Legal

Privacy Policy

levat8labs, Inc. · Last updated: July 2026

CONTENTS

At levat8labs, Inc. ("levat8labs," "we," "us," or "our"), we are committed to protecting the privacy and security of the personal data entrusted to us. This Privacy Policy (this "Policy") explains how we collect, use, process, store and share your personal data, and outlines your rights regarding that data. It applies to personal data we collect from visitors to our website, from our clients and their authorized users, from prospective clients, and from other individuals who interact with us in connection with our products and services, including the levat8labs platform (the "Services"). Jurisdiction-specific notices for the United States, Australia and Europe appear in the sections below.

1. Scope and our role

levat8labs is a Delaware corporation that operates as an AI-first technology incubation lab, developing artificial intelligence, analytics and communications solutions for business customers across industries, including the levat8labs platform. This Policy governs personal data for which levat8labs determines the purposes and means of processing, such as data collected through our website, our marketing activities, and our administration of client relationships.

In many cases, we process personal data on behalf of our clients, for example guest or caller data handled through the levat8labs platform in connection with a hotel’s reservation or guest-services operations. Where we process personal data on behalf of a client, that client is the controller of the data and levat8labs acts as a service provider or processor. Our processing of that data is governed by the applicable services agreement and data processing agreement between levat8labs and the client. If you are an end user and have questions about how your personal data is handled by a business that uses the Services, you should direct your request to that business.

2. Personal data we collect

We collect various types of personal data to provide the Services and operate our business effectively. The specific data we collect depends on your interactions with us, the Services you use, and the choices you make. This may include, but is not limited to:

Contact information: such as your name, email address, postal address and telephone number.

Account information: such as usernames, passwords and other credentials used to access the Services.

Payment information: where applicable, the details required to process payments, such as billing address. levat8labs does not store highly sensitive information such as full payment card numbers or social security numbers.

Service usage data: information about how you use the Services, including features used, time spent and interactions.

Technical data: such as IP addresses, device information, browser type and operating system.

Communication and voice data: information from your communications with us, such as inquiries and support requests, and, where you interact with the levat8labs platform, call audio, transcripts and related metadata.

Cookies and similar technologies: cookies are small text files placed on your device to store data that can be recalled by a web server in the domain that placed the cookie. We use cookies and similar technologies for storing and honoring your preferences and settings, enabling sign-in, combating fraud, analyzing how our products perform, and fulfilling other legitimate purposes.

3. How we use your personal data

We use your personal data for operational purposes, as well as for analysis, control and strategic decision-making. Specifically, we use your data to:

provide, operate and maintain the Services;

process transactions and send you related information;

communicate with you about the Services, updates and offers;

improve and personalize the Services, including developing new features;

analyze usage trends and measure the effectiveness of the Services;

ensure the security and integrity of our systems and data;

comply with legal obligations and enforce our terms and policies.

Our processing of personal data for these purposes includes both automated and manual (human) methods of processing. Our automated methods are often related to and supported by our manual methods. For example, to build, train and improve the accuracy of the levat8labs platform and our other automated methods of processing, including artificial intelligence, we may manually review a sample of the output produced by those automated methods against the underlying data.

As part of our efforts to improve and develop our products, we may use your data to develop and train our AI models. We do not use personal data that we process on behalf of a client to develop or train our AI models except to the extent permitted by the applicable client agreement or data processing agreement.

4. How we store, process and share your personal data

Data storage

levat8labs does not store or back up highly sensitive information such as full payment card numbers or social security numbers;

sensitive data is encrypted at rest to help ensure its protection;

no company data, and in particular no sensitive data, is stored on personal employee devices or on removable media;

backups are stored in encrypted form for a defined retention period and in accordance with recognized industry standards; and

before any server is decommissioned, we verify that no sensitive data remains stored on it.

Personal data collected by levat8labs is primarily stored and processed in the United States. Depending on the Services used and the location of our clients and service providers, personal data may also be stored or processed in other countries, including Australia, the European Economic Area and the United Kingdom. We handle cross-border transfers in accordance with applicable law, as further described in the jurisdiction-specific sections below.

Data retention

We retain personal data only for as long as is reasonably necessary for the purposes for which it was collected, or as required by law. The table below summarizes our general retention approach. Where we process personal data on behalf of a client, retention is governed by the applicable client agreement.

