1. Data Controller

LevelUp Ecosystem is responsible for processing your personal data in accordance with the General Data Protection Regulation (GDPR). Any inquiries regarding your data or privacy can be directed to our dedicated support team at: [email protected] or [email protected].

2. Data We Collect & How We Use It

We only collect the absolute minimum amount of data required to make our services (LevelMovie, LevelMusic, and Level IA) function properly. When you log in via Google OAuth 2.0, we collect and process:

• Google Identity Data: Your display name, primary email address, and profile picture URL. Purpose: Customizing your user interface and securing your account.
• Firebase UID: A unique, non-human-readable technical identifier provided by Google. Purpose: Securely linking your data to your account within our database.
• LVL Access Key & Hashed PIN: The unique key generated for you and the 4-digit PIN you set. Purpose: Managing your access rights and securing the display of your key.
• Approximate Location Data: Basic location data provided by your browser. Purpose: Used strictly in real-time by Level IA to contextualize its responses (e.g., local weather). This data is never permanently stored or sold.
• Level IA Conversations: Your chat history with our AI. Purpose: Providing the AI assistance service and maintaining a persistent memory for your future sessions.

3. Artificial Intelligence (Level IA) & Gemini

Level IA is powered by Google's Gemini AI. To provide you with intelligent and contextual responses, your text prompts and conversation history are sent securely to Google's API. Because we utilize the free tier of these services, data processing is subject to Google's standard API terms of service.

Important: We do not attach your personal identity (such as your name or email) to the AI requests to train models. However, we strongly advise against sharing highly sensitive personal, financial, or medical information in your conversations with Level IA.

4. Third-Party Infrastructure & APIs

To deliver a fast, secure, and feature-rich ecosystem, we rely on industry-leading third-party services. These partners act as data processors and operate under strict security protocols:

• Hosting & Security: Our platform is deployed via Vercel and code hosted on GitHub, with Cloudflare providing CDN (Content Delivery Network), DDoS protection, and SSL encryption.
• Database & Auth: We use Google's Firebase for secure user authentication and database storage.
• Communications: We use Resend to securely route and deliver our transactional and support emails.
• Content Providers (LevelMovie & LevelMusic): We query external databases such as the TMDB API (The Movie Database) and the Apple Music API to provide you with rich media content. These services only receive anonymous, technical search requests (e.g., searching for a movie title) and never receive your personal data.

5. Data Storage, Security & International Transfers

All user data is stored securely within our infrastructure. We enforce rigorous security measures, including:

• Encryption in Transit & at Rest: All data sent between your device and our servers is encrypted using TLS 1.3, and data is securely encrypted while stored in our databases.
• Granular Access Rules: Firebase security rules are strictly configured to ensure that you, and only you, can access your personal data and conversation history.
• International Transfers: Due to the global nature of cloud infrastructures like Cloudflare, Vercel, and Firebase, your data may be processed on servers located outside your country of residence. These providers comply with international privacy frameworks (such as Standard Contractual Clauses).
• Breach Notification: In the unlikely event of a security breach that poses a high risk to your data rights, we commit to notifying you and the relevant authorities within 72 hours, in compliance with GDPR.

6. Your Rights Under GDPR

In compliance with the General Data Protection Regulation (GDPR) and applicable privacy laws, you possess full control over your data. You have the right to:

• Right of Access: Request a complete copy of all personal data we hold about you.
• Right to Rectification: Request correction of inaccurate data (note: your name and email are synced with your Google Account).
• Right to Erasure ("Right to be Forgotten"): Request the permanent and irreversible deletion of your LevelUp account and all associated data.
• Right to Data Portability: Receive your data in a structured, commonly used format.

To exercise any of these rights, please contact us at [email protected]. We are committed to processing all requests within 30 days.

7. Data Retention Period

Your personal data is retained only for as long as your LevelUp account remains active. If you choose to delete your account, all personal data, including your profile information, LVL Access Key, hashed PIN, and Level IA conversation history, will be permanently and irretrievably deleted from our servers.

8. Protection of Minors

The LevelUp Ecosystem is not intended for use by children under the age of 13 (or 16, depending on your local jurisdiction). We do not knowingly collect personal information from minors. If you are a parent or guardian and believe your child has created an account and provided personal data, please contact us immediately so we can delete it.

9. Cookies and Tracking Technologies

Unlike many platforms, LevelUp Ecosystem is completely free of advertising trackers. We do not use Facebook Pixels, Google Analytics tracking scripts, or any third-party marketing cookies.

We only use strictly necessary technical mechanisms to ensure the platform functions:

• Firebase Authentication Tokens: Secure tokens stored locally to maintain your active login session.
• Local Storage (localStorage/sessionStorage): Used solely to remember your interface preferences (e.g., dark mode) and manage temporary session states.

10. Transparency & Creation: Built with AI

In the spirit of full transparency, we want to share that the LevelUp Ecosystem was developed with the assistance of Artificial Intelligence. However, AI did not do everything. It acted as a powerful technical assistant to help write code and format structures, but the vision, architecture, decision-making, and passion behind this project remain entirely human. We mention this to inspire our community: with today's available tools and your own determination, anyone can learn, build their own projects, and bring their ideas to life.

11. Contact the Privacy Team

If you have any questions, concerns, or requests regarding this Privacy Policy or how we handle your personal data, please do not hesitate to contact our dedicated support team.

Contact Privacy Support