← Back to Levamio Review Agent
Privacy Policy "Levamio Review Agent" (web app for businesses)
The German name of the service is "Levamio Bewertungs-Agent".
1. Controller
NEXTLEVEL CORPORATE SERVICE PROVIDER - FZCO, Building A1, IFZA Business Park, Dubai Digital Park, Dubai Silicon Oasis, Dubai, United Arab Emirates (DIEZ License No. 67837), represented by Tassilo Peter Seitz. Levamio is an offering of NEXTLEVEL CORPORATE SERVICE PROVIDER - FZCO (hereinafter "we").
Email for data protection matters: [email protected] (general support: [email protected])
2. Our roles
| Data | Our role | Basis |
|---|---|---|
| Account, company profile, billing, support, usage and security logs of users (Part A) | Controller | this Privacy Policy |
| Customer list, review requests, reviews, reply drafts, click and dispatch logs kept by the user in the app (Part B) | Processor of the user (Art. 28 GDPR) | Data Processing Agreement as an annex to the Terms; the user is the controller |
| Unsubscribes and "sender unknown" reports by recipients of a review request (section 11) | Controller (abuse prevention) and processor (suppression list per company) | section 11 |
Part A – Data of users
3. Overview
| Purpose | Data | Legal basis |
|---|---|---|
| Registration and sign-in via email link | Email address, user ID, sign-in link (stored only as a hash value, valid for 15 minutes, single use), session identifier (only as a hash value, 30 days), timestamps | Art. 6(1)(b) GDPR |
| Bot protection at sign-in (Cloudflare Turnstile) | Verification token; for this purpose Cloudflare evaluates technical browser signals and the IP address | Art. 6(1)(f) GDPR (protection against automated sign-in attempts) |
| Acceptance of the Terms and the Data Processing Agreement | Version, timestamp, accepting user | Art. 6(1)(b), (c), (f) GDPR |
| Confirmation of the reply-to address | Reply-to address, confirmation link (hash value only, valid for 7 days), timestamps, status; in the case of "This wasn't me", a hash value of the address in a suppression list | Art. 6(1)(b), (f) GDPR (protection against misuse of third-party addresses) |
| Company profile and settings | Name, industry, country of establishment, language, reply-to address, review link, sender details (legal notice/imprint), sign-off, tone, own introductory sentence, confirmation of the conditions of the existing-customer exception (timestamp, user), membership and role | Art. 6(1)(b) GDPR |
| Trial period, subscription, billing | Plan, status, end of trial period, Stripe identifiers; at Stripe additionally billing address, VAT ID, payment method | Art. 6(1)(b), (c) GDPR |
| Google Business Profile (optional, once offered) | Refresh token of the Google sign-in (AES-GCM encrypted), selected location, time and errors of the last retrieval | Art. 6(1)(b) GDPR |
| System emails (sign-in link, confirmation of the reply-to address, reminder before deletion) | Email address, content | Art. 6(1)(b) GDPR |
| Operation, security, abuse prevention | IP address on access (Cloudflare), timestamp, request, error codes; rate limits only with hash values of IP or email addresses; dispatch and quota counters per company; block flag in case of abuse | Art. 6(1)(f) GDPR (secure operation, protection against spam via our dispatch channel) |
| Support | Message, email address, company and contract data | Art. 6(1)(b), otherwise (f) GDPR |
We do not engage in automated individual decision-making within the meaning of Art. 22 GDPR. We do not sell data. We send promotional emails to users only with their consent or within the scope of the statutory existing-customer rule, with the option to object.
Obligation to provide data: The details required for registration, sign-in and billing are necessary for concluding the contract. There is no statutory obligation to provide them.
4. Cookies
The web app sets only one strictly necessary session cookie (lvr_session, HttpOnly, 30 days) and stores the selected language in the browser (localStorage). On the sign-in page, Cloudflare's Turnstile widget loads, which may process in the browser information required for the bot check. Legal basis: § 25(2) no. 2 TDDDG (German Telecommunications Digital Services Data Protection Act; exemption for strictly necessary storage and access), Art. 6(1)(b) GDPR. We do not set analytics, advertising or tracking cookies – neither in the app nor on the redirect pages of the QR codes and links.
