Levanta global privacy policy.

1.1 About Levanta

Levanta ("Levanta", "we", "us", or "our") operates a global digital personal development platform including website and mobile application services (the "Platform"). Levanta is registered in Israel as a Licensed Dealer (Osek Murshe), Certificate No. 316751049, and operates under Israeli law. This Privacy Policy applies to all users worldwide, regardless of their location or the device they use to access our services.

Our Platform is designed to provide structured personal growth experiences, combining discipline, structure, and community to help individuals achieve their long-term development goals. We are committed to protecting your privacy and ensuring that your personal information is handled responsibly and transparently throughout your journey with us.

1.2 Scope of This Policy

This Privacy Policy governs the collection, use, processing, storage, transfer, and protection of personal data collected through the Platform, including data collected directly from users and automatically through technical systems. This policy applies to all features, services, and functionalities offered through our website, mobile applications, and any other digital interfaces we may provide.

The scope of this policy extends to cover all interactions you have with Levanta, including but not limited to: account registration and management, subscription and payment processing, participation in community features, communication with our support team, and any analytics or performance tracking that helps us improve our services. We encourage you to read this policy carefully to understand how we handle your information at every stage of your interaction with our Platform.

1.3 Acceptance

By accessing or using the Platform, you acknowledge that you have read, understood, and agreed to the practices described in this Privacy Policy. If you do not agree with any part of this policy, you should discontinue use of the Platform immediately. Your continued use of our services constitutes your ongoing acceptance of this policy and any updates we may make to it over time. We recommend reviewing this policy periodically to stay informed about how we protect your information.

2.1 Account Data

Account data includes your full name, email address, username, encrypted credentials, and any profile information voluntarily submitted by you during registration or profile updates. This information is essential for creating and maintaining your account, personalizing your experience, and enabling you to access the full range of features available on our Platform. We store this information securely using industry-standard encryption methods and access controls. Your account data allows us to recognize you when you return to the Platform, maintain your progress history, and provide personalized recommendations based on your growth journey. We may also use your name and email address to communicate important updates about your account or our services.

2.2 Payment Data

Payment information is processed exclusively by secure third-party payment providers who specialize in handling financial transactions safely and in compliance with industry standards such as PCI DSS (Payment Card Industry Data Security Standard). Levanta does not directly store, process, or have access to your complete credit card numbers, bank account details, or other sensitive financial information. We may receive limited transaction confirmation data from our payment processors, including billing status, subscription tier, payment confirmation numbers, and renewal dates. This information is necessary for us to manage your subscription, provide accurate billing records, and ensure uninterrupted access to premium features. Our payment partners employ advanced security measures including encryption, tokenization, and fraud detection systems to protect your financial data at all times.

2.3 Technical and Usage Data

Technical and usage data encompasses a wide range of information collected automatically when you interact with our Platform. This includes your IP address, which helps us understand your general geographic location and detect potential security threats. We collect device identifiers, browser type and version, operating system information, screen resolution, and language preferences to optimize our Platform's performance across different devices and configurations. Usage data includes session duration, pages visited, features used, interaction patterns, click-through rates, and performance diagnostics. This information helps us understand how users engage with our Platform, identify areas for improvement, troubleshoot technical issues, and develop new features that better serve our community. All technical data is collected and processed in accordance with applicable privacy laws and is used solely to enhance your experience and maintain the security and stability of our services.

2.4 Communication Data

Communication data includes all correspondence between you and Levanta, such as support inquiries, feedback submissions, feature requests, bug reports, and any other messages you send to our team through official channels. This data may include the content of your messages, timestamps, communication channel used, and any attachments you provide. We retain this information to provide effective customer support, track and resolve issues, improve our services based on user feedback, and maintain a record of our interactions for quality assurance purposes. Communication data may also include your preferences for receiving marketing communications, newsletters, and platform updates. We respect your communication preferences and provide easy options to manage how and when we contact you.

3.1 Consent

Where required by law, we process certain personal data based on your explicit consent. This includes optional data collection such as marketing communications, cookies for analytics purposes, and participation in surveys or research programs. You have the right to withdraw your consent at any time, and doing so will not affect the lawfulness of processing based on consent before its withdrawal. We make it easy for you to manage your consent preferences through your account settings or by contacting our support team. When we rely on consent as our legal basis, we ensure that consent is freely given, specific, informed, and unambiguous, in accordance with GDPR requirements.

