Margin Levers (“we”, “our”, or “us”) is committed to protecting your privacy. This Privacy Policy explains how we collect, use, disclose, and safeguard your information when you use our application.
1. Information We Collect
We collect information that you voluntarily provide to us when you register on the application, express an interest in obtaining information about us or our products and services, when you participate in activities on the application, or otherwise when you contact us.
Personal Information
We may collect the following types of personal information:
- Account Information: Name, email address, and authentication credentials when you create an account
- Business Data: Customer revenue and profitability data you upload for analysis
- Usage Data: Information about how you interact with our application
- Communication Data: Records of your correspondence with us
Automatically Collected Information
When you access our application, we may automatically collect certain information including your IP address, browser type, operating system, access times, and the pages you have viewed directly before and after accessing the application.
2. How We Use Your Information
We use personal information collected via our application for a variety of business purposes including:
- To provide, operate, and maintain our services
- To process your customer profitability analyses
- To generate AI-powered insights and recommendations
- To improve, personalize, and expand our application
- To understand and analyze how you use our application
- To communicate with you about updates, security alerts, and support
- To comply with legal obligations
2a. Legal Basis for Processing
Where the General Data Protection Regulation (GDPR) applies, we process your personal data only where we have a lawful basis to do so. The table below maps each processing purpose to its legal basis under Article 6 of the GDPR.
| Purpose | Legal Basis | Article |
|---|---|---|
| Account management, service delivery | Performance of a contract | Art. 6(1)(b) |
| AI analysis of your uploaded customer data | Performance of a contract | Art. 6(1)(b) |
| Billing and payment processing (Stripe) | Performance of a contract + Legal obligation | Art. 6(1)(b), (c) |
| Product analytics and usage monitoring (PostHog) | Consent (Art. 6(1)(a)) — you may withdraw consent via cookie settings at any time | Art. 6(1)(a) |
| Marketing emails and product updates | Consent | Art. 6(1)(a) |
| Security monitoring and fraud prevention | Legitimate interests | Art. 6(1)(f) |
3. Data Security
We implement appropriate technical and organizational security measures to protect your personal information against unauthorized access, alteration, disclosure, or destruction. These measures include:
- Encryption: All data is encrypted in transit (TLS 1.3) and at rest (AES-256)
- Access Controls: Row-level security ensures you can only access your own data
- Session-Only Mode: Option to analyze data without server-side storage
- Regular Audits: We regularly review our security practices
4. Data Sharing and Disclosure
We do not sell, trade, or rent your personal information to third parties. We may share your information only in the following circumstances:
- Service Providers: With trusted third-party service providers who assist us in operating our application (e.g., cloud hosting, payment processing)
- Legal Requirements: When required by law or to respond to legal process
- Business Transfers: In connection with a merger, acquisition, or sale of assets
- Consent: When you have given us explicit consent to share your information
Sub-Processors
We use the following sub-processors to deliver our services. Each processes only the minimum data required for its designated purpose.
| Sub-Processor | Purpose | Data Processed | Location |
|---|---|---|---|
| Supabase | Database and authentication | Account data, analysis results | US (AWS us-east-1) |
| Vercel | Application hosting | Request logs, IP addresses | US |
| Anthropic (via OpenRouter) | AI-powered analysis | Analysis prompts, financial data | US |
| Stripe | Payment processing | Billing information, subscription data | US |
| Postmark | Transactional email | Email addresses, notification content | US |
| PostHog | Product analytics | Anonymized usage events | US |
| Cloudflare | DNS and scheduled tasks | Request routing metadata | Global |
We will notify you of any changes to this list via email at least 30 days before engaging a new sub-processor. For the most current list, see our Data Processing Agreement.
Anonymized Benchmark Data
When you save an analysis, we collect anonymized performance metrics to generate industry benchmark comparisons. This data includes:
- Profitability Ratios: profit concentration, tail weight, gross profit margin
- Categorical Data: Industry sector, company size tier
- Aggregate Counts: Number of customers analyzed
We do not collect or transmit:
- Your company name or identity
- Individual customer names, IDs, or transactions
- Specific revenue or cost figures
- Any personally identifiable information
Your user ID is hashed (one-way anonymization) before storage. This anonymized data enables all users to see how their performance compares to industry peers. All users who contribute data receive benchmark comparison features.
5. Data Retention
We retain your personal information only for as long as necessary to fulfill the purposes for which we collected it, including to satisfy legal, accounting, or reporting requirements. For paid subscribers whose subscription is canceled or lapses, identifying personal data (analyses, customer records, AI insights, and chat history) is anonymized within 30 days of cancellation. Your account profile (name and email address) is retained to allow frictionless re-subscription. Anonymized aggregate metrics that cannot be linked back to you are retained indefinitely to power industry benchmarking features available to all users. You may request deletion of your data at any time through your account settings or by contacting us. Diagnostic log data (IP addresses, user agents) is automatically nullified after 90 days.
6. Your Rights
Depending on your location, you may have the following rights regarding your personal data:
- Access: Request a copy of the personal data we hold about you
- Correction: Request correction of inaccurate personal data
- Deletion: Request deletion of your personal data
- Portability: Request a portable copy of your data
- Restriction (Art. 18): You may request we restrict processing of your data in certain circumstances. Submit requests to [email protected].
- Objection: Object to certain processing of your personal data
How to Exercise Your Rights
To exercise any of the rights listed above, please contact us at [email protected]. We respond to all data subject requests within 30 days as required by applicable law. For requests that are complex or numerous, we may extend this period by a further 60 days, in which case we will notify you.
Several rights are available as self-service actions in your account:
- Account deletion is available via Account Settings. Deleting your account permanently removes your profile and schedules all associated analyses for hard deletion within 30 days.
- Data export (portability)is available in Account Settings › Privacy. You can download a JSON file containing your account data, analyses, and preferences at any time.
7. Cookies and Tracking
We use essential cookies to maintain your session and preferences. We use PostHog for privacy-focused analytics to understand how our application is used, based on your consent. You can withdraw consent and manage cookie preferences at any time via your browser settings or the cookie settings link in our footer.
8. Children's Privacy
Our application is not intended for individuals under the age of 18. We do not knowingly collect personal information from children. If you become aware that a child has provided us with personal information, please contact us.
9. Changes to This Policy
We may update this Privacy Policy from time to time. We will notify you of any changes by posting the new Privacy Policy on this page and updating the “Last updated” date. We encourage you to review this Privacy Policy periodically.
10. Contact Us
If you have questions or concerns about this Privacy Policy or our data practices, please contact us at:
- Email: [email protected]
- Website: marginlevers.com