Privacy policy

Leveld, Luxembourg, is responsible for the personal data described on this page and is the contact for anything concerning it. When Leveld incorporates, this page will name the legal entity and its registered address.

Only what the product needs to work:

• Account data — your email address and a one-way hash of your password. The password itself is never stored.
• Security data — two-factor secrets and passkey credentials, if you enable them.
• Portfolio data — the read-only exchange API keys you connect, encrypted at rest, and the transactions and holdings you add manually.
• Session data — strictly necessary, HTTP-only cookies that keep you signed in. Leveld runs no advertising and no third-party analytics trackers.

• Running the product — computing balances, performance and the analysis you ask for.
• Keeping your account safe — authentication, abuse prevention and an append-only audit log.
• Meeting legal obligations that apply to Leveld.

We do not sell your personal data, and we do not use it for advertising.

Your data is not shared with third parties, except the service providers that host and operate Leveld under contracts that bind them to these same rules. Leveld is hosted by Netcup, in Germany.

A small, named group of Leveld staff can open your account record to answer a support request or to investigate a security concern. They must state a reason before doing so, that reason and their name are recorded, and they cannot see your password or your two-factor secret. Every one of those reads — including any that were refused — appears in Security → Account access in your own dashboard, so you can see what happened without having to ask us.

For as long as your account exists. If you delete your account, your personal data is deleted with it; anything the law requires Leveld to keep longer is kept only for that purpose, and only for as long as that law says. Retention follows the GDPR’s storage-limitation principle; a detailed per-record schedule is being implemented.

Under the GDPR you can ask, at any time, to:

• see a copy of the data Leveld holds about you
• correct data that is wrong or incomplete
• receive your data in a machine-readable format
• have your data erased
• restrict or object to a particular use of it

You can also lodge a complaint with the data-protection authority in your country.

Privacy requests are answered by a person, not an automated pipeline. Write to the data-protection contact:

dpo@leveld.app