Privacy policy

The short version

• We collect what we need to reply to you, run this website and provide Leva to the businesses that use it.
• Drawings, project data, catalogs and prices that customers upload belong to them. We use them to provide the service to that customer. Catalogs and prices are confidential and never pooled across suppliers.
• Leva and its database are hosted in Sydney, Australia. To read drawings and prepare takeoffs, Leva sends drawings and instructions to OpenAI, which processes them in the United States as our service provider. Training on our data is switched off, so OpenAI doesn’t use it to train its models.
• Analytics and advertising cookies are optional. In the EU, EEA, UK and Switzerland they stay off until you accept. Anyone can change their choice in Cookie settings, and we honor Global Privacy Control.
• We don’t sell personal information for money. Some advertising cookies may count as “sharing” under US state laws, and you can opt out.
• We follow the Australian Privacy Principles voluntarily. You can ask to access or correct your personal information at any time, and we handle privacy complaints ourselves first.

Who we are

Leva is a product of Leva Solutions Pty Ltd (ABN 80 692 829 299), an Australian private company based in Sydney NSW 2000, Australia.

We are responsible for the personal information we hold, including personal information in content that customers upload to Leva. In GDPR terms, we are the controller for this website, Leva accounts and our own sales and marketing, and we act on the customer’s behalf, as their service provider or processor, for content they upload (see Customer content, catalogs and pricing).

Questions about privacy go to hello@runleva.com.

What we collect

When you contact us or book a call

Your name, work email, company, role and anything you write to us. If you book a call on our booking page, the booking form is provided by Cal.com, our scheduling provider. It collects your name, email, the time you pick and your answers to a few questions (such as your company, role, the trades you supply, your region and your typical monthly quote volume), and adds the meeting to our calendar.

When you visit this website

Pages viewed, how you arrived (for example, the referring site or ad), clicks on “Try 3 free takeoffs” and “Book a call”, video plays, how far you scroll, your device and browser type, language and an approximate location derived from your IP address. Our own site code records these events, and the analytics and advertising tools listed in our cookie policy collect them where your choices allow.

The website itself has no accounts; Leva accounts are at app.runleva.com. The website picks the Australian or US version of its videos from your device’s time zone, without a cookie.

When you sign up for Leva

To sign up you give your work email, your company’s name and the trade you supply (or that you only need takeoffs), and your name if you choose to. You can upload drawings at the same time. We record the IP address and browser the sign-up came from, to limit sign-ups and prevent misuse of the free takeoffs, and we email you a code or link to confirm your address before any takeoff starts.

When your business uses Leva

• Account information: names, work emails, roles and sign-in details of the people who sign up or are invited to your business’s account.
• Customer content: drawings, plans, specifications and project details, the instructions and answers you give Leva, and the takeoffs and quotes produced from them. These can include personal information about other people, such as a contractor’s contact details or a project address. When a supplier sends a quote from Leva, we also hold the email address it went to.
• Catalog and pricing data: the products, prices and customer-specific rates a supplier loads into Leva.
• Usage and technical data: records of sign-ins, takeoffs, actions and errors, IP addresses and device information, used to run, secure and support the service.

From other sources

Business contact details from a colleague who introduces you, from events or from public professional profiles, and aggregated campaign reports from advertising platforms.

We don’t ask for sensitive information, such as health information or racial or ethnic origin. Please leave it out of uploads and messages.

If you don’t give us the information we ask for, we may not be able to reply to you, set up an account or run takeoffs.

How we use it

• To reply to you, and to arrange and run pilots.
• To set up accounts, confirm sign-ups and keep track of free takeoffs.
• To provide the product: reading drawings and preparing takeoffs for the customer’s team to check.
• To send service emails, such as sign-up codes, team invitations, password resets and the quotes a supplier asks us to send.
• To support, secure and fix the service, and to prevent misuse.
• To understand how the website and product are used, and to improve them.
• To measure our advertising and show our ads to people who have visited this website, where your choices allow.
• To send occasional product and company news to business contacts. Every email has an unsubscribe link.
• To meet legal obligations and enforce our agreements.

We use and disclose personal information only for these purposes, for related purposes you would reasonably expect, or as the law allows.

Customer content, catalogs and pricing

Content a customer uploads, and the results Leva produces from it, belong to that customer. We use it only to provide, support and secure the service for that customer, as our terms (or a signed agreement with that customer) set out, or as the law requires.

Supplier catalogs, prices and customer-specific rates are confidential. We never share one supplier’s catalog or pricing with another supplier, never pool or combine pricing across suppliers, and never use it to benchmark, suggest or set anyone else’s prices. Within our team, only people who need access to provide or support the service have it, and they are bound by confidentiality.

Leva’s results are prepared for the customer’s own team to check before a quote is released. We don’t use customer content to make decisions that have legal or similarly significant effects on individuals.

