Privacy Policy

1. Who We Are

This Privacy Policy describes how GO CUE AI, INC. ("gocue.ai") collects, uses, and shares information through Leveair. Leveair is a secure document vault and living-link sharing platform used by both businesses and individuals to store, organize, and share important documents and records.

When we say "we," "us," or "our" in this policy, we mean GO CUE AI, INC. When we say "you" or "your," we mean you as a user of leveair — whether as an account holder (sender) or as a viewer who receives a shared link.

2. What Data We Collect

We collect only the data necessary to provide the leveair service. This includes:

Account holders (senders)

• Account information — your email address, display name, and profile photo (avatar). Within any organization you belong to, your display name and profile photo are visible to other members of that organization (for example, members can see the organization owner's name and photo in their Account settings, so they can identify who owns each shared account).
• Organization or personal profile data — business name, industry, team member information, or individual profile details you provide.
• Documents and files — any files you upload to your vault, including business documents, identity records, and attachments.
• Usage data — timestamps of when you access your vault, upload documents, or create shared links. Used for audit logging and security.
• Authentication data — hashed passwords and multi-factor authentication tokens managed by our authentication provider.
• Biometric login credentials (optional) — if you enable Face ID, Touch ID, Windows Hello, or a device passkey from Settings → Security, we store a public cryptographic key generated by your device, along with an opaque credential ID, a usage counter, and a device label you can edit. We do not store, receive, or have any access to your fingerprint, face image, or any biometric data itself — that information never leaves your device's secure hardware enclave (Apple Secure Enclave, Android StrongBox, Windows TPM). See Section 12a for full details.
• Billing data — subscription status and payment method details, processed and stored by Stripe. We do not store your full card number.

Viewers (recipients of shared links)

When a leveair user sends a LeveShare link (a living document link), recipients who open that link may be asked to verify their identity. We collect:

• Email address — entered voluntarily to verify identity before accessing a shared link. Used solely to control access and attribute activity to the correct viewer.
• Access logs — a timestamped record of each action taken on a shared link, associated with the viewer's email address. Logged events include: opening the link (view), downloading a file (download), opening an external URL (preview), copying a document field value such as a reference number or EIN (copy — the specific field label is recorded), and uploading a file (upload). These logs are visible to the sender and are the basis for leveair's audit trail feature.
• Device and browser information — browser type and general device category (mobile/desktop), parsed from the HTTP user-agent string. Used to provide context in access logs.
• Files uploaded by viewers — if the sender has enabled two-way upload on a link, files submitted by the viewer are stored in our secure file storage and attributed to the viewer's email address.
• One-time verification codes (OTP) — a 6-digit code may be sent to a viewer's email address to verify identity before accessing a link. The code expires in 10 minutes and is deleted after use.
• Bot protection challenge — when a viewer requests an email verification code, an invisible security challenge runs automatically in the background to detect automated abuse. This challenge transmits your IP address and browser characteristics to Cloudflare for evaluation. No challenge result or personal data is retained by leveair as a result of this check. See Section 6 for details on Cloudflare's data practices.

3. How We Store Your Data

All data is stored on infrastructure provided by Supabase, which runs on Amazon Web Services (AWS) in the United States. Your data is protected by:

• Encryption in transit — all data is transmitted over HTTPS using TLS 1.2 or higher.
• Encryption at rest — database storage is encrypted at the infrastructure level by AWS, and file storage is encrypted at rest by our storage provider.
• Application-layer encryption (private vault files) — files you upload to your private vault (documents, people documents, asset files) are encrypted in your browser with AES-256-GCM before reaching our storage. Encryption keys are managed per organization and are held by leveair under role-based access controls. This provides defense-in-depth on top of the at-rest encryption above and protects against storage-only data leaks. This is not end-to-end encryption — leveair staff with administrative database access can in principle decrypt your files. We do not access customer file content in the normal course of operating the service, but we are not cryptographically prevented from doing so.
• LeveShare files are decrypted for recipients — when you share a vault document through a LeveShare link, the file is decrypted and a plaintext copy is created in a separate storage bucket so the people you send it to can view it. Access to that copy is enforced by the LeveShare link’s settings (allowed emails, one-time codes, passcodes, viewer list, expiration) rather than by cryptographic key separation. Deactivating a share removes the shared copy.
• Stored credentials (asset passwords) — passwords you save inside an asset record are transformed before being written to the database so they are not visible in plain text in casual database queries. This is not equivalent to a dedicated password manager and should not be treated as one.
• Row-level security — database access policies ensure you can only access data belonging to your account or organization.
• Signed URLs — vault document downloads use time-limited signed URLs that expire within one hour. LeveShare link downloads use longer-lived signed URLs scoped to the active share so recipients can return to the same link over its lifetime.

