Privacy Policy

Effective Date: June 1, 2026

This Privacy Policy describes how Level Up Technology LLC, a California Limited Liability Company, doing business as Level Up Labs ("Level Up Labs," "we," "us," or "our") collects, uses, discloses, and protects information in connection with the Factimonious platform (the "Service"). This Policy applies to all users globally, subject to the region-specific provisions set forth herein.

BY USING THE SERVICE, YOU ACKNOWLEDGE AND AGREE TO THE PRACTICES DESCRIBED IN THIS POLICY. IF YOU DO NOT AGREE, PLEASE DO NOT USE THE SERVICE.

1. Who We Are

Level Up Technology LLC, doing business as Level Up Labs, operates Factimonious, accessible at https://factimonious.ai and through associated APIs. Our principal place of business is in the State of California, United States.

Privacy inquiries and requests should be directed to:

Privacy Team: factimoniousprivacy@factimonious.ai

2. Our Core Data Commitment

Level Up Labs is committed to user privacy through a privacy-by-design approach. Customer Data follows two distinct paths, described in detail in our AI & Machine Learning Data Use Policy and TOMs document. Path 1 (Service Delivery Data) includes Session Results and other account-linked data needed to provide the Service; this data is NOT anonymized and is personal data, handled as described in Section 3.4 and Section 7 below. Path 2 (AI/ML Training Data) is a separately aggregated dataset that is genuinely anonymized – aggregated across Customers and time periods sufficient to prevent attribution to any individual or Customer – before any use in training our AI/ML models, as described in Section 5 below. Customer’s raw code repository contents are accessed transiently for analysis and are not retained by Level Up Labs.

Separately, we collect limited personal information necessary to operate accounts, process payments, and communicate with you, as described below. This personal information, together with Path 1 Service Delivery Data such as Session Results, is kept distinct from the Path 2 anonymized dataset. Level Up Labs will never sell your personal information. Your identifiable personal information and Path 1 data are used only to operate, secure, and improve your experience using the Service; they are not used to train our AI/ML models, which are trained exclusively on the genuinely anonymized Path 2 dataset, as described in Section 5 below.

3. Information We Collect

3.1 Account and Registration Information

When you create a Factimonious account, we collect:

Name and email address;

GitHub account identifiers (GitHub user ID, username, and email associated with your GitHub account);

Company or organization name (if provided);

Role or job title (if provided).

3.2 Payment Information

All payment transactions are handled by Stripe, Inc. We do not store full payment card numbers or sensitive financial data. We receive from Stripe limited information such as the last four digits of your card, card type, expiration date, and billing address for billing and fraud prevention purposes.

3.3 Usage and Log Data

We automatically collect certain technical information when you use the Service, including:

IP address and approximate geographic location (country/region);

Browser type and version, operating system;

Pages visited, features accessed, timestamps;

Error logs and diagnostic data.

3.4 Session Results and Service Data Use

The Service accesses Customer-authorized code repositories and engineering toolchains to analyze AI-assisted code activity, semantic code changes, and software engineering signals. The repository contents are not retained by Level Up Labs following each analysis session. Upon completion of each session, the Service generates a Session Result, which is saved and linked to the Customer’s account. Any or all subsequent sessions may analyze the Customer’s current repository against the prior Session Result, and all detected changes will be reflected in the new Session Result, enabling Customers to review a complete history of repository change metadata over time. Session Results are Path 1 Service Delivery Data: they are account-linked, are NOT anonymized, and are personal information used to provide the Service. A separate, genuinely anonymized Path 2 dataset derived from Service usage (including aggregated session metadata, with all direct and reasonably reversible identifiers removed) may also be used to train and improve our AI/ML models, as described in Section 5 below and in our AI & Machine Learning Data Use Policy. Session Results and repository content are never used for AI/ML training.

3.5 Communications

If you contact us for support or otherwise communicate with us, we retain records of those communications, including any personal information you voluntarily provide.

3.6 Cookies and Tracking Technologies

We use cookies and similar tracking technologies to operate and improve the Service. Please see our Cookie Policy for details.

4. How We Use Your Information

We use the personal information we collect for the following purposes:

To create and manage your account and provide the Service under our Terms of Service;

To process payments and manage subscriptions through Stripe;

To send transactional communications such as receipts, account notifications, and security alerts;

To respond to support inquiries and provide customer assistance;

To send product updates, newsletters, or promotional content (with your consent where required by law);

To monitor and analyze usage and performance to improve the Service;

To generate product recommendations for you based on your account-linked (Path 1) usage patterns, which you may opt out of at any time (see Section 5 below and our AI & Machine Learning Data Use Policy);

To detect, investigate, and prevent fraudulent transactions, abuse, and security incidents;

To comply with applicable legal obligations.

Legal bases under applicable law (including GDPR) include: contract performance (operating your account, processing payments), legitimate interests (security, analytics, service improvement), legal obligation, and consent (marketing communications where required).

