 〈hosting regions〉. Where we transfer personal data out of the EEA, UK, or Switzerland, we rely on the European Commission's Standard Contractual Clauses together with a transfer impact assessment, or on an adequacy decision where one applies.

〈confirm the transfer mechanism for each sub-processor with counsel, and whether a UK Addendum and Swiss amendments are required〉

Account data — kept while the account is active and for 〈period, e.g. 30 days〉 after deletion, then erased.

Customer content — kept until the seller deletes it or the account is closed, then erased within 〈period, e.g. 30 days〉. Deleting a project deletes its documents, conversations, and analyses.

Billing records — kept for 〈statutory period in your jurisdiction, commonly 7 years〉 to meet tax and accounting obligations.

Abuse-prevention hashes — expire automatically with their rate-limit window; the longest currently in use is 24 hours.

Placement measurement — kept for 〈period, e.g. 24 months〉 for billing and dispute resolution.

Backups are overwritten on a rolling cycle; data in backups is erased no later than the end of that cycle.

Tenant isolation is enforced at the data-access layer: every query filters by tenant identifier in the repository, not by convention in application code, so one tenant's data cannot be read through another tenant's session.

Data is encrypted in transit with TLS and at rest by the underlying storage platform. Access to production data is restricted to staff who need it, is authenticated, and is logged in an audit trail.

〈add your penetration-testing cadence, SOC 2 / ISO 27001 status, and incident-response commitments once they are real — do not claim certifications you do not hold〉

If a breach is likely to result in a risk to individuals, we will notify the competent supervisory authority without undue delay and, where feasible, within 72 hours of becoming aware of it.

Where we act as processor, we will notify the affected customer without undue delay so they can meet their own notification duties.

〈name the lead supervisory authority once the establishment is decided〉

Subject to the conditions in applicable law, you may request access to your personal data, correction, erasure, restriction of processing, portability, and you may object to processing based on legitimate interests.

Where processing rests on consent, you may withdraw it at any time without affecting the lawfulness of processing before withdrawal.

California residents may request disclosure of the categories and specific pieces of personal information collected, request deletion or correction, and are protected against discrimination for exercising these rights. We do not sell or share personal information as those terms are defined under the CPRA.

Write to privacy@leptex.com. We respond within one month and will tell you if we need a permitted extension. You also have the right to lodge a complaint with your supervisory authority.

For data we hold as a processor, we will route your request to the seller who controls it and assist them in answering.

We use strictly necessary cookies for authentication and security, which do not require consent. Any analytics or preference cookies are set only after you consent, and you can change your choice at any time through the cookie preferences link in the footer.

〈list each cookie, its purpose, and its lifetime once the analytics stack is fixed〉

Assistant replies are generated by a large language model grounded in the seller's documents. They may be inaccurate and should be verified before being relied upon.

The assistant produces inferences about a buyer's stage and intent. These are shown only to the seller, are never fed back into the assistant's own context, and do not by themselves produce legal or similarly significant effects. We do not carry out automated decision-making within the meaning of Art. 22 GDPR.

Inference is performed by 〈name your model providers〉 under terms that prohibit training on our data.

Leptex is a business tool and is not directed to children. We do not knowingly collect personal data from anyone under 16. If you believe a child has provided us data, write to privacy@leptex.com and we will delete it.

We will post any change here and update the date above. For material changes we will give account holders advance notice by email.

Privacy questions and data requests: privacy@leptex.com

Data protection officer or representative: 〈appoint and name, if Art. 37 or Art. 27 GDPR applies to you〉

Postal address: 〈registered address〉