4. How We Use Your Data

We use your data solely to:

• Provide the leveair vault and LeveShare service to you.
• Verify viewer identity when accessing a shared link and enforce the sender's access controls (allowed emails, passcodes, permissions, and expiration dates).
• Generate and display access logs to the sender, showing who opened a shared link, when, and what actions they took.
• Send transactional emails such as invitations, password resets, document expiration alerts, and notifications when a viewer accesses or uploads through a shared link.
• Process subscription billing through Stripe.
• Maintain security through audit logs and access monitoring.
• Analyze uploaded documents to identify metadata and calculate suggested renewal and expiration deadlines when you enable AI Insights (see Section 5 below).
• Monitor application errors and performance to maintain service quality (see Section 6).

5. AI Document Analysis

leveair offers an optional AI Insights feature that automatically identifies metadata from documents you upload — such as document title, category, issuer, and reference number — and analyzes document context to calculate suggested renewal and expiration deadlines. This feature is enabled by default and can be disabled at any time from your organization settings.

How it works: When you upload a PDF to your vault, leveair reads text from the file (or renders page images for scanned documents) and sends that content to Anthropic's API for analysis. The AI analyzes document context to identify metadata fields and calculate suggested renewal and expiration deadlines — it does not store your document content.

What is sent to Anthropic: Extracted text (up to approximately 8,000 characters) or rendered page images from the first pages of your uploaded PDF. The full file is never transmitted to Anthropic.

Important limitations: AI-calculated renewal and expiration deadlines are derived from document context and may not reflect official records. AI-generated metadata suggestions may also be inaccurate, incomplete, or misidentify document content. You must independently verify all AI-calculated dates with the original issuing authority before relying on them. leveair and GO CUE AI, INC. are not liable for any consequences of decisions made based on unverified AI output.

Opt-out: Organization administrators can disable AI Insights entirely from Settings → Organization. When disabled, no document content is sent to Anthropic and AI analysis does not run.

Anthropic processes submitted content under their own privacy policy and data processing terms. We do not use your document content to train AI models.

6. Third-Party Services

leveair uses the following third-party services to operate:

