Privacy Policy

1.Who is responsible

Levay ("we") is the controller for the data described here. Contact: privacy@levay.xyz.

When Levay runs in a community, that community's admins decide how it is set up there (which features are on, which messages are posted, what the shop sells). Questions about a specific community can also go to its admins.

2.What we collect

Website and waitlist

• Your email address and where you joined from, when you join the waitlist.
• A spam check by Cloudflare Turnstile, which looks at technical signals from your browser and IP address.
• Request logs: which page or API address was requested and when, used for debugging. They do not contain your IP address or browser.
• Your IP address is used only for a moment, to limit abuse (rate limits) and for the Turnstile spam check; it is not written to logs.

Dashboard account

• Email address and, if you add one, your name.
• Your password, stored only as a secure hash.
• Email verification codes and invite links, stored only as hashes and valid for a short time.
• Your consent record: when you accepted the terms, which version, and whether you opted in to product emails.
• Settings such as the platform you used last.

Linked Discord account and Slack workspaces

• Discord: your user ID, username, avatar and the list of servers you can manage. We do not keep your Discord sign-in token and do not get access to your messages.
• Slack: the workspace ID and name, the installing user's ID, and the access token Levay needs to work.

Inside a community where Levay is added

• Members' platform IDs, display names and avatars, so Levay can show who thanked whom.
• Thanks: who gave and received it, the amount, the reason text, the channel and the time.
• Balances, XP, levels and leaderboard positions.
• Shop orders: product, price, status and any code or content delivered.
• Channel names, role names and custom emoji, so admins can pick them in the dashboard.
• What you send to Levay directly: slash commands, buttons, shortcuts and the message you use "Thank the author" on.

Levay does not read or store the general conversation in your channels.

Community shop page

• If you sign in to a shop page, your Discord or Slack user ID, name and avatar, to show your balance and orders.

Emails

• We send emails you need (verification codes, invites, password resets, important notices). Product news only if you opted in - you can unsubscribe at any time.

Unless a form says a field is optional, Levay needs it to work: without it we cannot create the account or provide that part of the Service. If you are not sure whether something is required, ask us.

If you add other people's personal data to Levay (for example in a message template or a shop item), you are responsible for being allowed to share it.

3.What other people can see

Inside a community, other members can see your name and avatar next to the thanks you give and receive, your level and rank in your profile, and the leaderboard. The community's admins also see orders in their shop. Your remaining daily allowance is shown only to you.

4.Why we use it

We do not sell personal data, use it for advertising or build advertising profiles.

We may also use data to protect our rights in court if Levay is misused, and we may have to disclose it when an authority lawfully requests it. Ask us at any time if you want to know which legal basis applies to something.

5.Who we share it with

Only with service providers that help us run Levay, under contracts that protect the data:

We may also disclose data if the law requires it or to protect people from harm. Data is processed where we and these providers work, so it may leave your country. If data is transferred outside the EEA, we use safeguards such as the European Commission's Standard Contractual Clauses; you can ask us which ones apply.

6.How long we keep it

We may keep data longer only where the law requires it or you agreed to it. When a period ends, the data is deleted, so after that we can no longer give you a copy of it or correct it.

7.Your rights

Under the GDPR and similar laws you can ask us to:

• give you a copy of your data, also in a machine-readable format;
• correct data that is wrong;
• delete your data;
• limit how we use it (we then only store it);
• object to how we use it on the basis of our legitimate interest, explaining why it matters in your situation;
• withdraw a consent you gave, at any time;
• stop product emails, at any time and without giving a reason (or use the unsubscribe link).

Write to privacy@levay.xyz from the email on your account, or with your Discord or Slack username if you are a community member. It is free, and we answer within one month. If we correct or delete data we shared with a provider, we tell them too. You can also complain to your local data protection authority.

Removing someone's data from a community can also remove their balance, XP and order history there.

8.Cookies

We only use cookies that Levay needs to work. No analytics or advertising cookies.

9.Security

Traffic is encrypted with HTTPS. Passwords, verification codes and invite links are stored as hashes, and we do not keep Discord sign-in tokens at all. Only people who need access to run Levay have it. If a breach affects you, we will tell you as the law requires.

10.Children

Levay is not meant for children under 13, or under the age required by law in your country to use Discord or Slack. If you think a child gave us data, write to us and we will delete it.

11.Changes to this policy

If we change this policy in a way that matters, we will tell you by email or in the dashboard before it takes effect. If a change affects something you consented to, we will ask for your consent again. The date at the top shows the latest version.

12.Contact

Privacy questions and requests, including more detail about any processing described here: privacy@levay.xyz.