3.2 Contractual Necessity

We process personal data that is necessary to fulfill our contractual obligations to you under the Terms of Service. This includes processing required to create and maintain your account, provide access to Platform features, manage your subscription, process payments, deliver the services you have requested, and communicate with you about your account and our services. Without processing this data, we would be unable to provide you with the core functionality of our Platform and fulfill our commitments to you as a member of the Levanta community.

3.3 Legitimate Interests

We may process personal data based on our legitimate interests, provided these interests are not overridden by your fundamental rights and freedoms. Our legitimate interests include improving and optimizing our Platform, ensuring the security and integrity of our services, preventing fraud and unauthorized access, analyzing usage patterns to develop new features, conducting internal research and analytics, and maintaining the operational efficiency of our business. We carefully balance our interests against your privacy rights and implement appropriate safeguards to minimize any potential impact on your privacy. You have the right to object to processing based on legitimate interests, and we will honor such requests unless we can demonstrate compelling legitimate grounds that override your interests.

3.4 Legal Compliance

We process personal data when necessary to comply with applicable legal and regulatory obligations. This includes obligations under tax laws, financial regulations, data protection laws, court orders, subpoenas, and other legal requirements imposed by governmental authorities. We may also process data to establish, exercise, or defend legal claims, protect our legal rights, and respond to requests from law enforcement agencies in accordance with applicable procedures. When we process data for legal compliance purposes, we do so only to the extent required by law and implement appropriate measures to protect your privacy interests.

4.1 Service Delivery

The primary purpose of processing your personal data is to provide, operate, maintain, and improve the Platform and its features. This includes enabling you to create and access your account, navigate through different sections of the Platform, track your personal growth progress, access educational content and resources, participate in community features, and utilize all the tools and functionalities we offer. We continuously work to enhance the user experience, fix bugs, optimize performance, and introduce new features that support your development journey. Your data helps us understand how to best serve you and deliver a Platform that meets your needs and exceeds your expectations.

4.2 Subscription Management

We process personal data to manage all aspects of your subscription relationship with Levanta. This includes processing initial subscription sign-ups, managing billing cycles and payment processing, handling subscription tier upgrades or downgrades, sending renewal reminders and payment confirmations, managing cancellation requests, and maintaining accurate records of your subscription history. We use this information to ensure you have uninterrupted access to the features included in your subscription tier and to provide transparent billing practices. Our subscription management processes are designed to be seamless and user-friendly, with clear communication about any changes to your subscription status.

4.3 Analytics and Improvements

We analyze user behavior, engagement patterns, and feedback to continuously improve our Platform and develop new functionalities that better serve our community. Analytics processing helps us understand which features are most valuable to users, identify pain points in the user experience, measure the effectiveness of our content and programs, and make data-driven decisions about Platform development. We use aggregated and anonymized data wherever possible for analytics purposes to minimize privacy impact while still gaining valuable insights. Our commitment to improvement is driven by our desire to provide the most effective personal development platform possible, and your data plays a crucial role in helping us achieve this goal.

4.4 Security and Fraud Prevention

Protecting our Platform and our users is of paramount importance. We process personal data to detect, investigate, and prevent unauthorized access attempts, fraudulent activities, policy violations, and other potentially harmful behaviors. This includes monitoring for suspicious login attempts, unusual account activity, payment fraud, and violations of our Terms of Service. We employ advanced security technologies and protocols to safeguard your data and maintain the integrity of our Platform. Our security measures are regularly reviewed and updated to address emerging threats and vulnerabilities. By processing data for security purposes, we create a safer environment for all members of the Levanta community.

4.5 Communication

We process personal data to communicate with you about important matters related to your account and our services. This includes sending administrative notices such as account verification emails, password reset requests, and subscription confirmations. We also send service updates about new features, maintenance schedules, and policy changes that may affect your use of the Platform. Security notifications alert you to potential issues with your account or important security updates. Additionally, with your consent, we may send promotional communications about new content, special offers, and community events. You can manage your communication preferences at any time through your account settings.