If your details appear in a customer’s content (for example, you are one of their contractors), you can contact that customer, or us at hello@runleva.com, to use your privacy rights. We will work with the customer to respond.

Leva in ChatGPT and other assistants

Connecting Leva lets the assistant access jobs, drawings, measurement preferences, quantities and takeoff questions in the Leva account you choose, within your existing permissions. Your requests and attached drawings are sent to Leva to create jobs, run takeoffs or update their scope. Leva returns the requested results, question details and drawing evidence to the assistant.

You can disconnect at Leva’s connections page. Disconnecting stops the connection’s access; it does not delete drawings or results already saved in Leva or messages already in your assistant. Leva retains saved content as described below. For access or deletion requests, email hello@runleva.com. The assistant provider’s terms and privacy policy govern content in its own service.

AI processing and service providers

Leva uses OpenAI’s API to read drawings and prepare takeoffs. During a takeoff, Leva sends the drawings, your instructions and the job’s scope to OpenAI, which processes them in a temporary workspace on its servers in the United States. OpenAI acts as our service provider (processor): it processes this content on our instructions, under contract, to provide the service to us. Leva ends the workspace when a takeoff finishes or is stopped.

Training on our data is switched off in Leva’s OpenAI project, so OpenAI doesn’t use the content we send to train or improve its models. OpenAI keeps that content only as its API data policies allow, which can include keeping it for a limited time to monitor for abuse. If this changes in a way that matters to you, we will update this policy.

We don’t use one customer’s content to train models that serve other customers unless that customer agrees.

Other service providers help us run Leva and this website:

• Fly.io hosts the Leva app, its database and uploaded drawings in Sydney, Australia.
• Resend sends Leva’s emails, such as sign-up codes, invitations, password resets and quotes.
• Sentry receives error reports, so we can find and fix faults. Reports never include request bodies, which carry drawings and prices. They can include the page address, IP address, browser details and recent actions on the page, which can include text you typed.
• Cal.com handles call bookings.
• Google provides our business email (Google Workspace) and the analytics on this website.
• The analytics and advertising tools in our cookie policy.

Each gets only what it needs for its task and must protect it.

Cookies, pixels and similar technologies

We keep a small first-party record of your cookie choices. Where your choices allow, we also use Google Analytics 4 (analytics), Google Ads (ad measurement and remarketing), the LinkedIn Insight Tag and the Meta Pixel (ad measurement and retargeting), loaded through Google Tag Manager. Our cookie policy lists each one, what it does and how long it lasts.

• EU, EEA, UK and Switzerland: analytics and advertising stay off until you accept them.
• Elsewhere, including the US and Australia: they are on by default, and you can switch them off at any time.
• Global Privacy Control: if your browser sends a GPC signal, we treat it as an opt-out of advertising cookies and of the sale or sharing of your personal information.

Who we share it with

• Service providers, as described above, under contract, including OpenAI for takeoffs, Resend for email, Sentry for error reports and Cal.com for bookings.
• Advertising platforms (Google, LinkedIn and Meta), through their tags on this website, where your choices allow.
• Your own organization: content in a customer’s Leva workspace is visible to that customer’s authorized users.
• People a supplier sends quotes to: when a supplier sends a quote from Leva, the quote and its takeoff report go to the email address the supplier enters.
• Assistants you connect: when you connect Leva to ChatGPT or another assistant, Leva returns the results you ask for to that assistant.
• Professional advisers, such as lawyers, accountants and auditors, under confidentiality.
• Authorities, where the law requires it or to protect rights, property or safety.
• A buyer or successor, if we are involved in a merger, acquisition or sale of assets, on the terms of this policy.

Your choices and rights

Wherever you are, you can ask to access, correct or delete the personal information we hold about you, and opt out of marketing emails and ad tracking:

• Cookie settings: switch analytics and advertising on or off.
• Do not sell or share my personal information: switch advertising off.
• Global Privacy Control: we honor it automatically.
• Anything else: email hello@runleva.com. We don’t charge for reasonable requests.

We verify requests by matching details we already hold. Where the information is in a customer’s content, we work with that customer to respond.

Australia: access, correction and complaints

Small businesses like ours are generally exempt from the Privacy Act 1988 (Cth). We follow the Australian Privacy Principles voluntarily, which means:

• Access. You can ask for the personal information we hold about you. We will respond within 30 days and won’t charge you for asking. If we refuse, we will tell you why in writing and how to complain.
• Correction. If information we hold about you is inaccurate, out of date, incomplete, irrelevant or misleading, ask us to correct it. We will respond within 30 days. If we don’t agree to correct it, we will tell you why, and you can ask us to keep a statement with the information saying you believe it is wrong.
• Anonymity. You can deal with us anonymously or under a pseudonym where that is practical, for example when asking a general question. A Leva account needs a work email and a company name.
• Marketing. You can opt out of marketing emails at any time.
• Overseas disclosure. Some of our service providers are overseas, mainly in the United States. See Where your information is stored.
• Data breaches. If a data breach is likely to cause you serious harm, we will tell you promptly and explain what you can do, following the approach of the Notifiable Data Breaches scheme.
• Complaints. See Contact and complaints.

