Privacy Policy

LEANOX.AI
Effective Date: 15 September 2026

1. Who We Are and Scope of This Policy

This Privacy Policy explains how LEANOX.AI, (“we”, “us” “ours”), collects, uses, stores, shares, and protects personal data in connection with LEANOX.AI, including any beta, pilot, or early-access version of it (together, the "Service"). This Policy applies to visitors, registered users, and beta participants. It does not apply to third-party websites or services we merely link to.

2. What Personal Data We Collect

The personal data we collect depends on how you interact with the Service. This may include:

2.1 Data you provide directly

  • Account information: name, email address, company/organization, job title, password (stored hashed), display name, profile photo URL, an internal account identifier, your sign-in provider identifier, and your role and status.
  • Provider API credentials: the API keys you choose to store with us for Anthropic, OpenAI, Google, or xAI. They are encrypted at rest using envelope encryption with Google Cloud KMS, are never displayed back to you after you enter them, and are never written to our logs.
  • Communications: content of support requests, feedback, bug reports, or survey responses you send us.
  • Contact form messages: your name, email address, the reason you chose, your message, and your account ID if you are signed in.
  • Beta participation data: any information you submit through the Beta Service, including content you input for evaluation purposes.

2.2 Data collected automatically

  • Usage data: features used, actions taken, session duration, click and navigation patterns.
  • Diagnostic data Of users using our ui as well as user agent information that flow through the proxy crash reports, error logs, performance metrics, device and browser type, IP address, operating system.
  • Cookies and similar technologies: as described in Section 8 below.

Your IP address and browser user-agent are also recorded by our hosting platform's own request logs and kept for approximately 30 days. They are not included in the usage telemetry records described above. Our public playground can be used without signing in.

2.3 Sensitive information

We do not intentionally collect sensitive categories of personal data (e.g., health, biometric, racial or ethnic origin, religious beliefs) through the Service. If you submit such information voluntarily (for example, within free-text fields), you do so at your own discretion, and we will handle it under the same protections described in this Policy.

2.4 Data you must not send us

The Service is not designed or certified to receive special categories of personal data or regulated payment data. You must not submit protected health information, payment card data, or government identity numbers through the Service. We do not offer a HIPAA Business Associate Agreement and the Service is not PCI DSS certified. You are responsible for what you send through the Service, and for removing such data from your prompts before they reach us.

3. How and Why We Use Personal Data

We use personal data only for the following purposes, each with a corresponding legal basis where GDPR applies:

  • To provide and operate the Service — necessary to perform our contract with you (GDPR Art. 6(1)(b)).
  • To respond to support requests and communications — contract performance / legitimate interest.
  • For Beta Data specifically: Please refer to the Beta Terms of Service.
  • To maintain security, prevent fraud, and enforce our Terms — legitimate interest / legal obligation.
  • To comply with legal obligations, such as tax, accounting, or regulatory requirements.

We do not use personal data for automated decision-making or profiling that produces legal or similarly significant effects on you.

The gateway does make automated technical decisions — for example, whether to cache part of a prompt, based on observed patterns in your traffic. These decisions concern routing, caching and cost. They are not decisions about you as an individual and have no legal or similarly significant effect on you.

4. What We Do Not Do With Your Data

Consistent with our Beta Service Terms of Use, we commit that personal data and Beta Data will not be:

  • sold to any third party;
  • used for third-party advertising, ad targeting, or marketing purposes;
  • shared with any third party for that third party's own independent purposes; or
  • used for any purpose beyond providing the Service and Internal Improvement Purposes, without asking for your separate, explicit consent first.

5. Who We Share Data With

We do not sell personal data. We may disclose personal data only in the following limited circumstances:

  • Service providers / processors: vendors who host our infrastructure, provide analytics, or support our operations, bound by written data-processing agreements and permitted to use the data only to provide their service to us.
  • Legal requirements: where required to comply with a legal obligation, court order, or valid governmental request.
  • Business transfers: in connection with a merger, acquisition, or asset sale, subject to continued protection under this Policy or a policy offering equivalent protections.
  • With your consent: for any other purpose, only after you explicitly agree.

6. International Data Transfers

Our servers and service providers may be located in EU

7. Data Retention

We retain personal data only for as long as necessary to fulfill the purposes described in this Policy, including to provide the Service, comply with legal obligations, resolve disputes, and enforce our agreements.

8. Cookies and Similar Technologies

The Service uses cookies and similar technologies for authentication, essential functionality, and analytics.

We use Google's reCAPTCHA service in our contact form. The purpose of the reCAPTCHA request is to distinguish a human from automated, machine inputs. To this end, your input is transferred to Google and further processed there. The IP address and, if required, other data used by Google for the service is transferred to Google.

9. Your Rights

Depending on your location, you may have some or all of the following rights regarding your personal data:

  • Access — request a copy of the personal data we hold about you.
  • Rectification — request correction of inaccurate or incomplete data.
  • Erasure — request deletion of your personal data, subject to legal exceptions.
  • Restriction / objection — request that we limit or stop certain processing, including processing based on legitimate interest.
  • Portability — request your data in a structured, commonly used, machine-readable format.
  • Withdraw consent — where processing is based on consent, withdraw it at any time without affecting prior lawful processing.

California residents (CCPA/CPRA): the right to know what personal information is collected, the right to delete, the right to opt out of sale or sharing (we do not sell or share personal information as defined by CCPA), and the right to non-discrimination for exercising these rights.

Israeli residents: rights under the Privacy Protection Law, 5741-1981, Amendment 13. and its regulations, including the right to inspect and request correction of data held about you in a database.

To exercise any of these rights, contact us at info@leanox.ai. We will respond within the time required by applicable law. You also have the right to lodge a complaint with your local data protection authority.

10. Security

We implement technical and organizational measures designed to protect personal data against unauthorized access, alteration, disclosure, or destruction, including access controls, encryption in transit, and limiting data access to personnel with a legitimate need. As disclosed in our Beta Service Terms of Use, the Beta Service is provided on an "as is" / "as available" basis without any guarantee of uninterrupted or error-free operation; no security measure is perfect, and we cannot guarantee absolute security. We will notify affected users and relevant authorities of a data breach where and as required by applicable law.

11. Children's Privacy

The Service is not directed to, and we do not knowingly collect personal data from, individuals under the age of 18. If we become aware that we have collected personal data from a child without appropriate consent, we will delete it.

12. Beta Service Note

If you participate in the Beta Service, please also review our Beta Service Terms of Use, which govern data handling specifically within the beta context, including the commitment that Beta Data is used solely for Internal Improvement Purposes. Where the Beta Service Terms and this Privacy Policy address the same topic, this Privacy Policy governs as to personal data matters, and the Beta Service Terms govern as to service availability, warranties, and liability.

13. Changes to This Policy

We may update this Privacy Policy from time to time to reflect changes in our practices or for legal, operational, or regulatory reasons. We will update the "Effective Date" above and, for material changes, provide additional notice (such as an in-product notification or email) before the changes take effect.

14. Contact Us

Questions, requests, or complaints regarding this Privacy Policy or our data practices can be directed to: info@leanox.ai