• Supabase (database, authentication, and file storage) — hosted on AWS in the United States.
• Stripe (subscription billing and payment processing) — Stripe stores your payment method and billing details under their own privacy policy. We do not store full card numbers.
• Anthropic (AI document analysis) — when AI Insights is enabled, document text or page images are sent to Anthropic's API for analysis. The AI identifies document metadata and calculates suggested renewal and expiration deadlines from document context. The full document file is never transmitted. See Section 5 for full details. You may opt out.
• Netlify (web hosting and content delivery).
• Resend (transactional email delivery — invitation emails, OTP codes, expiration alerts).
• Cloudflare Turnstile (invisible bot protection) — when a viewer requests an email verification code, an automated security challenge runs in the background. This transmits the viewer's IP address and browser characteristics to Cloudflare for evaluation. No challenge result or personal data is stored by leveair as a result of this check. Cloudflare processes this data under their own privacy policy.
• Google Analytics 4 + Google Ads (visitor measurement and ad attribution) — we use Google's gtag.js loaded with Consent Mode v2. The script is included in every page so Google's verification tools can detect it, but all storage (ad cookies, analytics cookies, ad personalization, ad user data) defaults to "denied" — no data is sent to Google until you explicitly accept Marketing cookies in our cookie banner. On acceptance, GA4 begins recording aggregate visitor behavior (pageviews, session duration, navigation) and Google Ads sets first-party conversion cookies (_gcl_aw, _gcl_dc) to measure whether an ad drove your visit. We do not use either service to build personalized advertising profiles or to serve you ads on other sites. Declining Marketing cookies stops data transmission immediately. You can revoke consent at any time by clearing browser storage, changing your cookie preferences in our banner, or contacting us. Google processes any data sent under their own privacy policy.
• Sentry (error monitoring and session replay) — when an application error occurs, Sentry captures a report including the error details, the page you were on, and a session replay of the actions leading to the error. All text on screen is masked and media is blocked in session replays. Error reports do not include document content. This data is used solely to diagnose and fix bugs.
• Google Drive (optional file import) — if you choose to import a document from Google Drive, leveair requests read-only access to your Drive files solely to download the file you select. We do not store your Google credentials, do not retain your Drive access token after the import completes, and do not access any files beyond the one you explicitly pick. The imported file is a one-time copy — changes made to the original file in Google Drive after import are not reflected in leveair. Google Drive access is governed by Google's Privacy Policy.

These services process data only as necessary to provide their respective functions. They do not have access to the content of your vault files or the files you share via LeveShare beyond what is necessary to store and transmit them. Decryption keys for private vault files are held only by leveair under role-based access controls.

7. We Never Sell or Share Your Data

Your data is yours. We do not sell, rent, trade, or share your personal information or documents with any third party for marketing, advertising, or any other purpose beyond what is described in this policy.

Viewer email addresses collected through LeveShare links are accessible only to the sender who created the link and to us for the purposes described above. They are never shared with other users, organizations, or third parties.

8. LeveShare Links and Viewer Privacy

LeveShare is leveair's living-link feature. When a sender creates a LeveShare link and shares it with you, the following applies:

• Your email address is used to verify your identity and may be required before you can view the link's contents, depending on the sender's settings.
• Consent notice at the email gate. When a link requires email verification, you will be shown a consent notice before you can enter your email. You must explicitly acknowledge that your email and access activity will be logged and visible to the sender before you can proceed. If you do not consent, you cannot access the link.
• Your actions on the link are logged and visible to the sender. Logged events include: opening the link, downloading a file, copying a document field value (the specific field label is recorded, not your clipboard contents), and uploading a file. This is a core feature of the service — senders choose leveair specifically because they can see who accessed their documents.
• The sender may revoke your access to a link at any time. Revocation takes effect immediately.
• The sender may set an expiration date on your individual access or on the link as a whole.
• If you upload a file through a LeveShare link, that file is stored securely and shared only with the link's sender.
• Access restrictions. Senders may permanently restrict specific email addresses from accessing a particular shared link. If your access is restricted, you will see a standard access-unavailable message. That message does not disclose whether a restriction was applied or the reason for it. Restriction records are retained in our systems to enforce the sender's security decision. See Section 9 for how deletion requests are handled when a restriction record exists for your email.
• Remove yourself from a link. You may remove yourself from any organization's LeveShare links — or from all links at once — directly from leveair.com/my-links. Email verification is required. When you remove yourself: your email address is permanently anonymized in all access logs and upload records for that organization (replaced with "[redacted]"), your non-restricted viewer invite records are deleted, and any restriction records are anonymized to preserve the sender's security settings. Files you submitted to the organization are not deleted — they remain as the organization's records. You must check two acknowledgment boxes before proceeding, confirming you understand both the access-history removal and the file-retention behavior. Removal takes effect immediately.

If you received a LeveShare link and have questions about how the sender is using your data, please contact the sender directly. To remove yourself from links, use the self-serve tool at leveair.com/my-links. For other questions about how leveair handles your data, contact us at hello@gocue.ai.

