levelpartner.ai
Legal

Privacy Policy

Effective Date: 10 September 2026

1. Data Controller

The data controller for your personal information is JSMN EQT LLC. For any privacy question or request, contact us at privacy@levelpartner.ai.

2. Personal Data We Collect

  • Identification & Contact: Name, email address, phone number, LinkedIn profile URL.
  • Business Info: Company name, website, monthly revenue, current tech stack.
  • Account & Billing: Handled securely by Stripe; we do not store full credit card details.
  • Affiliate Data: Referral tracking codes (lp_ref).
  • Usage & Device: IP address, browser type, pages visited, and cookie or device identifiers assigned by our analytics and advertising tools.
  • Advertising Match Data: Where you have given us your details, we send Google and Meta a hashed (irreversibly scrambled) version of your name, email address, phone number, gender and location so that they can match a measurement event to an account. We send no other details for this purpose, and we never send them unscrambled.
  • Call & Meeting Data: Transcripts and recordings via Fathom. We ask for your consent at the start of the call. If you would rather we did not take notes, tell us and we switch the notetaker off for that call. Recordings stay in Fathom and are not transferred anywhere else; transcripts are used only for quality checks and improving our support.
  • Communications: Content of emails, form submissions, and support tickets.

3. How We Use It

We process your data under the following GDPR Article 6 lawful bases:

  • Contractual Necessity: To deliver our services, process payments, and manage your account.
  • Legitimate Interests: To improve our services, secure our platform, and track affiliate referrals.
  • Consent: For marketing communications, for call recording, and — for visitors in the European Economic Area, the United Kingdom and most other countries — for analytics and advertising cookies and similar technologies and the resulting transfer of measurement data to Google and Meta. For visitors in the United States, Canada, Australia and Switzerland these technologies operate on an opt-out basis instead, as described in section 9.
  • Legal Obligation: To maintain accounting records and comply with tax laws.

Call recordings and transcripts are held by Fathom, where they are made. We use them only to check and improve the quality of our service and support. They are not transferred to any advertising platform and are not used for advertising or audience building.

4. Third Parties We Share Data With

We use trusted third parties to deliver our services. Most act as our processors, meaning they handle personal data only on our instructions. These include GoHighLevel (marketing automation), Stripe (payments), Fathom (call recording), Lead Connector (scheduling), Vercel (hosting), Cloudflare (website delivery, security and performance), Cookiebot by Cybot A/S (cookie consent management), YouTube (embedded video), hCaptcha by Intuition Machines, Inc. (bot and abuse prevention), Google Fonts (web fonts), Google (analytics and advertising, including Google Ads), and Anthropic PBC and OpenAI (AI processing). Our AI providers do not train their models on data submitted through their APIs.

Two are different. For the advertising and measurement data described in section 5, Meta Platforms Ireland Limited and Google LLC decide some purposes of the processing themselves rather than acting only on our instructions. Section 5 explains what that means for you and what rights you have.

Where personal data is transferred outside the EEA or the UK, we rely on the European Commission's Standard Contractual Clauses, on the EU-US Data Privacy Framework and its Swiss-US and UK Extensions where the recipient is certified under them, and on the UK International Data Transfer Addendum where UK law applies.

A full list of our providers and their own sub-processors, with a version date, is published at levelpartner.ai/sub-processors.

5. Advertising and measurement

We advertise our services on Google and on Meta platforms including Facebook and Instagram. To measure whether that advertising works, and to show our ads to people who have visited our sites, we use advertising and measurement technologies provided by Google and Meta.

How the data reaches them. These technologies send data in two ways. Some events are sent from your browser by tags loaded through Google Tag Manager. Some are also sent from our own systems, server to server, through Meta's Conversions API. We do not currently send data to Google server to server; if we begin to, the same consent will govern it. Server-side sending uses information already collected during your visit, including identifiers stored on your device, so the same consent governs both routes.

What is sent. Which pages you viewed and which actions you took, such as starting or completing a purchase or booking an appointment; your IP address, browser type and device identifiers; and, where you have given us your details, hashed versions of your name, email address, phone number, gender and location for matching. Nothing beyond this is sent.

