Privacy Policy

Leva is provided by Orbixa Technologies Ltd (“we”, “us”, “Leva”), a company registered in England and Wales.

Registered office: 22 - 28 Willow Street, Accrington, Lancashire, BB5 1LP
Company number: 16519488
ICO registration: ZC054842
Privacy contact: use the privacy request form below, or email us: Show email address

We process personal data under the UK General Data Protection Regulation (UK GDPR) and the Data Protection Act 2018. Our supervisory authority is the Information Commissioner's Office (ICO). Where we process the personal data of people in the European Union, the EU General Data Protection Regulation (EU GDPR) also applies.

We are the controller for personal data about visitors to our website and about Leva account holders: the founders and team members who use Leva, and the billing contacts for their accounts.

Our customers are the controllersfor personal data they upload to Leva or collect through it, such as their contacts, prospects, email recipients and the people who submit forms on landing pages they publish. For that data we act as a processor on our customer's instructions, under our data processing agreement with them. If your data reached Leva that way, please contact the business that collected it; we will help them respond to your request.

• Account data: name, email address, and a password hash (never stored in plaintext)
• Business data: company information, goals, strategies, brand guidelines and founder profile data you provide
• Visual assets: logos, images and brand materials you upload, which may be processed by AI to understand your brand
• Integration data: access tokens for the tools you connect, stored encrypted and used only to act on your behalf
• AI output feedback: reactions and optional comments you give on outputs
• Connected-tool actions: when Leva acts in a tool you have connected (for example sending an email or updating your CRM), the action, its timing and its cost are logged for billing and audit
• Usage data: agent runs, task outcomes, feature usage and performance metrics
• Payment data: handled by our payment provider; we do not store card numbers or security codes
• Support data: messages you send to us, including privacy requests

We rely on the following lawful bases under the UK GDPR:

• Contract: providing, maintaining and improving the Leva service
• Legitimate interests: security, fraud prevention and service improvement
• Consent: marketing communications and non-essential analytics (you may withdraw it at any time)
• Legal obligation: complying with the law, for example keeping financial records

We use AI models from third-party providers to generate outputs; Leva does not train or fine-tune AI models, and your feedback improves outputs within your own workspace.

We share personal data only with service providers that help us deliver Leva, each bound by a written data processing agreement. We do not sell your data. The categories are:

Customers can view our current sub-processors in their account settings or request the list from us. See also our Sub-Processors page.

Tools you connect: when you connect your own accounts with other platforms, those platforms process your data under their own privacy policies. You choose which tools are connected and can disconnect them at any time.

Some of our service providers process data outside the UK. When personal data leaves the UK we rely on UK adequacy regulations, the UK Extension to the EU-US Data Privacy Framework where the provider is certified, the UK International Data Transfer Agreement, or the UK Addendum to the EU Standard Contractual Clauses. For data subject to the EU GDPR we rely on the EU Standard Contractual Clauses or an EU adequacy decision.

Under data protection law you have the right to:

• Access: request a copy of the personal data we hold about you
• Rectification: ask us to correct inaccurate data
• Erasure: ask us to delete your data
• Restriction: ask us to limit how we use your data
• Portability: receive your data in a machine-readable format
• Objection: object to processing based on legitimate interests
• Withdraw consent: for any processing based on consent (for example marketing or analytics cookies)

We normally reply within one month. You can also complain to the ICO at ico.org.uk.

We protect your data with encryption in transit and at rest, role-based access controls and audit logging. Credentials such as access tokens are stored in an encrypted secrets vault. No method of transmission or storage is completely secure, so we cannot guarantee absolute security.

We use the following categories of cookies and similar technologies:

• Essential cookies: required for sign-in, session management and security. These cannot be disabled without breaking core functionality.
• Analytics (non-essential): anonymised usage and performance measurement, loaded only with your consent, managed through the cookie banner or our Cookie Policy.

We do not use advertising, retargeting or behavioural tracking cookies. You can withdraw consent at any time from the Cookie Policy page.

We will tell account holders about material changes to this policy by email at least 30 days before they take effect. The date at the top of this page shows when it was last revised.