Category of data	Purpose of retention	Typical period	Basis for retention
Account data (name, contact information, login)	To provide ongoing service, manage your account, facilitate login and maintain service continuity.	5 years	Contractual obligation; customer relationship management; fraud prevention.
Service and usage data (product use, activity logs)	To improve functionality, troubleshoot issues, analyze performance, ensure security and personalize the experience.	5 years	Product development; security auditing; performance analysis.
Communication records (support email, chat, call records)	To provide customer support, track inquiries, improve service quality and maintain a record of interactions.	5 years	Customer service best practice; dispute resolution.
Compliance and legal records (privacy acknowledgments, data subject requests)	To demonstrate compliance with privacy laws, manage legal obligations and handle potential claims.	5 years after creation or request closure, or as required by law	Legal compliance; record-keeping obligations; statute of limitations.

Data processing

Data is primarily processed for the purposes outlined in Section 3. We identify and define the types of data necessary to support our products or services, as well as data considered key for collection, storage, analysis and reporting.

Data sharing

levat8labs does not collect data for the purpose of selling or sharing it with third parties for their independent use without your explicit consent. Please see the U.S. State Data Privacy Laws Notice below for more information. We may share your data as follows:

Service providers: with trusted third-party service providers, either pursuant to our agreement with you or to enable them to perform services on our behalf, such as hosting, analytics, payment processing and customer support. Such sharing is subject to strict confidentiality obligations and is limited to the purposes described in this Policy.

Clients: with the client on whose behalf we process the relevant personal data, in accordance with the applicable services agreement and data processing agreement.

Legal and compliance: when required by law or to respond to valid legal process, to protect our rights or property, or to ensure the safety of our users or the public.

Business transfers: in connection with a merger, acquisition, financing, reorganization or sale of assets, in which case personal data may be transferred as part of that transaction, subject to the commitments in this Policy.

No mobile opt-in consent, and no data associated with a mobile opt-in, shall be shared with third parties for their marketing purposes.

5. Your rights to access, alter and remove your personal data

We respect your privacy rights and provide you with mechanisms to control your personal data. Subject to applicable law, you have the right to:

Access your data: request a copy of the personal data we hold about you.

Alter or correct your data: request that we correct any inaccurate or incomplete personal data.

Remove your data: request the deletion of your personal data under certain circumstances. No sensitive data shall be removed from an approved secure location without the prior approval of the data owner, the appropriate area of the business, or legal counsel. Where an individual requires sensitive information to be removed, that information shall be protected at all times from inappropriate disclosure.

Object to processing: object to the processing of your personal data for certain purposes.

Data portability: request to receive your personal data in a structured, commonly used and machine-readable format.

Withdraw consent: where we rely on your consent to process your personal data, withdraw that consent at any time, without affecting the lawfulness of processing carried out before the withdrawal.

levat8labs also identifies and removes duplicate data that may be prone to unauthorized access, in order to further protect your information. To exercise any of these rights, please contact us using the details in Section 11. We may need to verify your identity before fulfilling your request. Residents of the United States, Australia and Europe have additional rights, which are described in the jurisdiction-specific sections below.

6. Data security

We implement robust technical and organizational measures to protect your personal data from unauthorized access, use, disclosure, alteration or destruction. These measures include, for example, encryption at rest and in transit, access controls and regular security audits. Notwithstanding these measures, no method of transmission over the internet and no method of electronic storage is completely secure, and we therefore cannot guarantee the absolute security of personal data.

7. Cookies and tracking technologies

Our website may use cookies and similar technologies to operate the site, remember your preferences, understand how the site is used and improve your experience. Most web browsers are set to accept cookies by default. If you prefer, you may adjust your browser settings to delete or reject cookies. If you choose to delete or reject cookies, certain features of our website may not function properly. Where required by law, we shall obtain your consent before placing non-essential cookies.

8. Children’s privacy

The Services are intended for businesses and are not directed to children. We do not knowingly collect personal data from children. If you believe that a child has provided us with personal data, please contact us at privacy@levat8labs.com, and we shall take reasonable steps to delete the information in accordance with applicable law.

9. Third-party links and services

Our website and the Services may contain links to third-party websites or services that are not operated or controlled by levat8labs. This Policy does not apply to those third parties, and we are not responsible for their privacy practices. We encourage you to review the privacy policies of any third party before providing your personal data to it.

10. Changes to this Privacy Policy

We update this Policy from time to time to provide greater transparency, in response to feedback from customers, regulators, industry or other stakeholders, or in response to changes in our products or our data processing activities and policies. When we make changes, we shall revise the "Last updated" date at the top of this Policy and post the revised Policy on our website. Where required by law, we shall provide additional notice of material changes. We encourage you to periodically review this Policy to learn how levat8labs is protecting your information.

