Short version: Your documents are never stored. They are processed in memory and discarded immediately after analysis. We never use your procurement documents to train AI models. We collect only what's needed to run the service and communicate results.
Levlr ("we", "our", "us") operates the AI procurement analysis platform available at levlr.io and its subdomains. This Privacy Policy explains how we collect, use, and protect information when you use our services.
By using Levlr, you agree to the collection and use of information as described in this policy. If you do not agree, please do not use the service.
When you create an account, we collect your email address and a password (stored as a one-way hash). You may optionally provide your name and company. We do not collect payment card details directly — all billing is handled by Stripe, which is PCI-DSS Level 1 certified.
We collect anonymised usage telemetry: which analysis engines you use, how many analyses you run, general session duration, and error rates. This data does not include the contents of your documents. It is used to improve product reliability and prioritise features.
If you contact us by email or submit a free analysis request, we store the email address and message content to respond to your enquiry and deliver your results. Free analysis result emails are sent via our transactional email provider (Resend) and are retained for 30 days for deliverability purposes.
We collect standard server logs including IP address, browser type, referring URL, and timestamps. These are retained for up to 90 days for security and abuse prevention purposes.
Documents are never stored. Files you upload — bid documents, contracts, invoices, POs, RFQs — are transmitted over TLS 1.3, processed entirely in server memory, and discarded immediately after the analysis response is returned. We do not write your documents to any database, object storage, or log file.
Document content is transmitted to Google's Gemini API for AI analysis. This transmission is covered by Google's API data processing terms, which prohibit Google from using API-submitted data to train its models. You can review Google's API data usage policies at ai.google.dev/gemini-api/terms.
We never use your procurement documents, bid data, or contract contents to train our own models or any third-party model.
We use the data we collect for the following purposes:
We do not use your data for advertising. We do not sell your data to any third party. We do not use your documents or analysis results for any purpose other than delivering the service to you.
We share data only with the following categories of service providers, under contractual obligations that restrict their use of the data:
We do not share your data with advertisers, data brokers, or analytics resellers. We do not sell personal data under any circumstances.
In the event of a merger, acquisition, or sale of assets, user data may be transferred to the acquiring entity, subject to the same privacy protections described here. We will notify affected users by email prior to any such transfer.
We take the security of construction procurement data seriously. Our security measures include:
No system is perfectly secure. If you discover a security vulnerability, please report it to [email protected]. We aim to respond to security reports within 24 hours.
If you are located in the European Economic Area or the United Kingdom, you have the following rights under the General Data Protection Regulation (GDPR) and UK GDPR:
Our lawful basis for processing is: contract performance (to deliver the service you signed up for), legitimate interests (security, fraud prevention, product improvement), and consent (marketing communications).
To exercise any of these rights, email [email protected]. We will respond within 30 days. You also have the right to lodge a complaint with your national data protection authority.
Under the California Consumer Privacy Act (CCPA), California residents have the right to:
To submit a CCPA request, email [email protected] with the subject line "CCPA Request." We will verify your identity and respond within 45 days.
We use a minimal set of cookies necessary to operate the service:
We do not use advertising cookies, tracking pixels, or third-party analytics cookies. We do not use Google Analytics, Facebook Pixel, or similar advertising-network trackers. If we add analytics in the future, we will update this policy and provide an opt-out mechanism.
Levlr is a business-to-business software service. It is not directed at children under the age of 16. We do not knowingly collect personal information from anyone under 16. If you believe a child has provided us with personal information, please contact us and we will delete it promptly.
We may update this Privacy Policy from time to time. When we make material changes, we will notify registered users by email at least 14 days before the changes take effect. The "Last updated" date at the top of this page will always reflect the most recent revision. Continued use of the service after a policy update constitutes acceptance of the revised terms.
For privacy-related questions, data requests, or to exercise your rights:
Levlr · levlr.io · Privacy Policy · Effective March 1, 2026