5.1 Types of Cookies

Our Platform uses various types of cookies and similar technologies to enhance your experience and provide our services effectively:

• Essential Cookies: These cookies are strictly necessary for the operation of our Platform. They enable core functionalities such as user authentication, session management, security features, and load balancing. Without these cookies, the Platform cannot function properly, and they cannot be disabled.
• Functional Cookies: These cookies remember your preferences and settings, such as language selection, display preferences, and personalization options. They enhance your experience by providing features tailored to your needs and remembering choices you make across sessions.
• Analytics Cookies: These cookies help us understand how users interact with our Platform by collecting information about pages visited, time spent on different sections, navigation patterns, and error encounters. This data is used to improve our services and user experience.

5.2 Third-Party Analytics

We may use third-party analytics tools and services to better understand Platform performance, user engagement, and areas for improvement. These tools may use their own cookies and tracking technologies to collect information about your use of our Platform. Third-party analytics providers process data on our behalf and are contractually obligated to use the data only for providing analytics services to us and not for their own purposes. We carefully select analytics partners who demonstrate strong privacy practices and compliance with applicable data protection laws. The insights we gain from analytics help us make informed decisions about Platform development, content creation, and feature prioritization.

5.3 Cookie Management

You have control over how cookies are used on your device. Most web browsers allow you to manage cookie settings through the browser preferences or settings menu. You can choose to block all cookies, accept all cookies, or selectively accept certain types of cookies. Please note that blocking essential cookies may prevent you from accessing certain features or using the Platform at all. Blocking functional cookies may affect your personalized experience, and blocking analytics cookies limits our ability to improve our services based on user behavior. We recommend reviewing your browser's help documentation for specific instructions on managing cookies. Some browsers also offer "Do Not Track" signals, which we respect to the extent technically feasible.

6.1 Global Operations

As a global platform serving users worldwide, your personal data may be processed in Israel, where Levanta is based, or in other jurisdictions where our service providers, hosting partners, and infrastructure providers operate. This may include countries within and outside the European Economic Area (EEA). We work with carefully selected partners and service providers around the world to deliver our services efficiently and reliably. The global nature of our operations enables us to provide consistent, high-quality service to users regardless of their location, while also ensuring redundancy and disaster recovery capabilities that protect your data and maintain service availability.

6.2 Safeguards

When we transfer personal data across international borders, we implement appropriate safeguards to ensure that your data receives an adequate level of protection regardless of where it is processed. These safeguards may include Standard Contractual Clauses approved by relevant data protection authorities, adequacy decisions recognizing certain countries as providing adequate data protection, binding corporate rules for transfers within corporate groups, and other legally recognized transfer mechanisms. We assess the data protection laws and practices of each country where data may be transferred and implement additional technical and organizational measures as needed to address any identified risks. Our commitment to protecting your data extends across all jurisdictions where we operate.

7.1 Service Providers

We share personal data with carefully selected third-party service providers who assist us in operating and improving our Platform. These providers include cloud hosting and infrastructure services that store and process data securely, payment processors that handle subscription transactions, analytics services that help us understand user behavior, customer support platforms that enable us to assist users effectively, email service providers that deliver transactional and marketing communications, and security services that protect against threats and fraud. All service providers are bound by contractual obligations to protect your data, use it only for the purposes we specify, and maintain appropriate security measures. We conduct due diligence on our providers and regularly review their compliance with our data protection requirements.

7.2 Legal Requirements

We may disclose personal data when required by law, regulation, legal process, or governmental request. This includes responding to court orders, subpoenas, search warrants, or other lawful requests from law enforcement agencies and regulatory bodies. We may also disclose data when we believe in good faith that disclosure is necessary to protect the rights, property, or safety of Levanta, our users, or the public. This includes exchanging information with other companies and organizations for fraud protection, cybersecurity purposes, and credit risk reduction. When legally permitted, we will attempt to notify affected users of such disclosure requests unless doing so would be prohibited by law or would jeopardize an investigation.

7.3 Business Transfers

In the event of a merger, acquisition, reorganization, bankruptcy, asset sale, or other business transaction involving Levanta, your personal data may be transferred to the acquiring entity or successor organization as part of the transferred assets. In such circumstances, we will take reasonable steps to ensure that your data continues to be protected in accordance with this Privacy Policy or a policy that provides equivalent or greater protection. We will notify you of any such transfer and any changes to the privacy practices that may result, giving you the opportunity to exercise your rights regarding your personal data before the transfer is completed.