5. Billing via Stripe
You purchase subscriptions via Stripe Checkout. Stripe collects payment and billing data and processes it for payment processing and fraud prevention partly as an independent controller and otherwise as our processor. We do not receive complete card data.
6. Retention period (Part A)
- Account and company profile: until the end of the contract or deletion of the account. The end of the contract is the end of a cancelled subscription or – if no subscription was purchased after the free trial period – the end of the trial period. We delete 30 days after the end of the contract unless a retention obligation applies; approximately 7 days beforehand we remind you by email. You can delete your account and company yourself at any time (Settings, after entering the company name).
- Sign-in links: deleted one day after expiry. Sessions: 30 days or until sign-out. Confirmation links for the reply-to address: entries after 31 days. Rate limit counters: 24 hours.
- "This wasn't me" suppression list (hash value only): permanently, so that the block remains effective.
- Billing and contract data: for the duration of statutory retention periods (depending on the applicable law, up to 10 years).
- Server logs: generally no more than 30 days. Support requests: up to 3 years after closure.
Part B – Data of the users' customers (processing on behalf)
7. What we process on behalf of users
The user decides whom to ask for a review and which replies to publish. For this purpose we process on the user's behalf:
- Customer list: name, email address, language, country, legal basis for email requests (consent with date and evidence, or existing customer with date of the purchase/service and notice of the right to object), time of the last request, unsubscribe status, origin (manual/CSV);
- Review requests: recipient, language, legal basis at the time of dispatch (evidence), status (delivered, simulated, failed), timestamp, identifier of the dispatch service, time of the first click;
- QR codes and links: label and number of visits per day (aggregated, without IP address, without cookies, without device identifier);
- Reviews: display name of the author, stars, text, date, language, existing reply, automatically detected flags (e.g. "health", "legal"); the source is pasting by the user or – once offered – the user's Google Business Profile;
- Reply drafts: text, origin (template, AI, user), approval (timestamp, person, checksum), publication.
No health data: The app is not intended for special categories of personal data (Art. 9 GDPR). Users from health professions do not record any information on treatments in the customer list; for reviews with a health context, the app advises not to include health information in replies and not to confirm a treatment relationship.
8. Sending review requests (Resend)
Email requests are only possible to contacts for whom the user has documented a legal basis; before each dispatch the app checks the stored country rules, unsubscribes and a minimum interval of 180 days between two requests. Dispatch to end customers is being enabled step by step; until then, requests are only simulated and not delivered. We send via Resend (Resend, Inc., USA; dispatch region EU). The sender is the user: the email bears the user's name with the suffix "via Levamio" (in German "über Levamio"), a sender address of our dispatch domain, the user's confirmed reply-to address, the user's sender details, the reason for receipt and an unsubscribe link. Resend receives the recipient address, sender, subject, text and technical delivery details. We do not use open tracking (tracking pixels). We route the link to the review page via our domain in order to record the first click per request for the user's statistics; in doing so we do not store any IP address.
9. AI reply drafts (Anthropic, optional)
Only if the user requests an AI draft do we send to Anthropic (Anthropic PBC, USA): the text and stars of the review, the user's name, industry and desired tone, and an optional note. Not sent are the author's display name, email addresses or the customer list. Drafts are automatically checked for contact details, links and (for medical practices) health information and are only published after editing and approval by the user. According to Anthropic's current information, API data is not used for training and is generally deleted within 30 days.
10. Google Business Profile (optional, once offered)
If the user connects their Google Business Profile, we retrieve, with the user's authorisation, the reviews of the selected location and publish exclusively replies that the user has approved and expressly selected for publication. Google is the user's contractual partner in this respect. The user can disconnect at any time; the stored token is then deleted.
11. Notice for recipients of a review request and visitors of the QR links
If you have received a review request "via Levamio" or scanned a QR code: The controller is the company that wrote to you or displayed the code. We only provide the software. Please direct questions and data protection requests to that company (replying to the email is sufficient); if your request reaches us, we will forward it.
When you open a QR code or link, we redirect you without an intermediate page to the public review page (e.g. Google). In doing so we count only the visit (date, code), without IP address and without cookies; technically, Cloudflare processes your IP address for delivery (section 12). The privacy terms of the review platform apply to that platform.