In the event of a conflict between this Policy and the terms of any agreement between a customer and levat8labs for the Services or products, the terms of that agreement shall control.

11. How to contact us

If you have any questions, concerns or requests regarding this Policy or our data practices, please contact us at:

levat8labs, Inc.

8 The Green, Suite 12066
Dover, DE 19901, United States

Email: privacy@levat8labs.com

U.S. state data privacy laws notice

Last updated: July 2026

Overview

Beginning in 2020, the California Consumer Privacy Act (the "CCPA") gave residents of California new rights over their personal information. California has since amended that law, and other states have enacted comparable laws. As a result, more people across the United States now have stronger privacy rights. This notice explains our commitments under these state laws and supplements the main Policy above. Please note that implementing rules under some of these laws have not yet been finalized; we shall update our processes, disclosures and this notice as those rules are finalized and as otherwise necessary. This notice addresses two commitments: transparency and control.

What personal information we collect and use

You have the right to know what kinds of personal information levat8labs collects, how we obtain and use that information, and our business purposes for that collection. The table below outlines the categories of personal information we collect, the sources, our purposes of processing and the categories of recipients.

Category	Sources	Purposes of processing	Recipients
Name and contact data	Interactions with users and partners.	Provide the Services; respond to customer questions; help, secure and troubleshoot.	Service providers and user-directed entities.
Credentials	Interactions with users and organizations that represent users.	Provide the Services; authentication and account access; help, secure and troubleshoot.	Service providers and user-directed entities.
Payment data	Interactions with users and financial institutions.	Transact commerce; process transactions; fulfill orders; detect and prevent fraud.	Service providers and user-directed entities.
Subscription and licensing data	Interactions with users and organizations that represent users; third-party storefronts.	Provide, personalize and activate the Services; customer support; accounting.	Service providers and user-directed entities.
Interactions and content	Interactions with users, including data generated through those interactions.	Provide and personalize the Services; product improvement and development; safety.	Service providers and user-directed entities.
Feedback and ratings	Interactions with users.	Provide the Services; product improvement and development; customer support.	Service providers and user-directed entities.

Subject to your consent, and depending on the Services you use and any agreement in place, we may collect, process or disclose certain personal information that qualifies as "sensitive data" under applicable U.S. state privacy laws. Sensitive data is a subset of personal information. The table below outlines the categories of sensitive data we may collect.

Category of sensitive data	Sources	Purposes of processing	Recipients
Account	Log-in.	Provide the Services and fulfill requested financial transactions.	Service providers.
Geo-location information	Users’ interactions with the Services.	Provide the service requested; product improvement. Some attributes may be disclosed to third parties to provide the service.	Users and service providers.
Contents of your mail, email, text messages or call audio	Users’ interactions with the Services.	Provide the Services; improve the product experience; ensure safety; help, secure and troubleshoot.	Service providers.

How we share your personal information

You have the right to know if your personal information is provided to third parties. We may provide personal information to our service providers, as defined under applicable U.S. state privacy laws, to perform services specified by written agreement. These services may include providing our products and services, customer service, preventing fraud, processing payments and fulfilling orders or transactions. We may also share your information with other third parties when you direct us to do so. In addition, we may disclose personal information to third parties for other notified purposes, as permitted by U.S. state privacy laws.

We do not sell your personal information

You have the right to know whether your personal information is being sold. Personal information is "sold" when it is provided to a third party for monetary or other valuable consideration for a purpose that is not a "business purpose" as set forth in the CCPA or other U.S. state privacy laws. A "sale" does not include disclosure at your direction, disclosure under a service agreement, or disclosure otherwise permitted by law. levat8labs does not sell your personal information.

We do not engage in profiling

You have the right to know whether your personal information is used for "profiling," meaning automated decision-making that produces legal or similarly significant effects. levat8labs does not engage in such profiling.

Control

Know what we have: understand the specific pieces of personal information we have collected and kept about you, typically over the preceding twelve months.

Make corrections: fix any personal information we hold that is inaccurate or incomplete.

Get a copy: receive a copy of the personal information we hold, in an accessible format.

Delete your data: request that we delete your personal information. Under certain conditions we will remove your data from our records.

If you have questions about your privacy or want to exercise your data rights, the best way to reach us is by email. Please send your request to privacy@levat8labs.com and a levat8labs representative will get back to you as soon as possible. You also have the right to raise a concern or lodge a complaint with your state attorney general.