Consent and opt-out. What governs these technologies depends on where you are. If you are in the European Economic Area, the United Kingdom or most other countries, they only run if you give marketing consent, and no measurement data is sent to Google or Meta before you do. If you are in the United States, Canada, Australia or Switzerland, they run when you arrive and you may turn them off at any time. Either way you can change your choice at any time using the "Your privacy choices" link in our footer or the privacy icon at the bottom left of every page, and if your browser sends a Global Privacy Control signal we act on it automatically. Turning them off stops any further sending; it does not reverse what was already sent beforehand.

Joint controllership with Meta. For the collection of event data on our sites and its transmission to Meta, JSMN EQT LLC and Meta Platforms Ireland Limited are joint controllers under Article 26 GDPR, on the terms of Meta's Controller Addendum. The essence of that arrangement is published by Meta at facebook.com/legal/terms/businesstools_jointprocessing. Once the data reaches Meta, Meta acts as an independent controller for what it does with it. You may exercise your data protection rights against either of us: we handle requests about the data we hold, and Meta handles requests about the data it holds. If you contact us about the latter we will tell you where to send the request. Google acts as a controller for its own advertising purposes on comparable terms.

Selling and sharing. We do not sell your personal information. Under some United States state privacy laws the advertising activity described above is called 'sharing' your personal information, or 'targeted advertising', and you have the right to opt out. You can opt out using the "Your privacy choices" link in our footer or the privacy icon at the bottom left of every page and choosing "Do not sell or share my personal information", by sending a Global Privacy Control signal from your browser, which we act on automatically, or by emailing privacy@levelpartner.ai.

Phone numbers and other mobile information collected through our SMS opt-in are never included in any advertising audience and are never uploaded to any advertising platform.

6. Data Retention

  • Active Clients: Duration of contract + 3 years.
  • Affiliates: 5 years from last activity.
  • Marketing: Until unsubscribe or 2 years of inactivity.
  • Call Recordings: 12 months.
  • Web Analytics: 14 months.
  • Advertising audiences: up to 365 days from your last interaction with our sites. On Meta website custom audiences the platform maximum of 180 days applies. We set this period against our measured sales cycle — a business evaluating an engagement of this kind typically takes several months from first visit to decision, and a shorter window would end the processing before the purpose it exists for is complete.

How deletion works in practice

When you ask us to delete your data, we action the deletion in our primary systems without undue delay. Our service providers hold backup copies for their own defined periods, so a deleted record may persist in a provider's backups for a further limited period before those backups cycle. We do not restore deleted data from backups except where the law requires it.

Where we are required to keep records for accounting, tax or dispute-resolution purposes, we keep only what is necessary for that purpose and for no longer than required.

We keep no separate copy of the measurement events sent to Google and Meta. Once sent, that data is retained by Google and Meta under their own published retention rules, which we do not control. What we do control is how long someone remains in an advertising audience, and we set that to a maximum of 365 days from the last interaction, except on Meta website custom audiences where the platform maximum of 180 days applies.

7. AI processing

Some of our services use artificial intelligence providers to process content such as messages, call transcripts and support communications.

Our AI providers do not use our customers' content to train their models, and we do not permit them to do so.

Content sent to those providers is either not retained, or retained only for the limited period set out in that provider's terms. Where a provider's automated safety systems flag content, that provider may retain it for longer where its terms or the law require. We do not control those retention periods and we do not rely on them for our own record-keeping.

The AI providers we use are listed in our third-party service providers section. Where a provider offers a zero-retention option that fits the service, we use it.

8. Your Rights

Under the GDPR, you have the right to access, rectify, erase, restrict, or object to the processing of your data, as well as the right to data portability. You may withdraw consent at any time. To exercise these rights, email privacy@levelpartner.ai. We respond to all requests within one month. You also have the right to lodge a complaint with your local supervisory authority.

Additional rights in the United States

Depending on the state you live in, you may also have the right to know what personal information we hold about you, to receive a copy of it, to correct it, to ask us to delete it, and to opt out of the sale or sharing of your personal information and of targeted advertising. We do not sell your personal information. To exercise these rights, email privacy@levelpartner.ai. We will not discriminate against you for exercising them.