8.1 Retention Period

We retain personal data only for as long as necessary to fulfill the purposes for which it was collected, comply with our legal obligations, resolve disputes, enforce our agreements, and support legitimate business operations. The specific retention period for different types of data varies based on the nature of the data, the purposes of processing, and applicable legal requirements. Account data is typically retained for the duration of your account's existence plus a reasonable period thereafter to allow for account recovery. Transaction and billing data may be retained longer to comply with tax and accounting regulations. Technical and usage data is generally retained for shorter periods unless needed for security or legal purposes. We regularly review our data retention practices and delete or anonymize data that is no longer needed.

8.2 Account Deletion

You have the right to request deletion of your account and associated personal data at any time. Upon receiving a valid deletion request, we will delete your personal data within a reasonable timeframe, subject to certain exceptions. We may retain limited data as necessary to comply with legal obligations (such as tax reporting requirements), resolve ongoing disputes, enforce our Terms of Service, or protect our legitimate interests. Anonymized or aggregated data that cannot be used to identify you may be retained for analytics and research purposes. When you delete your account, you will lose access to all Platform features, your progress history, and any premium content associated with your subscription. We recommend downloading any data you wish to keep before submitting a deletion request.

9.1 Safeguards

We implement comprehensive administrative, technical, and physical safeguards designed to protect personal data against unauthorized access, alteration, disclosure, or destruction. Our security measures include:

• Encryption: Data is encrypted both in transit (using TLS/SSL protocols) and at rest (using AES-256 encryption) to protect against interception and unauthorized access.
• Access Controls: Strict access controls limit who within our organization can access personal data, with access granted only on a need-to-know basis and subject to regular review.
• Authentication: Strong authentication mechanisms, including multi-factor authentication options, protect account access.
• Monitoring: Continuous monitoring systems detect and alert us to potential security incidents, unusual activity, and unauthorized access attempts.
• Regular Audits: We conduct regular security assessments, vulnerability scans, and penetration testing to identify and address potential weaknesses.
• Employee Training: All employees receive regular training on data protection, security best practices, and their responsibilities in safeguarding user data.

9.2 Limitations

While we implement robust security measures, no method of transmission over the Internet or electronic storage is completely secure. We cannot guarantee absolute security of your data against all possible threats, including sophisticated cyberattacks, zero-day vulnerabilities, or events beyond our reasonable control. Users acknowledge and accept the inherent risks associated with transmitting data over the Internet and using online services. We encourage you to take steps to protect your own data, including using strong, unique passwords, enabling multi-factor authentication when available, keeping your devices and software updated, and being cautious about phishing attempts and suspicious communications. If you believe your account has been compromised, please contact us immediately so we can take appropriate action.

10.1 Access and Portability

You have the right to request access to the personal data we hold about you. Upon verification of your identity, we will provide you with information about what data we process, the purposes of processing, the categories of recipients, and the retention periods. Where technically feasible and legally required, you have the right to receive your personal data in a structured, commonly used, and machine-readable format (data portability), enabling you to transfer your data to another service provider. We will respond to access and portability requests within the timeframes required by applicable law, typically within 30 days of receiving a valid request.

10.2 Correction and Deletion

You have the right to request correction of inaccurate or incomplete personal data we hold about you. We encourage you to keep your account information accurate and up to date by using the profile settings in your account. You also have the right to request deletion of your personal data under certain circumstances, such as when the data is no longer necessary for the purposes for which it was collected, when you withdraw consent (where consent is the basis for processing), when you object to processing based on legitimate interests, or when data has been unlawfully processed. We will honor deletion requests to the extent permitted by law, subject to our legitimate retention needs and legal obligations.

10.3 Restriction and Objection

Under applicable data protection laws, you may have the right to request restriction of processing of your personal data in certain circumstances, such as when you contest the accuracy of the data or when processing is unlawful but you oppose deletion. You also have the right to object to processing of your personal data based on legitimate interests or for direct marketing purposes. When you exercise your right to object, we will cease processing your data for the specified purposes unless we can demonstrate compelling legitimate grounds that override your interests, rights, and freedoms, or if processing is necessary for the establishment, exercise, or defense of legal claims. We make it easy to exercise these rights through your account settings or by contacting our support team.

11.1 Right to Know

California residents have the right to request disclosure of the categories and specific pieces of personal information we have collected about them, the categories of sources from which the information was collected, the business or commercial purposes for collecting the information, and the categories of third parties with whom we share personal information. You may submit a verifiable consumer request for this information up to twice within a 12-month period. We will respond to verified requests within 45 days, with the possibility of a 45-day extension if reasonably necessary and with notice to you.

