Privacy Policy

Last updated: 2 October 2026

1. Who we are

Leverage Studio (“we”, “us”) is an online library of digital products, sold as an All-Access subscription. The person responsible for your personal data (the “data controller”) is Robert Halladjian, Norway. You can reach us at privacy@levstd.app (or support@levstd.app). This policy applies to levstd.app and our hosted apps. It should be read together with our Terms & Conditions.

2. What we collect

2.1 Data you give us

• Account: your name, email address and a password (stored only as a one-way hash — we cannot read it). If you sign in with Google we receive your Google account ID, name, email address and profile picture from Google; we never receive your Google password.
• Preferences: for example whether you want emails about new products.
• Reviews: if you post a product review, the name you show, your rating and what you write. Reviews are public once approved.
• Messages: anything you send us when you email support, including refund requests.

2.2 Subscription & payment data

• Your chosen plan, the status of your subscription (active, cancelled, past due, expired), its renewal date and your PayPal subscription reference, so we know whether to give you access.
• Payments are processed by PayPal. PayPal collects your payment details under its own privacy policy; we receive confirmation of payment, the transaction/subscription ID and the payer ID — not your card or bank details.
• If you bought individual products in the past, we keep those order records (product, amount, date, PayPal references, the email used) — see Terms, section 11.

2.3 Data created when you use the site

• Library & app use: which products are in your library, and — for hosted PWA apps — the private space created for you and the time you last launched an app. Your personal access link contains a random token that identifies your space.
• Visit statistics: we record anonymous page visits — the page and product viewed, the referring site, your browser's user-agent string and a one-way hash of your IP address (not the address itself) — so we can count visits and see which products interest people.
• Optional Google Analytics: if analytics is switched on, Google Analytics 4 collects usage data (pages viewed, approximate location, device and browser) through cookies. See section 5.
• Technical logs: our hosting provider's servers log requests (IP address, time, URL, browser) for security and troubleshooting.

3. How we use it & why

Where the GDPR / UK GDPR applies, we rely on the legal bases below.

We don't use your data for automated decisions that significantly affect you, and we don't sell or rent it.

4. Who we share it with

Only with service providers that help us run the site, under their own privacy commitments:

• PayPal — payments and subscription billing.
• Google — “Sign in with Google” (if you choose it), Google Fonts (your browser loads fonts from Google's servers, which sees your IP address), and Google Analytics 4 if enabled.
• Hosting and email providers — our web host stores the site and database; our email service delivers the emails we send you.
• Authorities and advisers — if the law requires it, or to protect our rights, and our accountants or legal advisers where needed.
• A buyer — if the business were ever sold, your data could move to the new owner, who would have to honour this policy.

Your public reviews (name, rating, text) are visible to everyone who visits the product page.

5. Cookies & browser storage

We don't use advertising cookies. The site stores a few things in your browser so it works the way you expect:

• Essential: your sign-in token and cached profile (so you stay logged in), and a short-lived cache of site settings.
• Preferences: your language and light/dark theme.
• Features: for example, which skills you have ticked on the Dev Roadmap — this stays on your device and is never sent to us.
• Analytics (optional): if Google Analytics is enabled it sets cookies such as _ga to tell visits apart. You can block them in your browser settings or with Google's opt-out add-on, and the site will keep working.

You can clear this data at any time in your browser settings; you will simply be signed out and your preferences reset.

6. Emails

• Service emails (verification, welcome, subscription renewal reminders, refunds) are part of running your account and continue while you have an account or subscription.
• New-product emails are sent only if you opted in. Every one has an unsubscribe link, and you can also switch them off in your account. Unsubscribing never affects your access.

7. How long we keep it

• Account and library data: for as long as you have an account. If you ask us to delete your account we remove it, except what we must keep by law.
• Payment and order records: kept for as long as accounting and tax rules require (typically several years).
• Verification tokens: expire automatically (within 48 hours).
• Visit statistics: kept in anonymised/hashed form for as long as they are useful for understanding the site.
• Server logs: kept by our host for a short period for security.

8. Security

The site is served over HTTPS, passwords are hashed, files are served only to people with the right access, and access to our systems is restricted. No system is perfectly secure, so please use a strong, unique password. If a breach affects your personal data we will tell you and the authorities where the law requires it.

9. Your rights & choices

Depending on where you live (including the EU, UK and many other places) you can ask us to:

• access the personal data we hold about you and get a copy (and export it in a common format);
• correct data that is wrong;
• delete your data or close your account;
• restrict or object to certain uses, including processing based on our legitimate interests;
• withdraw consent at any time for things based on consent, such as new-product emails or analytics.

To use these rights, email privacy@levstd.app from the address on your account. We reply within one month. We may need to confirm it's you first. Cancelling a PayPal subscription is done in PayPal or on your account page (Terms, section 5); deleting your account does not cancel it by itself.

If you are in the EU or UK you also have the right to complain to your local data-protection authority. We'd appreciate the chance to put things right first.

California and similar laws: we don't sell or share your personal information for cross-context advertising, so there is nothing to opt out of; you can still ask to know, correct or delete your data as above.

10. International transfers

Our providers (such as PayPal, Google and our host) may process data in countries outside your own, including outside the EU/UK. Where that happens we rely on safeguards such as the European Commission's Standard Contractual Clauses or an adequacy decision, as applicable.

11. Children

Leverage Studio is not for children under 16 (or the age of digital consent where you live), and subscriptions are for adults. We don't knowingly collect data from children. If you think a child has given us their data, email us and we'll delete it.

12. Changes

We may update this policy as the site or the law changes. The date at the top shows the latest version. If a change is significant we'll tell you on the site or by email.

13. Contact

Privacy questions or requests:
privacy@levstd.app — we aim to reply within 3 business days (and always within one month).