Privacy Policy | Levanto

1. Controller

This Privacy Policy applies to the websites, applications, and services operated by Levanto Labs, Inc.(“Levanto,” “we,” “us,” or “our”), including Sage, our closed-ended decision/inference API and related customer dashboard (collectively, the “Services”), and our marketing site at levanto.ai, documentation, and related pages.

Levanto Labs, Inc.
131 Continental Drive, Suite 305
Newark, New Castle, Delaware 19713
United States
For privacy inquiries, contact us at team@levanto.ai.

2. Scope

This Policy covers personal data processed in connection with Sage inference and the Services that support it (account authentication, billing, usage metering, customer dashboard, documentation, and our marketing website). Other Levanto products or features, if any, that are not part of Sage inference are outside the scope of this Policy until separately described.

3. Categories of Personal Data We Process

Depending on how you interact with us, we may process the following categories of data:

• Account and identity data. When you sign in with Google OAuth, we receive identifiers necessary to create and maintain your account (for example, email address, Google subject identifier, and display name), and we store session information associated with your authenticated use of the dashboard.
• Billing and customer profile data. Name, company, billing email, mailing address, country, tax identification information where required, subscription plan and status, payment and invoice metadata, and related Stripe customer identifiers. Payment card data is processed by our payment processor; we do not store full payment card numbers on our systems.
• Usage and metering data. Technical and commercial records of API use (for example token counts, decision-kind counts, search counts, cost, model identifiers, and related metering metadata). Usage records do not include the content of prompts, questions, grounding context, or model results.
• Inference inputs and outputs (transient). Content, questions, and optional grounding context you submit to Sage, and the decisions/results returned. These are subject to zero data retention for ordinary inference.
• Diagnostic logs (limited). On failed or abnormally slow requests, we may temporarily log request and response payloads for debugging.
• Website and analytics data. Standard device and usage information collected via Google Analytics and Vercel Analytics on our marketing site (for example pages viewed, approximate location derived from IP, device/browser information, and interaction events).
• Communications. Information you send us by email or other correspondence.

4. Purposes and Legal Bases

We process personal data for the following purposes:

• Providing the Services — authenticating users, routing and completing Sage inference requests, operating the dashboard, metering usage, and processing payments.
• Security, abuse prevention, and debugging — protecting the Services, investigating failures, and resolving support issues.
• Billing, accounting, and tax compliance — issuing invoices, collecting amounts due, and retaining records as required by law.
• Improving and understanding our website — analytics on the marketing site via Google Analytics and Vercel Analytics.
• Communications — responding to inquiries and service-related notices.

5. Retention; Zero Data Retention for Inference

Inference and results — zero data retention. For ordinary Sage inference, we do not retain the content of prompts, questions, optional grounding inputs, or model results after the response is returned to you.

Fail / slow diagnostic logs — 30 days. If a request fails or exceeds our slow-request threshold, we may temporarily retain full request and response payloads solely for debugging and reliability purposes. Such diagnostic logs are retained for thirty (30) days and then deleted.

Billing and usage records — 10 years. Account, billing, payment, invoice, and usage/metering records are retained for ten (10) years.

Account data. Account and authentication data are retained for as long as your account remains active and for a reasonable period thereafter.

Website analytics. Analytics data is retained in accordance with the retention settings and policies of Google Analytics and Vercel Analytics.

6. No Training on Customer Content

We do not use customer Sage inference inputs or outputs to train, fine-tune, or otherwise improve foundation or agentic models.

7. Sharing and Subprocessors

We do not sell personal data. We share personal data with service providers that process data on our behalf, subject to appropriate contractual and technical safeguards, including:

• Google — authentication via Google OAuth only.
• Amazon Web Services (AWS) — proxying of Sage inference traffic and hosting of dashboard, billing, and usage APIs.
• RunPod — GPU infrastructure that runs Sage inference.
• Vercel — hosting of our marketing website and related frontend infrastructure.
• Mintlify — hosting and delivery of product documentation.
• Brave — web search used for optional grounding of Sage requests.
• Stripe — payment processing and related billing operations.

We may also disclose personal data if required by law, legal process, or governmental request.

8. International Transfers

Levanto is established in the United States. If you access the Services from the European Economic Area, your personal data may be transferred to and processed in the United States.

9. Security

We implement technical and organizational measures designed to protect personal data against unauthorized access, loss, alteration, or disclosure. No method of transmission or storage is completely secure; we cannot guarantee absolute security.

10. Your Rights

Depending on your location and applicable law, you may have the right to:

• request access to personal data we hold about you;
• request correction of inaccurate personal data;
• request deletion of personal data;
• request restriction of, or object to, certain processing;
• request portability of personal data you provided to us;
• withdraw consent where processing is based on consent.

To exercise these rights, email team@levanto.ai.

11. Cookies and Similar Technologies

Our marketing website uses cookies and similar technologies in connection with Google Analytics and Vercel Analytics to measure traffic and product-interest events.

12. Children

The Services are not directed to children under 16 years of age. We do not knowingly collect personal data from children.

13. Changes to This Policy

We may update this Privacy Policy from time to time. The “Effective date” at the top of this page will be revised when changes take effect.

14. Contact

For questions about this Privacy Policy or our privacy practices, contact:

Levanto Labs, Inc.
131 Continental Drive, Suite 305
Newark, New Castle, Delaware 19713
United States
Email: team@levanto.ai