9. Your Rights

You have the right to:

• Access your data — you can view all your data within the leveair application at any time.
• Delete your account — you can permanently delete your account and all associated data from Settings → Privacy → Delete My Account.
• Export your data — you can download a complete copy of all data associated with your account directly from Settings → Privacy → Export My Data.
• Correct your data — you can update your profile, organization details, and documents at any time within the application.
• Opt out of AI analysis — organization administrators can disable AI Insights from Settings → Organization at any time.
• Remove yourself from links — if you are a viewer (not an account holder), you can remove yourself from an individual organization's links or from all links at once, directly from leveair.com/my-links. Email verification is required. Removal anonymizes your email address in access logs and upload records (replacing it with "[redacted]") — it does not delete the log entries themselves, which organizations retain for analytics. Files you submitted to an organization are not deleted; they remain as the organization's records with your email anonymized. If your email appears in a restriction record, that record is also anonymized rather than deleted, preserving the sender's security settings. For assistance, contact us at hello@gocue.ai.

9a. Rights for Users in the EU, EEA, and UK (GDPR)

If you are located in the European Union, European Economic Area, or United Kingdom, the General Data Protection Regulation (GDPR) and UK GDPR provide you with specific rights regarding your personal data. This section explains how those rights apply to leveair.

Data controller. GO CUE AI, INC. is the data controller for personal data we collect about you when you create an account, use the vault, or access a LeveShare link as a viewer.

Lawful basis for processing. We process your personal data on one or more of the following legal grounds:

• Contract (Art. 6(1)(b)) — to provide the leveair service you signed up for, including authentication, vault storage, and LeveShare delivery.
• Legitimate interests (Art. 6(1)(f)) — for product analytics, security monitoring, abuse prevention, and error tracking. You can object to this processing at any time by emailing hello@gocue.ai.
• Consent (Art. 6(1)(a)) — for optional features such as analytics cookies, AI document analysis, and viewer email-gate access. You can withdraw consent at any time without affecting the lawfulness of prior processing.
• Legal obligation (Art. 6(1)(c)) — to comply with applicable laws, respond to lawful requests, and maintain records required by regulators.

Your rights under GDPR. In addition to the rights listed in Section 9 above, you have the right to:

• Restrict processing of your personal data in certain circumstances (Art. 18).
• Object to processing based on legitimate interests, including profiling (Art. 21).
• Data portability — receive your personal data in a structured, machine-readable format and transmit it to another controller (Art. 20). The self-service export at Settings → Privacy → Export My Data satisfies this right.
• Withdraw consent at any time where processing is based on consent.
• Lodge a complaint with your local Data Protection Authority. A list of EU/EEA supervisory authorities is available at edpb.europa.eu. UK residents can complain to the Information Commissioner’s Office (ICO).

International data transfers. Our infrastructure providers (Supabase, AWS, Stripe, Anthropic, Cloudflare, Sentry, Resend, Netlify) process data primarily in the United States. When personal data of EU/EEA/UK residents is transferred to the US, we rely on the European Commission’s Standard Contractual Clauses (SCCs) (Module 2 for controller-to-processor transfers) and equivalent UK International Data Transfer Addendum, executed with each subprocessor. We assess each subprocessor’s safeguards and require encryption in transit and at rest.

Data Protection Officer. For privacy-specific questions, including formal rights requests, contact our Data Protection contact at hello@gocue.ai with the subject line “GDPR Request.” We will respond within 30 days as required by Art. 12.

Personal data breach notification. In the unlikely event of a personal data breach likely to result in a risk to your rights and freedoms, we will notify the relevant supervisory authority without undue delay and, where feasible, within 72 hours of becoming aware (Art. 33). Where the breach is likely to result in a high risk to your rights, we will notify affected users directly (Art. 34).

Data Processing Agreement (DPA). If you are a business customer subject to GDPR and require a Data Processing Agreement, please email hello@gocue.ai with the subject line “DPA Request” and we will provide our standard DPA for countersignature.

9b. Rights for California Residents (CCPA & CPRA)

If you are a California resident, the California Consumer Privacy Act (CCPA) as amended by the California Privacy Rights Act (CPRA) provides you with specific rights regarding your personal information.