Non-discrimination

U.S. state privacy laws prohibit businesses from discriminating against you for exercising your rights. Such discrimination may include denying a good or service, providing a different level or quality of service, or charging different prices. The CCPA permits a business to offer differing levels or quality of service, or different prices, where the difference is reasonably related to the value provided to the business by the consumer’s personal information.

Disclosure of privacy rights requests

Certain U.S. state privacy laws require businesses to disclose the number of requests received, complied with in whole or in part, or denied.

Australian Privacy Principles (APPs)

If you are an Australian resident, the Privacy Act 1988 (Cth) and the Australian Privacy Principles (the "APPs") apply to how we handle your personal information. The sections above describe our general privacy practices. This section provides additional information specific to Australian privacy requirements.

Cross-border disclosure (APP 8)

Personal information collected by levat8labs is stored and processed in the United States of America. We take the following steps to comply with APP 8:

Contractual protections: we maintain enforceable contractual arrangements with our United States-based service providers requiring them to handle your information in accordance with the APPs.

Security measures: we implement robust security measures, including encryption at rest and in transit, access controls and regular security assessments.

Regular reviews: we conduct regular reviews of our data handling practices to ensure ongoing compliance with Australian privacy requirements.

Accountability: under APP 8, we remain accountable for the handling of your personal information by our overseas service providers.

By providing your personal information to us, you consent to this transfer and storage in the United States with these safeguards in place. If you have concerns about this cross-border transfer, please contact us at privacy@levat8labs.com.

Your Australian privacy rights

Anonymity and pseudonymity (APP 2): where practicable, you may deal with us anonymously or using a pseudonym. This may not be possible for services requiring identity verification or account creation.

Access and correction (APP 12 and 13): we will respond to your access or correction requests within 30 days. If we refuse your request, we will provide written reasons.

Direct marketing opt-out (APP 7): you can opt out of direct marketing at any time by contacting us or using the unsubscribe links in our communications. We will action your request within 30 days.

Privacy Officer: a Privacy Officer is responsible for ensuring our compliance with the APPs. Direct privacy-related inquiries to privacy@levat8labs.com.

How to make a complaint

If you believe we have breached the Australian Privacy Principles, submit your complaint to privacy@levat8labs.com. We will acknowledge your complaint within 5 business days and investigate the matter. If you are not satisfied with our response, you may lodge a complaint with the Office of the Australian Information Commissioner (the "OAIC") at www.oaic.gov.au, by phone on 1300 363 992, or by email at enquiries@oaic.gov.au.

Notifiable data breaches

Under Australia’s Notifiable Data Breaches scheme, if we experience a data breach that is likely to result in serious harm to you, we will notify the OAIC as soon as practicable after becoming aware of the breach. We will also notify affected individuals without undue delay. We maintain detailed incident response procedures to detect, investigate and respond to potential breaches promptly.

About the Australian Privacy Principles

The Privacy Act 1988 includes 13 Australian Privacy Principles that govern how organizations collect, use, store and disclose personal information. The key APPs that apply to our Services include APP 1 (open and transparent management), APP 2 (anonymity and pseudonymity), APP 3 (collection of solicited personal information), APP 5 (notification of collection), APP 6 (use or disclosure), APP 7 (direct marketing), APP 8 (cross-border disclosure), APP 10 (quality of personal information), APP 11 (security), APP 12 (access) and APP 13 (correction). For more information, visit www.oaic.gov.au or contact our Privacy Officer at privacy@levat8labs.com.

This section applies where our processing of your personal data is subject to the EU General Data Protection Regulation, the UK General Data Protection Regulation or Swiss data protection law (collectively, the "GDPR"). For the purposes of the GDPR, levat8labs acts as a controller in respect of the personal data for which it determines the purposes and means of processing, and as a processor where it processes personal data on behalf of a client.

Lawful bases for processing

We process personal data only where we have a lawful basis to do so. Depending on the circumstances, the lawful bases on which we rely include consent, where you have given us consent to process your personal data for a specified purpose; performance of a contract, where processing is necessary to provide the Services or to take steps at your request before entering into a contract; compliance with a legal obligation; and legitimate interests, where processing is necessary for our legitimate interests or those of a third party, provided those interests are not overridden by your interests or fundamental rights.

Your GDPR rights

Subject to the conditions and exceptions in the GDPR, you have the right to request access to your personal data; to request rectification of inaccurate data; to request erasure; to request restriction of processing; to object to processing; to obtain your personal data in a portable format; and to withdraw consent where processing is based on consent. We do not make decisions that produce legal or similarly significant effects about you based solely on automated processing.

