Privacy Policy

Who is responsible.

The controller of your data is Individual Entrepreneur Tatiana Kuznetsova, registered in Georgia, identification code 305653245, address for legal notices: Akhmeteli St. 8, Tbilisi, Georgia («Levelvale», «we»). Contact: hello@levelvale.com.

In brief.

Levelvale is a property yield calculator. Until you create an account we do not know who you are. We collect only what the service needs: your email for an account, the figures you choose to save, and the payment status. We do not ask for your name, phone or documents, we do not sell data and we do not show advertising.

While you simply read the site.

We count visits anonymously: the event (a page opened, a button pressed, scrolling), the page address, language, the address you came from, and campaign tags (utm_source, utm_medium, utm_campaign) and a partner code (ref) if the link carried them. A random visit identifier lives only in the memory of the open page: nothing is stored in your browser for statistics, and we do not record your IP address. If you answer the short question «Did this calculation help you decide?», your answer and the text you choose to type (up to 300 characters) are saved with these statistics: please do not type personal data there. Statistics are deleted automatically after 24 months. Basis: our legitimate interest in knowing which pages work. You can switch off our own statistics below; the aggregated visit count by the hosting provider is described in the section «Who processes data on our behalf».

What stays in your browser.

Some things are kept in your browser's storage on this device so that the site works for you. They do not leave your device by themselves, and clearing the site data removes them:
• the figures you type into the calculator (including those the home page hands over to the app), the language, the colour theme and similar settings;
• after you sign in: the sign-in token that keeps you signed in, and a copy of the calculation model the app runs on, kept in the browser cache so that it opens faster;
• «tdlab_juris» and «lv_h7»: calculator settings, no personal data;
• «lv_fb_x»: that you closed the short feedback question, so that it is not shown again;
• «rc_analytics_disabled»: that you switched statistics off;
• «lv_ga_consent»: whether you accepted or declined Google Analytics;
• «lv_team»: only on our own team's devices, so that our own visits are left out of the statistics.
When you sign out, the model copy and the site's figures and settings (keys beginning with lv_, tdlab_ and ryc_handoff) are deleted from this browser; your statistics choice and the team mark stay. This is a function you use, not tracking.

The site's hosting sets two technical cookies. They are strictly necessary for the site to work, so they do not require consent:
• «__cf_bm» (Cloudflare, bot protection, up to 30 minutes);
• «__dpl» (hosting, technical, session).

Your account.

Your email address and password. The password is stored only as an irreversible cryptographic hash: we cannot see or recover it. Basis: the contract: without them there is no account. With the account we also save the time you accepted the Terms, whether you agreed to receive news, the language of sign-up and, if the link that brought you carried them, campaign tags and a partner code. Basis for the tags and the code: our legitimate interest in knowing which campaigns and partners bring people.

Sign-in with Google. If you sign in this way, Google (Google Ireland Limited, Google LLC) sends us your email address and the identifier of your account with them; Google may also send your name and a link to your profile picture. We use only the address and the identifier, so that you reach your own account; we do not show the name or picture and do not use them for anything else. Your Google password never reaches us. Sign-in passes through the sign-in service of our hosting provider, Lovable. Basis: the contract.

What you save.

Calculations you save, the names you give them and the monthly figures of properties you track in «My assets» are stored in our database so that you can open them again. A share link shows a read-only copy of a report to anyone who has the link; you decide whether to create one. Basis: the contract.

Payments.

Card details are entered on the payment partner's form and never reach Levelvale. The partner sells the subscription as merchant of record and is a separate controller of payment data: Paddle.com Market Ltd (United Kingdom); payments by Bank of Georgia cards are accepted by Gumroad, Inc. (United States). When you open Paddle's checkout, the page loads Paddle.js from Paddle's servers, which includes Paddle's Retain component; both work under Paddle's own privacy notice. To link the payment to your account we pass to Paddle your email, your account's internal identifier and, if your visit carried them, the campaign tags and the partner code; the Gumroad checkout link carries your email and the chosen plan. From the partner we receive your email, the plan, the dates of the paid period, the payment status and subscription identifiers. We keep one record per purchase to give you access and to handle refunds. Basis: the contract; for the campaign tags and the partner code, our legitimate interest.

Emails.

Service emails (sign-up, password reset, payment) are part of the contract. News about Levelvale, including new features and updates, only if you ticked that box at sign-up; every such email has an unsubscribe link, and you can also simply write to us. Basis: your consent, which you may withdraw at any time.

Google Analytics: only with your consent.