We honour the Global Privacy Control (GPC) signal. If your browser sends a GPC signal we treat it as an opt-out of the sale or sharing of your personal information and of targeted advertising, and we record that preference against your contact record where we hold one. A Global Privacy Control signal also suppresses our advertising technologies, not only our analytics.

You may lodge a complaint with your local supervisory authority in the EU or UK. In the United States you may contact the Federal Trade Commission at reportfraud.ftc.gov or your state Attorney General, and California residents may contact the California Privacy Protection Agency at cppa.ca.gov.

9. Cookies and your regional privacy choices

For the full list of cookies and similar technologies we use, and the third parties that receive data from them, see our Cookie Policy.

What you are asked depends on where you are, because the law differs.

If you are in the European Economic Area or the United Kingdom, and in most of the rest of the world, nothing beyond strictly necessary cookies runs until you allow it. You are shown a consent banner on your first visit, and nothing in the analytics, preferences or advertising categories is set until you choose.

If you are in the United States, Canada, Australia or Switzerland, analytics and advertising technologies are switched on when you arrive, and you may turn them off at any time. This is the notice we are required to give you at or before the point of collection. What we collect and who receives it is described in sections 2, 4 and 5 above. We do not sell your personal information, and mobile phone numbers and SMS opt-in information are never included in any advertising audience and never shared with any third party for marketing or promotional purposes.

Either way, you can change your choice at any time using the "Your privacy choices" link in our footer, or the privacy icon at the bottom left of every page. In the United States, Canada, Australia and Switzerland that panel includes a "Do not sell or share my personal information" option.

If your browser sends a Global Privacy Control signal, we act on it automatically and you do not need to do anything. Advertising and analytics are switched off before any advertising technology loads, and you will see a short confirmation that the signal was honoured.

If we cannot determine where you are, you are treated as if you were in the European Economic Area, which is the more protective option.

10. Security

Christian Olsson is responsible for information security at JSMN EQT LLC.

All staff use company-controlled levelpartner.ai accounts. Two-factor authentication is enforced on all staff accounts. All staff devices use full-disk encryption. Credentials are managed through a company password manager. Client data is held in separate sub-accounts and access is limited to the sub-account a person is authorised to work in. Connections to our website and platforms are encrypted using TLS.

We operate a documented incident response plan, and where we process personal data on a client's behalf we notify that client within 24 hours of becoming aware of a personal data breach affecting their data. Our full security programme is described at levelpartner.ai/security.

Two-factor authentication for your own account

Two-factor authentication is available to you and you can enable it yourself at any time:

  1. Log in to your account.
  2. Go to Settings.
  3. Open My Profile.
  4. Find Two-Factor Authentication (2FA).
  5. Click Setup.
  6. Open Google Authenticator, Microsoft Authenticator, Authy, or another TOTP authenticator app.
  7. Scan the QR code shown on your screen.
  8. Enter the 6-digit code generated by the authenticator app.
  9. Click Next or Confirm to activate 2FA.
  10. Save the 10 backup codes somewhere secure.
  11. Log out and log back in to verify that 2FA is working.

11. SMS and text messaging

No mobile information will be shared with third parties/affiliates for marketing/promotional purposes.

Text messaging originator opt-in data and consent are not shared with any third parties, excluding aggregators and providers of the text message service itself, and then only to deliver the messages you have asked to receive. You will only receive messages if you have explicitly opted in, and we keep a timestamped record of that consent. You can cancel SMS messages at any time by replying STOP to any message; the request is processed immediately. Reply HELP to any message, or contact support@levelpartner.ai or +1 866-261-9691, for assistance.

12. Children

Our services are strictly B2B and not intended for individuals under 16 years of age. We do not knowingly collect data from minors. Our SMS messaging programmes are separately restricted to individuals aged 18 or over, as stated in our Terms of Service.

13. Changes to this Policy

We may update this policy periodically. Material changes will be communicated via email or a prominent notice on our website.

14. Contact

If you have questions about this Privacy Policy, please contact us at privacy@levelpartner.ai.

Questions about this page: support@levelpartner.ai. Other policies: Terms, Partner Programme Agreement, Cookies, Sub-processors, Data processing, Security, Legal notice.