Notice at Collection. Below is a summary of the categories of personal information we collect and the purposes for which we collect them. We collect this information directly from you when you use leveair.

• Identifiers (email address, account ID, IP address) — to authenticate you, deliver the service, and prevent fraud.
• Commercial information (subscription status, billing history) — to bill you and provide billing support, via Stripe.
• Internet activity (usage logs, access logs, browser type) — to operate the service, provide audit trails for senders, and improve product quality.
• Geolocation data (coarse, IP-derived only — no precise GPS) — included in access logs for security and audit purposes.
• Inferences (AI-derived document metadata such as title, category, expiry — only when AI Insights is enabled) — to populate document fields automatically.
• Professional information (organization name, role, industry) — to operate team features and bill business accounts.

We do not sell your personal information. We do not receive monetary or other valuable consideration in exchange for your personal information from any third party, and have not done so in the preceding 12 months.

Sharing for advertising purposes (with your consent). When you accept Marketing cookies in our cookie banner, we share limited information about your visit (page URL, referrer, conversion events such as signup or paid subscription) with Google Ads so we can measure ad campaign effectiveness. Under the California Privacy Rights Act (CPRA), this may be classified as “sharing” for cross-context behavioral advertising. You can opt out at any time by declining Marketing cookies in the cookie banner (visible on first visit, or by clearing your browser storage and reloading), or by emailing hello@gocue.ai with the subject line “Do Not Sell or Share.” If you decline Marketing cookies, no data is shared with any advertising partner.

Sensitive personal information. We do not collect the following categories of sensitive personal information unless you choose to upload them as files into your vault: government identifiers, financial account numbers, precise geolocation, biometric data, health data, or contents of mail/email. When you do upload such files, they are stored encrypted (see Section 3) and are not used for inferences or any other secondary purpose. You can delete them at any time.

Your California rights. California residents have the right to:

• Right to know — request the specific categories and pieces of personal information we have collected about you (covered by Settings → Privacy → Export My Data).
• Right to delete — request deletion of your personal information (covered by Settings → Privacy → Delete My Account).
• Right to correct — request correction of inaccurate personal information.
• Right to opt out of sale or sharing — not applicable because we do not sell or share, but you can confirm at any time by emailing hello@gocue.ai.
• Right to limit use of sensitive personal information — applicable only where we use sensitive PI for purposes beyond the necessary service. We do not.
• Right to non-discrimination — we will not deny service, charge different prices, or provide a different level of service because you exercised your rights.
• Authorized agent — you may use an authorized agent to make a request on your behalf. We will require verification.

How to exercise your rights. Use the in-app tools listed above, or email hello@gocue.ai with the subject line “California Privacy Request.” We will verify your identity and respond within 45 days, with one possible 45-day extension as permitted by law.

Minors under 16. We do not knowingly collect or sell personal information of California residents under 16. leveair is intended for users 18 and older.

10. Data Retention

When you delete your account, all associated data is permanently removed from our active database immediately. Infrastructure-level backups may retain data for up to 7 days before automatic deletion.

We automatically purge certain operational data on a rolling schedule:

• Activity and audit logs — retained for 1 year from the date of the event, then permanently deleted.
• LeveShare access logs — retained for 1 year from the access date, then permanently deleted.
• In-app notifications — retained for 90 days, then permanently deleted.
• Sentry error reports — retained for 90 days per Sentry's default data retention policy.

This purging happens automatically. You do not need to take any action.

11. Cookies and Local Storage

leveair uses browser local storage for authentication session management and user preferences (such as theme settings). You can manage your cookie preferences at any time using the cookie banner that appears on first visit, or by clearing your browser storage and reloading.

We use PostHog, a product analytics service, to understand how visitors use our website and application — for example, which pages are viewed and where users drop off. PostHog stores a pseudonymous identifier in your browser's local storage. No personally identifiable information is shared with PostHog beyond what you provide to leveair. You can opt out of analytics tracking at any time by declining Analytics cookies in the cookie banner.

