Legal
Privacy Policy
Effective date: March 26, 2026 · Last updated: March 26, 2026
At Latifúndios ("we", "us", or "our"), we take your privacy seriously. This Privacy Policy explains how we collect, use, disclose, and protect your personal data when you use the Levly.ai service ("Service"), in compliance with the General Data Protection Regulation (GDPR) and applicable Portuguese law.
1. Data Controller
The data controller responsible for your personal data is:
Latifúndios
Portugal
laticlaw@latifundios.pt
2. Data We Collect
We collect only what we need to provide and improve the Service. This includes:
Account data
Your email address, chosen display name, and encrypted password when you create an account.
Conversation data
Messages you send to Lev (our AI assistant) and the responses generated. This data is used to provide the core functionality of the Service.
Skill & goal tracking data
Skills, goals, events, progress entries, and XP records you create within the Service.
Usage data
Log data such as your IP address, browser type, pages visited, timestamps, and interactions with the Service. Collected automatically for security and analytics purposes.
Payment data
We do not store your full payment details. Payment processing is handled by our third-party payment provider and subject to their privacy policy.
3. How We Use Your Data
We use your personal data for the following purposes and legal bases:
- Providing the Service (performance of contract): processing your messages, storing your goals and skills, generating AI responses.
- Account management (performance of contract): creating and managing your account, authenticating you, sending account-related emails.
- Service improvement (legitimate interest): analysing usage patterns to improve the product, fixing bugs, developing new features.
- Legal compliance (legal obligation): retaining certain records as required by law, responding to lawful requests.
- Communications (consent or legitimate interest): sending product updates, newsletters, and feature announcements. You can unsubscribe at any time.
4. Third-Party AI Processing (OpenAI)
The AI functionality in Levly.ai is powered by OpenAI (OpenAI, L.L.C., based in the United States). When you send a message to Lev, your message content is transmitted to OpenAI's API to generate a response.
This constitutes a transfer of personal data to a third country (USA). We rely on appropriate safeguards (OpenAI's Data Processing Agreement and Standard Contractual Clauses) for such transfers in accordance with GDPR Article 46.
OpenAI's use of your data via the API is governed by OpenAI's API data usage policies, which specify that API data is not used to train their models by default. You can review OpenAI's privacy practices at openai.com/privacy.
5. Data Sharing
We do not sell your personal data. We share data only in the following limited circumstances:
- Service providers: Third parties who assist us in operating the Service (e.g., cloud hosting, payment processing, email delivery) under strict data processing agreements.
- OpenAI: As described in Section 4 above.
- Legal requirements: When required by law, court order, or government authority.
- Business transfers: In connection with a merger, acquisition, or sale of assets, with appropriate notice to you.
6. Data Retention
We retain your personal data for as long as your account is active or as needed to provide you with the Service.
- Account data and tracking data is kept while your account is active.
- Upon account deletion, we will delete your personal data within 30 days, unless retention is required by law.
- Anonymised, aggregated usage statistics may be retained indefinitely as they do not identify you.
7. Your Rights (GDPR)
As a data subject under the GDPR, you have the following rights:
Right of Access
Request a copy of the personal data we hold about you.
Right to Rectification
Request correction of inaccurate or incomplete data.
Right to Erasure
Request deletion of your personal data ('right to be forgotten').
Right to Portability
Receive your data in a structured, machine-readable format.
Right to Restrict Processing
Request that we limit how we use your data in certain circumstances.
Right to Object
Object to processing based on legitimate interest.
Right to Withdraw Consent
Where processing is based on consent, withdraw it at any time.
Right to Lodge a Complaint
File a complaint with the Portuguese Data Protection Authority (CNPD) at cnpd.pt.
To exercise any of these rights, contact us at laticlaw@latifundios.pt. We will respond within 30 days.
8. Cookies & Tracking
We use essential cookies to maintain your session and authentication state. We do not use third-party advertising cookies. You can control cookies through your browser settings, but disabling essential cookies may affect Service functionality.
9. Security
We implement industry-standard security measures including HTTPS encryption, hashed passwords, and access controls to protect your personal data. However, no system is completely secure. In the event of a data breach that poses a risk to your rights, we will notify you and the relevant supervisory authority as required by GDPR.
10. Children's Privacy
The Service is not directed to children under 13. We do not knowingly collect personal data from children under 13. If you believe a child has provided us with personal data, please contact us and we will delete it promptly.
11. Changes to This Policy
We may update this Privacy Policy from time to time. We will notify you of material changes via email or a prominent in-app notice at least 14 days before the changes take effect. Your continued use of the Service after the effective date constitutes acceptance of the updated policy.
12. Contact Us
For any privacy-related questions, requests, or concerns:
Latifúndios
Portugal
laticlaw@latifundios.pt