If you press «Accept» in the banner, the site loads Google Analytics 4 (Google Ireland Limited and Google LLC). Before that, and if you press «Decline», nothing from Google Analytics is loaded and nothing is sent to it. Google Analytics sets cookies (_ga, _ga_*) for up to 2 years and receives: the page address without parameters or fragment (only campaign tags utm_* are kept), the page title, the address of the previous page without parameters, language, device and browser type, the approximate location Google derives from your IP address, and the time of the visit. We do not send your email, name, account identifier, the figures of your calculations, share-link addresses or sign-in tokens; pages opened from a sign-in or password link, shared reports and the team's own devices are left out. Google signals and advertising personalisation are switched off. Purpose: to understand which pages and features are used. Basis: your consent. Data may be processed in the United States; Google relies on the EU–US Data Privacy Framework and the European Commission's Standard Contractual Clauses. Google Analytics keeps this data for no longer than 14 months. Your choice is remembered in this browser («lv_ga_consent»); you can change it or withdraw consent at any time below: Google Analytics then stops on this device and its cookies for this site are deleted.

Who processes data for us.

• Lovable (Lovable Labs): hosting of the site and the app, the database and sign-in (Lovable Cloud, which runs on Supabase, Inc., United States); the site is delivered through the network of Cloudflare, Inc. (United States). Lovable also counts visits for us in aggregated form (pages, country, device type, the site you came from) with its own script on the pages (/~flock.js); the «Disable statistics» button below does not switch that count off.
• Google (Google Analytics 4): only after you accept it in the banner: see «Google Analytics: only with your consent».
• Google (Google Workspace): our mailbox hello@levelvale.com; letters you write to us are kept there.
They process personal data only on our behalf and under their data-processing terms. Paddle and Gumroad are separate controllers of payment data (see «Payments»).
• Telegram: internal alerts to the owner about a payment (amount and currency), a cancellation, a failed renewal, a refund, a Gumroad purchase (the plan), site outages, and a daily count of sign-ups and payments. The alerts contain no email, name or account identifier.
Your data may therefore be processed outside Georgia and outside your country, including in the United States. For such transfers the data-processing terms of Lovable, Supabase, Cloudflare and Google provide the European Commission's Standard Contractual Clauses (for UK data, with the UK Addendum); Cloudflare may also rely on the EU–US Data Privacy Framework. Fonts are served from our own site; exchange rates and reference statistics are requested by our server, not by your browser, so these services do not see you.

How long everything is kept.

Visit statistics, including answers to the feedback question: 24 months, then they are deleted automatically. Your account, saved calculations and assets: while the account exists; after you ask us to delete the account they are removed from the working database within 10 working days, and copies in the hosting provider's backups disappear as those backups expire in the provider's normal backup cycle. Our record of each purchase: while the account exists, and after it is deleted only as long as needed to handle refunds, payment disputes and accounting. Payment records of the payment partner: as its own policy and tax law require.

Your rights.

You may ask what data we hold about you and receive a copy, have it corrected or completed, have it deleted or its processing stopped, have it blocked while a question about it is being settled, receive the data you gave us in a machine-readable form, object to processing, refuse news emails, withdraw consent at any time, and have your account deleted together with everything saved in it. Write to hello@levelvale.com from the address of your account.
Deadlines under the Law of Georgia on Personal Data Protection: information about the processing, access and a copy: within 10 working days (in special cases we may extend this by up to 10 more working days and will tell you why at once); correction, deletion or stopping the processing, and withdrawal of consent: within 10 working days; a decision on blocking: within 3 working days; news emails stop no later than 7 working days after you ask. If the EU or UK GDPR applies to you, we answer without undue delay and in any case within one month.
You may also complain to a supervisory authority: in Georgia: the State Audit Office of Georgia (sao.ge), which took over the functions of the Personal Data Protection Service on 2 March 2026; in the EU or the UK: the authority of your country.

Age.

Levelvale is for people aged 18 and over. We do not knowingly collect data of children.

If something goes wrong.

If data is leaked or accessed without authorisation, we record the incident and notify the State Audit Office of Georgia within 72 hours of identifying it, unless it is unlikely to cause significant harm; if the risk to you is high, we tell you without undue delay what happened and what to do. Where the EU or UK GDPR applies, we also notify the competent authority as that law requires.

Changes and contact.

The date of the last update is at the top of this page. If we change this policy in a way that matters for how your data is used, we email account holders before the change takes effect. This text is published in English and Russian. Georgian version: ქართული. Questions: hello@levelvale.com; postal address for legal notices: Akhmeteli St. 8, Tbilisi, Georgia.