5. Anonymized Data for AI/ML Training

The genuinely anonymized Path 2 dataset derived from Customer use of the Service is used by Level Up Labs to train, test, evaluate, and improve the AI and machine learning models that underlie the Service. This use is a core and integral function of the Service. Path 1 Service Delivery Data, including Session Results, is not used for AI/ML training and is not within the scope of this Section.

Because the Path 2 dataset is genuinely anonymized and does not constitute personal data under applicable privacy laws (including the GDPR, CCPA/CPRA, and similar frameworks), it is not subject to rights of access, deletion, portability, or opt-out that apply to personal data. There is no opt-out right with respect to our use of the Path 2 anonymized dataset for AI/ML training and testing.

Separately from Path 2 AI/ML training, Level Up Labs may use your organization's own Path 1 account-linked usage data – which is NOT anonymized – to generate product recommendations directed to your account (for example, suggesting features or integrations that may benefit your team based on observed usage patterns). Because this personalization feature uses account-linked personal data, you may opt out of it at any time through account settings or by contacting factimoniousprivacy@factimonious.ai, without affecting your ability to use the Service or our separate use of the Path 2 anonymized dataset for AI/ML training.

For full details of our anonymization standards and AI/ML data practices, please see our AI & Machine Learning Data Use Policy.

6. Sharing and Disclosure of Information

We do not sell your personal information. We may share your personal information in the following circumstances:

6.1 Service Providers and Sub-Processors

We engage trusted third-party service providers to assist in operating the Service, including cloud infrastructure providers, analytics services, and email delivery services. These providers are contractually obligated to process personal data only on our instructions and to maintain appropriate data protection standards.

6.2 Payment Processor

Your payment information is shared with Stripe, Inc. as necessary to process transactions. Stripe's handling of payment data is governed by Stripe's own Privacy Policy.

6.3 Legal and Regulatory Requirements

We may disclose personal information where required by applicable law, regulation, legal process, or government request, or where necessary to enforce our Terms of Service, protect the rights, property, or safety of Level Up Labs, our users, or others.

6.4 Business Transfers

In the event of a merger, acquisition, reorganization, or sale of all or substantially all of our assets, personal information may be transferred to the successor entity. We will provide prior notice of such transfer and the resulting changes to this Privacy Policy.

6.5 With Your Consent

We may share personal information for other purposes with your express consent.

7. Data Retention

We retain personal information only for as long as necessary to fulfil the purposes for which it was collected, and as required by applicable law. Our standard retention periods are:

Account data: retained for the duration of your account, plus three (3) years after account closure;

Session Results (Path 1 account-linked data): duration of account plus three (3) years, consistent with the DPA;

Usage and log data: ninety (90) days rolling;

Billing records: seven (7) years as required by applicable tax law;

Support communications: three (3) years;

Anonymized service data: retained as long as operationally necessary for the AI/ML systems that power the Service.

You may request earlier deletion of personal data at any time, subject to legal retention requirements. Requests should be directed to factimoniousprivacy@factimonious.ai.

8. Your Privacy Rights

Depending on your location, you may have certain rights with respect to your personal information. These may include:

Access: Request a copy of personal information we hold about you;

Correction: Request correction of inaccurate or incomplete personal information;

Deletion: Request deletion of your personal information ("right to be forgotten"), subject to legal retention obligations;

Portability: Receive your personal information in a portable, machine-readable format;

Restriction: Request that we limit processing of your personal information;

Objection: Object to processing based on legitimate interests;

Non-discrimination: We will not discriminate against you for exercising your privacy rights.

Anonymized data, by its nature, cannot be attributed to you and is therefore not subject to the above rights.

To exercise any right, please contact us at factimoniousprivacy@factimonious.ai. We will acknowledge your request within five (5) business days and respond within thirty (30) days (or up to forty-five (45) days where permitted by law). EU/UK/Swiss users may also lodge complaints with their local Data Protection Authority.

8.1 California Residents (CCPA/CPRA)

California residents have the right to know what personal information we collect, use, disclose, or sell; the right to delete personal information; the right to correct inaccurate personal information; and the right to opt out of the sale or sharing of personal information. We do not sell personal information. The right to opt out does not apply to our use of the Path 2 anonymized dataset for AI/ML training, which does not constitute personal information under the CCPA/CPRA. We recognize the Global Privacy Control (GPC) signal as a valid opt-out preference signal for purposes of any sale or sharing of personal information under the CCPA/CPRA where applicable.

8.2 EEA and UK Residents (GDPR)

Residents of the European Economic Area and United Kingdom have the rights described above under the General Data Protection Regulation (GDPR) and applicable national implementing legislation. Where we process personal data based on consent, you may withdraw consent at any time without affecting the lawfulness of prior processing.