We also use Google Analytics 4 and Google Ads gtag.js with Consent Mode v2. The Google tag is loaded on every page so Google's verification tools can detect it, but all storage defaults to "denied": no data is sent to Google until you explicitly accept Marketing cookies. On acceptance, GA4 records aggregate visitor behavior (pageviews, session duration) and Google Ads sets first-party conversion cookies in the _gcl_* family (Google Click Identifier) to attribute signups and purchases to ad campaigns. Declining or revoking Marketing cookies stops both immediately.

For LeveShare viewers, we use browser local storage to remember your verified email address on a given device so you do not need to re-enter it each time you access the same link. This data is stored only on your device.

For OTP verification, we store a session flag in browser local storage to remember that the viewer has been verified for the current session. This flag is cleared when the viewer signs out or the link's permissions change.

12. Chrome Browser Extension

leveair offers a Chrome browser extension that provides quick access to your vault directly from the Chrome toolbar. The extension operates under the same privacy principles as the main application. Specifically:

• Authentication — the extension uses your leveair login credentials to authenticate securely with our backend. Your session token is stored locally in Chrome's extension storage and is never shared with third parties.
• Clipboard access — the extension may write to your clipboard when you use the one-click copy feature (e.g., copying your EIN or business address). No clipboard data is read or transmitted to our servers.
• Local storage — the extension caches your session and preferences locally on your device. This data does not leave your device except to authenticate with leveair's backend.
• Network requests — the extension communicates exclusively with leveair's backend to fetch your profile and documents. It does not make requests to any other domain.
• No browsing data — the extension does not read, monitor, or collect any information about the websites you visit.

12a. Biometric Login (Face ID / Touch ID / Passkey)

leveair offers an optional biometric login feature so you can sign in with Face ID, Touch ID, Windows Hello, or a device passkey instead of typing your password. This feature uses the WebAuthn / FIDO2 standard — an open W3C specification designed specifically to keep biometric data private.

What we store on our servers:

• An opaque credential identifier (a random string generated by your device — not derived from your biometric).
• A public cryptographic key — useful only for verifying signatures, useless for impersonating you. The matching private key never leaves your device.
• A usage counter (used to detect cloned authenticators per the WebAuthn spec).
• The transports your device reported (e.g., “internal” for built-in biometric).
• A device label you can edit (e.g., “iPhone”).
• Timestamps for when the credential was added and last used.

What we do NOT store, transmit, or have access to:

• Your fingerprint, face geometry, iris scan, or any other biometric reading.
• Any biometric template or hash thereof.
• The private cryptographic key — it is created inside your device's secure hardware (Apple Secure Enclave, Android StrongBox, Windows TPM, hardware security keys) and cannot be extracted by any software, including ours.

How sign-in works: When you sign in with biometric, your device prompts you for Face ID / Touch ID. If the biometric matches locally on your device, your device uses its private key to sign a one-time challenge from our server. Our server verifies the signature with the stored public key — we never see the biometric itself, only the cryptographic proof that your authenticator unlocked successfully.

Removing biometric credentials: You can remove any registered device at any time from Settings → Security → Biometric login. The credential is deleted from our database immediately. Deleting it from leveair does not affect the credential's status in your device's own keychain — to remove it there, use your operating system's passkey or password manager settings.

Why biometric is more private than passwords: Passwords can be guessed, leaked, or shared. Biometric public keys are unique to the (user, site, device) tuple, can't be phished, and reveal nothing about you if breached. We adopted WebAuthn specifically because it gives users a stronger authentication option while reducing the personal data we collect.

13. Children's Privacy

leveair is not intended for individuals under the age of 18. We do not knowingly collect personal information from minors.

14. Changes to This Policy

We may update this privacy policy from time to time. If we make material changes, we will notify you via email or through a notice within the application. Your continued use of leveair after changes are posted constitutes your acceptance of the updated policy.

15. Contact Us

If you have questions about this privacy policy or how your data is handled, contact us at:

GO CUE AI, INC. — leveair
Email: hello@gocue.ai