International data transfers

Where we transfer personal data protected by the GDPR to a country that has not been recognized as providing an adequate level of protection, we implement appropriate safeguards, such as the Standard Contractual Clauses approved by the European Commission, the United Kingdom International Data Transfer Agreement or Addendum, or another lawful transfer mechanism. You may contact us to request further information about the safeguards we apply to a particular transfer.

How to exercise your rights, and complaints

To exercise any of these rights, please contact us at privacy@levat8labs.com. You also have the right to lodge a complaint with your local supervisory authority. Our representative in the European Union for the purposes of Article 27 of the EU GDPR is TA Franco, tfranco@levat8labs.com.

Mobile applications (iOS and Android)

This section applies to the levat8labs mobile applications for iOS and Android (the "Apps"), which form part of the Services. It supplements the rest of this Policy and describes practices specific to the Apps and to the Apple App Store and Google Play. In the event of a conflict between this section and the general provisions above, this section controls with respect to the Apps. The data collection disclosures we provide on each App’s store listing are intended to be consistent with this Policy.

Information we collect through the Apps

Account and profile data: the information used to create, authenticate and manage an account, including name, email or login identifier, phone number, job title, membership number, employment start date, property, department, assigned floors, roles and permissions, work schedule, user status, preferred language, VIP status where configured, and authentication or security data such as password hashes, token hashes, refresh and session tokens, and API-key hashes for integration users.

Device and technical data: mobile-generated device ID, platform (iOS or Android), push notification token, device-token registration status and last-seen timestamps, optional device ID used for realtime connection tickets, and request or session language information.

Voice and audio data: where you use voice features of the levat8labs platform, microphone input, call audio, transcripts, related metadata and service-request content created from those interactions.

Usage and analytics data: app and service activity reflected in backend records, including logins, session and token activity, ticket and service-request lifecycle events, assignments, break events, notification state, realtime events, saved-report criteria, and operational metrics such as endpoint names, method, path, success or failure, timing, request IDs, actor IDs and error details.

Diagnostic data: backend diagnostic and performance data used to maintain and improve the Apps and Services, including API, database and cache latency metrics, command logs, trace metadata, sanitized error logs, push delivery results and service availability information.

Advertising identifiers: the backend does not collect or store IDFA, GAID or other advertising identifiers.

Push notification tokens: where you enable push notifications, the backend stores mobile push tokens, mobile-generated device IDs, platform, user and hotel association, active status and registration timestamps, and uses Firebase Cloud Messaging to send push notifications.

Device permissions

The Apps request permission to access certain device features. Where required, we request each permission at or before the time the related feature is used, and you may grant or decline it. Depending on the features you use, the Apps may request notifications, in order to send push notifications; and camera, photos, contacts or files, to let users take or select images or files for ticket attachments. The backend stores attachment metadata (file name, content type, file size, object key, attachment, session and ticket IDs, uploader user ID, status and timestamps) and uses AWS S3 for file storage.

You can review and change these permissions at any time in your device settings. Disabling a permission may limit the functionality of the Apps. Where required by applicable law and platform rules, we will present a prominent in-app disclosure and obtain your consent before collecting sensitive data such as audio through the Apps.

Third-party SDKs

The Apps may incorporate third-party software development kits (SDKs) for purposes such as analytics, crash reporting, attribution and push notifications. These SDKs may collect device identifiers, usage data and diagnostic data on our behalf. We remain responsible for the data collected through the Apps, including by these SDKs, and we disclose the relevant categories in our store listings. For push notifications we use react-native-firebase/messaging and expo-notifications. We use no analytics, crash reporting or attribution SDKs.

Deleting your account and data

You may delete your account and the personal data associated with it at any time. You can initiate deletion by emailing us at privacy@levat8labs.com. When you delete your account, we will delete or de-identify the personal data associated with it, except where we are required or permitted to retain certain data for legitimate purposes such as security, fraud prevention, legal compliance or dispute resolution, as described in Section 4. Where we process personal data on behalf of a client, deletion is handled in accordance with the applicable client agreement.

Children and privacy on mobile

The Apps are intended for business users and are not directed to children, and we do not knowingly collect personal data from children through the Apps. You can manage your privacy on mobile by adjusting device permission settings, managing notification settings, resetting or limiting your advertising identifier, deleting your account as described above, and contacting us with any request under this Policy.

Terms & Conditions →Back to home →