Unsubscribe / sender unknown: Using the link in each request, you can unsubscribe from further requests from that company (also via the one-click unsubscribe of your email program). We then store a hash value of your email address in that company's suppression list for as long as the company uses Levamio, so that you are not contacted again even after a new import. If you report "I don't know the sender", we additionally store the identifier of the request, the company concerned and the timestamp for 365 days; if reports concerning three different requests from the same company are received within 7 days, we automatically block its dispatch. We use your IP address only as a hash value to limit requests (deleted after 24 hours). We are the controller for abuse prevention; the legal basis is Art. 6(1)(f) GDPR (protection of recipients and of our dispatch channel) or Art. 6(1)(c) GDPR (compliance with the objection).
12. Retention period (Part B)
We store data of the user's customers for as long as the user keeps it in the app. We automatically delete request logs (including evidence of the legal basis) and click counters after 24 months, and discarded reply drafts after 90 days. The user can export all data at any time (JSON, customer list as CSV) and delete it together with their account. After the end of the contract, we delete it 30 days after the end of the contract; approximately 7 days beforehand we remind the user by email.
13. Recipients and third countries
| Service | Purpose | Seat / processing | Safeguard |
|---|---|---|---|
| Cloudflare | Hosting (Workers, Static Assets), database (D1), scheduling, bot protection (Turnstile), redirects, logs | Cloudflare, Inc., USA; primary database location Western Europe, processing at the edge worldwide | Data processing agreement; Standard Contractual Clauses or DPF, where applicable |
| Resend | Sending system emails and review requests | Resend, Inc., USA; dispatch region EU | Data processing agreement; Standard Contractual Clauses or DPF, where applicable |
| Anthropic (optional) | AI reply drafts | Anthropic PBC, USA | Data processing terms; Standard Contractual Clauses or DPF, where applicable |
| Stripe | Billing of the subscription | Stripe entity of our account; Stripe, Inc., USA | Independent controller or processor; Standard Contractual Clauses or DPF, where applicable |
| Google (optional) | Retrieval of reviews, publication of approved replies | Google entity of the user | Contractual partner of the user |
Third countries: For the USA, the adequacy decision on the EU-US Data Privacy Framework applies where the recipient is certified, otherwise Standard Contractual Clauses (Art. 46(2)(c) GDPR). We are established in the United Arab Emirates; there is no adequacy decision for that country. We apply the GDPR to the extent it applies to our offering and access the stored data only via encrypted, authenticated connections. For data of the users' customers, the Standard Contractual Clauses of the EU Commission (Module 2) are agreed in the Data Processing Agreement.
14. Security
HTTPS, encrypted storage of Google tokens (AES-GCM), sign-in, confirmation and request links as well as sessions only as hash values, bot protection and rate limits, strict separation of data per company in every query, protection against cross-site request forgery, redirects only to known review platforms, verification of the legal basis before every dispatch, dispatch limits, unsubscribe and report link with automatic blocking, emergency stop for dispatch.
15. Your rights
You have the right of access (Art. 15), rectification (Art. 16), erasure (Art. 17), restriction (Art. 18), data portability (Art. 20) and to object to processing based on legitimate interests (Art. 21 GDPR). Requests to [email protected]; we generally respond within one month. As a recipient of a review request, please contact the requesting company (section 11). You can withdraw consent at any time with effect for the future. You can lodge a complaint with a data protection supervisory authority, in particular in the EU/EEA member state of your habitual residence, your place of work or the place of the alleged infringement, and in Switzerland with the FDPIC (EDÖB, Federal Data Protection and Information Commissioner).
Right to object (Art. 21 GDPR): Where we process data on the basis of legitimate interests (e.g. bot protection, abuse prevention), you may object at any time on grounds relating to your particular situation. We will then no longer process the data unless we demonstrate compelling legitimate grounds or the processing serves legal claims.
16. Changes
We adapt this Policy when features, service providers or the legal situation change; we inform users of material changes by email. Current version: https://levamio.com/apps/bewertungs-agent/datenschutz-en/
As of: 21 October 2026