Privacy Policy

Levoron takes user privacy seriously. This policy explains what data we collect, how we use it, with whom we share it, and what rights you have over it.

The controller of the database and of the processing is:

• Marcela Andrea Marcote
• Tax ID (CUIT): 27-18075410-0
• Address: Boccuzzi 291, Florencio Varela, provincia de Buenos Aires, Argentina
• Email: hola@levoron.com

For privacy inquiries, write to that email or use the “Report a problem or suggestion” button, at the bottom of the left-hand menu.

• Account data: email, name, hashed password, agency, role.
• Agency data: business name, tax ID, address, phone numbers, social networks, logo, seller photo.
• End-client (passenger) data that you upload: name, contact, passport, date of birth. This data is yours and you are the controller before those people — Levoron acts as processor.
• Operational data: quotes, files, payments, receipts, attachments.
• Technical data: IP address, browser, OS, language, usage logs.
• WhatsApp messages (only if the agency connects its WhatsApp Business number through Meta): the phone number and profile name of the person writing, the text of messages received and sent, their delivery status and the reference to attachments. The access token Meta gives us for that account is stored encrypted. Attachments are not copied: they are opened from Meta when you view them.

• To provide the Service (display your information, execute your instructions).
• To process payments through third-party providers (we do not touch card data).
• To send you operational emails (password recovery, receipts, plan alerts).
• To send you usage tips and Levoron news. You can unsubscribe at any time with the “Unsubscribe” link included in each of those emails; your account notices will keep coming.
• To improve the system and find errors: we record how the dashboard is used —which screens are opened, which buttons and links are clicked, how long is spent on each screen, technical errors and failed requests—, linked to your agency and your user. We do not record what you type, the text of messages, your clients' names or data, or your IP address, and we do not store anything in your browser for this. It is used only by the Levoron team to fix problems and decide on improvements; it is never sold or shared with third parties.
• To respond to support tickets you open.

The Service uses Anthropic (Claude) models to generate text. When you use AI features, the input (e.g., quote destination and services) is sent to Anthropic with the sole purpose of generating the response. It is NOT used to train models and is not stored beyond processing.

If you have sensitive information you don't want to send to AI, you can disable “optimize with AI” mode where it appears, or not use AI features.

We share data only with processors that need to process it for the Service to function:

• Supabase: database hosting and file storage.
• Anthropic: AI text generation.
• Vercel: web application hosting.
• Cloudflare: storage of catalog images and encrypted backups.
• Sentry: technical error logging so we can fix them. Only when an error happens inside the dashboard, it also receives a reconstruction of the last minute of the screen (not a video) with all text, fields and images masked: it shows where you clicked, never what you typed or which data was on screen. Without errors nothing is sent, and public pages are never recorded.
• MercadoPago / Paddle: subscription payment processing.
• Resend / transactional email provider: sending operational emails.
• Meta (WhatsApp Business Platform): if you connect your WhatsApp number, messages travel through Meta's platform under its own terms. Levoron receives only what Meta sends us for your account and never shows one agency's data to another.

Each has its own privacy policy. We do NOT sell your data or share it with third parties for marketing purposes.

Under applicable legislation (Law 25.326 in AR, LGPD in BR, GDPR in EU, etc.) you have the right to:

• Access: request a copy of the data we hold about you.
• Rectification: correct inaccurate data.
• Erasure: request that we delete your account and data (subject to legal retention obligations).
• Portability: receive your data in a structured format.
• Opposition: object to processing on legitimate grounds.

To exercise these rights, contact us via the “Report a problem or suggestion” button or the contact email. We respond within 30 calendar days.

• Operational data is kept while your account is active.
• If you cancel the account, we archive the data for 6 months to support reactivation; we then delete it.
• We keep payment receipts for the time required by your country's tax law (typically 5-10 years).
• Technical logs: 90 days by default.
• WhatsApp messages: while your number is connected or your account is active. Disconnecting the number deletes the access token; the chats stay in your account until you close it.
• Dashboard usage records: the detail is deleted after 30 days; after that, only a daily summary per agency, without per-user data, is kept for 12 months.

• All connections use HTTPS / TLS.
• Passwords are stored hashed with bcrypt.
• Access to your database is restricted by Row-Level Security: no other agency can see your data.
• We make periodic encrypted backups.
• If we detect a security breach affecting your data, we notify you within 72 hours as required by GDPR.

If a public authority asks us for personal data of users or their clients: (1) we check that the request is legally valid and comes from a competent authority; (2) we reject or challenge it if we consider it is not; (3) if something must be provided, we provide only the minimum information necessary; (4) we document each request, our response, the parties involved and the legal basis. Unless the law forbids it, we notify the affected person or agency.

We only use cookies strictly necessary to maintain your session and remember preferences (language, theme). We do not use Google Analytics, advertising or re-targeting cookies. To know how many people visit our public pages (showcases, packages and the package builder) we count visits ourselves, without cookies and without storing your IP: only the page, the site you came from and the device type. More detail in our cookie policy.

We may update this policy. We will notify material changes via email or in the dashboard. The last-updated date is always shown at the top.