US state privacy rights, including California

If you live in California or another US state with a consumer privacy law (such as Colorado, Connecticut, Oregon, Texas, Utah or Virginia), you may have the right to:

• know what personal information we collect, use and disclose, and get a copy;
• correct inaccurate information;
• delete information we hold about you;
• opt out of the “sale” or “sharing” of your personal information and of targeted (cross-context behavioral) advertising;
• appeal if we decline your request, where your state provides for it; and
• not be treated differently for using these rights.

Sale and sharing. We don’t sell personal information for money. When advertising cookies from Google, LinkedIn or Meta are active on this website, that can count as “selling” or “sharing” personal information for targeted advertising under some state laws. To opt out, use Do not sell or share my personal information or turn on Global Privacy Control in your browser. We don’t knowingly sell or share the personal information of anyone under 16, and we don’t use sensitive personal information in ways that would require offering a right to limit it.

What we collect and why.

Making a request. Email hello@runleva.com with “Privacy request” in the subject. We will reply within 45 days, or tell you if we need up to 45 more where the law allows. You can use an authorized agent; we may ask for proof that they act for you.

EU, EEA, UK and Switzerland

If the GDPR, the UK GDPR or Swiss data protection law applies to you:

• Legal bases. We rely on your consent for analytics and advertising cookies; on contract to provide Leva to customers and their users; and on our legitimate interests for business contact, security and improving this website and the service. We process customer content as a processor, on the customer’s instructions.
• Your rights. Access, correction, deletion, restriction, portability and objection (including to direct marketing, at any time), and withdrawing consent, which doesn’t affect processing before you withdraw it.
• Complaints. You can complain to your local data protection authority, for example the ICO in the UK.

Where your information is stored

Leva’s app, its database and uploaded drawings are hosted by Fly.io in Sydney, Australia. We disclose personal information to these service providers outside Australia:

• OpenAI (United States): drawings, instructions and project text for takeoffs.
• Sentry (United States): error reports.
• Resend (United States): email addresses and the emails Leva sends.
• Cal.com (United States): call bookings.
• Google, LinkedIn and Meta (the United States and other countries): website analytics and advertising, where your choices allow; Google also for our email.

Before we disclose personal information overseas, we take reasonable steps, including contract terms with our providers, so that it is handled consistently with the Australian Privacy Principles, and we remain responsible to you for how they handle it. For information from the EU, EEA, UK or Switzerland, we rely on an adequacy decision, the European Commission’s standard contractual clauses (with the UK addendum) or another lawful transfer mechanism.

Security

We protect information with encryption in transit, role-based access controls, logging and separation of each customer’s data, enforced in the database. Connection tokens and quote links are stored only in hashed form. Only people who need access to customer content have it. No system is perfectly secure; if you think something has gone wrong, email hello@runleva.com straight away.

How long we keep it

• Emails and enquiries: up to 2 years after our last contact, unless you become a customer.
• Website analytics: Google Analytics data for 14 months. Advertising platforms keep data under their own policies; cookie lifetimes are in our cookie policy.
• Your cookie choice: 12 months, then it expires.
• Leva accounts: an account’s content, catalogs, pricing, sign-up details and usage records are kept while the account is open, or as a signed agreement with the customer sets out. We close an account when its owner asks (email hello@runleva.com), and we delete the account’s data within 90 days of it closing. Copies in backups age out on their normal cycle after that.
• Takeoff workspaces at OpenAI: ended when a takeoff finishes or is stopped; OpenAI keeps content only as its API data policies allow, as described above.
• Quote links: a link in a quote email stops working after 90 days.

We keep information longer only where the law requires it or to resolve a dispute.

Children

Leva and this website are for businesses. They are not directed at children, and we don’t knowingly collect personal information from anyone under 16. If you think we have, contact us and we will delete it.

Changes to this policy

We will post any change on this page and update the date at the top. If a change is significant, we will tell customers by email or in the product before it takes effect.

Contact and complaints

Leva Solutions Pty Ltd
ABN 80 692 829 299
Sydney NSW 2000, Australia
hello@runleva.com

If you have a concern or complaint about how we handle personal information, please email us with the details. We handle complaints ourselves first, and we will respond within 30 days. If you are in Australia and not satisfied with our response, you can contact the Office of the Australian Information Commissioner at oaic.gov.au or on 1300 363 992 to find out what it can help with. Because small businesses are generally exempt from the Privacy Act, the OAIC may not be able to handle a complaint about us. In the EU, EEA, UK or Switzerland you can contact your local data protection authority. In the US you can contact your state attorney general, and California residents can also contact the California Privacy Protection Agency at cppa.ca.gov.