8.3 Canada Residents (PIPEDA / Québec Law 25)

If you are located in Canada, your personal information is also subject to the federal Personal Information Protection and Electronic Documents Act (PIPEDA) and, if you are located in Québec, Québec's Law 25. In addition to the rights described above, you have the right to access and request correction of your personal information, and to file a complaint with the Office of the Privacy Commissioner of Canada or, for Québec residents, the Commission d'accès à l'information du Québec (CAI).

8.4 Brazil Residents (LGPD)

If you are located in Brazil, your personal data is also subject to Brazil's Lei Geral de Proteção de Dados (LGPD). In addition to the rights described above, you have the right to confirmation of the existence of processing, information about the entities with which we have shared your data, and the right to request anonymization, blocking, or deletion of unnecessary or excessive data. You may also lodge a complaint with Brazil's Autoridade Nacional de Proteção de Dados (ANPD).

8.5 Australia Residents (Privacy Act 1988)

If you are located in Australia, your personal information is also subject to the Privacy Act 1988 (Cth) and the Australian Privacy Principles (APPs). In addition to the rights described above, you have the right to request access to and correction of your personal information, and to lodge a complaint with the Office of the Australian Information Commissioner (OAIC) if you believe we have mishandled your personal information.

8.6 Switzerland Residents (nFADP)

Residents of Switzerland have the rights described above under Switzerland's Federal Act on Data Protection (nFADP). Where we process personal data based on consent, you may withdraw consent at any time without affecting the lawfulness of prior processing. You may also lodge a complaint with the Swiss Federal Data Protection and Information Commissioner (FDPIC).

9. International Data Transfers

Level Up Labs is based in the United States, and your personal information may be transferred to, stored in, and processed in the United States and other countries where our service providers operate. These countries may have data protection laws that differ from those in your jurisdiction.

For transfers of personal data from the EEA or UK, we rely on appropriate safeguards, including (where Level Up Labs is self-certified) the EU-U.S. Data Privacy Framework and its UK extension, EU Standard Contractual Clauses (SCCs), and the UK International Data Transfer Agreement (IDTA), as applicable. For transfers of personal data from Switzerland, we rely on the EU Standard Contractual Clauses as recognized under Swiss law, the Swiss-U.S. Data Privacy Framework (where applicable), or other transfer mechanisms recognized under the Federal Act on Data Protection (nFADP). Level Up Labs’s current Data Privacy Framework certification status, if any, is available at https://www.dataprivacyframework.gov. Copies of transfer safeguards are available upon request at factimoniousprivacy@factimonious.ai.

10. Security

We implement and maintain appropriate technical and organizational measures designed to protect your personal information from unauthorized access, disclosure, alteration, or destruction, proportionate to the nature, scope, context, and purposes of our processing and the risks involved, as further described in our Technical and Organizational Security Measures (TOMs) document available upon request. Such measures are designed to address, as appropriate to the relevant risk profile:

Encryption in transit (TLS 1.2 or higher) and at rest (AES-256);

Role-based access controls and the principle of least privilege;

Authentication controls appropriate to the relevant system and risk profile; our key service providers, including our cloud infrastructure provider and payment processor, each maintain multi-factor authentication on their own platforms;

Periodic vulnerability assessments commensurate with risk, maturing as the Service scales; periodic data protection and security awareness training for personnel with access to personal information;

Incident response procedures and business continuity planning.

In the event of a personal data breach, we will notify affected users and relevant authorities within the timeframes required by applicable law (including within 72 hours under the GDPR where feasible).

11. Children's Privacy

The Service is not directed to individuals under the age of sixteen (16) in the EU/EEA, or under the age of thirteen (13) elsewhere. We do not knowingly collect personal information from children. Consistent with the CCPA/CPRA, we do not sell or share the personal information of California consumers we know to be under sixteen (16) years of age without opt-in consent (and, for consumers under thirteen (13), without verifiable parental consent); as noted above, we do not sell or share personal information in any event. If you believe we have inadvertently collected personal information from a minor, please contact us at factimoniousprivacy@factimonious.ai and we will promptly delete it.

12. Third-Party Links and Services

The Service may contain links to third-party websites or integrate with third-party services. This Privacy Policy does not apply to those third parties. We encourage you to review the privacy policies of any third-party services you access.

13. Cookie Policy

We use cookies and similar technologies to operate and improve the Service. For detailed information on our cookie practices, including how to manage your cookie preferences, please see our Cookie Policy available on our website.

14. Changes to This Policy

We may update this Privacy Policy from time to time. If we make material changes, we will notify you via email or prominent in-app notice at least thirty (30) days before the changes take effect. The updated Policy will be effective as of its stated effective date. Your continued use of the Service after the effective date constitutes your acceptance of the updated Policy.

15. Contact Us

If you have questions, concerns, or requests regarding this Privacy Policy or our privacy practices, please contact:

Level Up Technology LLC, d/b/a Level Up Labs

Privacy Team:

Email: factimoniousprivacy@factimonious.ai

Website: https://factimonious.ai