11.2 Right to Delete

California residents have the right to request deletion of personal information we have collected from them, subject to certain legal exceptions. These exceptions include situations where retention is necessary to complete a transaction, provide a requested service, detect and protect against security incidents, comply with legal obligations, or engage in research in the public interest. When we receive a valid deletion request, we will delete the personal information from our records and direct our service providers to do the same, unless an exception applies.

11.3 No Sale of Personal Information

Levanta does not sell personal information to third parties for monetary or other valuable consideration. We do not engage in the sale of personal information as defined under the CCPA/CPRA. We share personal information with service providers who assist us in operating our business, but these are not considered sales under California law because the providers are contractually bound to use the data only for the purposes we specify. California residents will not be discriminated against for exercising their privacy rights under the CCPA/CPRA.

12.1 Incident Response

We have established comprehensive procedures to detect, investigate, and respond to potential data breaches and security incidents. Our incident response team is trained to act quickly and effectively when a potential breach is identified. Response procedures include immediate containment measures to prevent further unauthorized access, thorough investigation to determine the scope and nature of the incident, assessment of potential impacts on affected individuals, implementation of remediation measures to address vulnerabilities, and documentation of all actions taken. We regularly test and update our incident response procedures to ensure they remain effective against evolving threats.

12.2 Notification

In the event of a data breach that is likely to result in a risk to the rights and freedoms of affected individuals, we will notify the relevant data protection authorities and affected users as required by applicable law. Notifications will be made without undue delay and, where feasible, within the timeframes specified by applicable regulations (such as 72 hours under GDPR). Breach notifications will include a description of the nature of the breach, the categories and approximate number of individuals affected, the likely consequences of the breach, and the measures taken or proposed to address the breach and mitigate its effects. We will also provide recommendations for steps affected individuals can take to protect themselves.

13.1 Data Controller

Levanta acts as the data controller for personal data processed through the Platform. As data controller, we determine the purposes and means of processing your personal data and are responsible for ensuring that processing activities comply with applicable data protection laws. We are accountable for implementing appropriate technical and organizational measures to protect your data, maintaining records of processing activities, conducting data protection impact assessments where required, and cooperating with data protection authorities. Our role as data controller encompasses all personal data collected directly from you, automatically through your use of the Platform, and from third-party sources where applicable.

13.2 Processor Obligations

When we engage third-party service providers to process personal data on our behalf, these providers act as data processors under our direction. All processors are bound by data processing agreements that require them to process personal data only according to our documented instructions, implement appropriate security measures to protect the data, assist us in responding to data subject requests, notify us promptly of any data breaches, delete or return personal data upon termination of services, and submit to audits and inspections to verify compliance. We carefully vet all processors before engagement and regularly monitor their compliance with contractual and legal obligations. Processors are prohibited from sub-contracting processing activities without our prior written consent.

14.1 Age Restriction

The Platform is designed for adults and is not intended for use by individuals under 18 years of age. We do not knowingly collect, solicit, or accept personal data from children under 18. By using the Platform, you represent and warrant that you are at least 18 years old and have the legal capacity to enter into binding agreements. The content, features, and community aspects of our Platform are designed for adult users who are ready to take responsibility for their personal growth journey. Parents and guardians should monitor their children's online activities and prevent them from providing personal information to services intended for adults.

14.2 Removal

If we discover or are notified that we have collected personal data from an individual under 18 years of age, we will take immediate steps to delete that information from our systems in accordance with applicable laws, including the Children's Online Privacy Protection Act (COPPA) in the United States and equivalent laws in other jurisdictions. If you believe that we have inadvertently collected personal data from a minor, please contact us immediately at the address provided below, and we will investigate and take appropriate action. We may also take steps to prevent the minor from further accessing the Platform.

15.1 Jurisdiction

Any disputes arising out of or relating to this Privacy Policy or our data processing practices shall be subject to the exclusive jurisdiction of the competent courts in Israel. However, this does not affect any mandatory consumer protection rights you may have under the laws of your country of residence, including rights under GDPR for EEA residents or CCPA for California residents. We will comply with applicable local laws regarding data protection even where those laws provide greater protection than Israeli law. By using our Platform, you consent to the transfer and processing of your data in Israel while acknowledging that you retain any rights afforded to you by your local data protection laws.