Lever Today · Legal

Privacy Policy

Last updated: September 27, 2026

Lever Today ("the Service") is operated by Manne IT Solutions Private Limited, Hyderabad, Telangana, India ("we", "us"). We build calm software whose business model is subscriptions — we do not sell your personal data, and we do not show advertising. This policy explains what we collect, why, and the controls you have.

1. Information we collect

Account information. Name, email address and authentication identifiers provided when you sign up (we use Authara for secure authentication).
Profile photo (optional). If you set a profile picture in the mobile app, it is cropped and shrunk on your device, then uploaded to us, re-encoded with its metadata (including any location data) removed, and kept in cloud file storage. It is served from a public but unguessable web address, so anyone who has that address can view it. You can remove it at any time from the Account screen in the app (tap your picture, then Remove picture).
Content you create. Contacts, notes, journals, goals, habits, time entries, financial records, health entries and routine configurations you enter into the Service.
Saved cards (optional).The Cards feature lets you keep your own record of your credit cards: name, issuer, network, last four digits, cardholder name, expiry date, credit limit, interest rate, statement and due dates, balance and statement dues, and — only if you choose to enter it — the card's full number. The full number is encrypted at rest and is shown back only to you. We never ask for a card's CVV or PIN. This is a personal record you keep for yourself; it is not how you pay us (see Section 5).
Voice input (optional). When you hold the microphone button to talk to the assistant, the app records your voice and sends the recording to be transcribed (see Section 3). We do not keep the recording; only the resulting text is used.
Information about other people.The People module stores the details you add about your contacts — for example name, email address, phone number, birthday, notes and your history with them. See Section 5 for the email we send when you add a contact with an email address. If you are someone's contact and want your details removed, you can ask them to delete the contact, or email privacy@lever.today.
Feedback and reports. Feedback you send us, and reports you make about an AI assistant reply — which include the reply and the message you sent before it, the reason you chose and any note — so we can review and improve the assistant.
Connected-service data. Only when you explicitly connect an integration (see Section 2), data from that service such as calendar events, contact details, fitness metrics, Google Keep notes, Google Drive file names and details, and Gmail messages (subject, sender and a short snippet, plus the full text of a message when you or the assistant open it).
Usage & device data.Basic logs (IP address, browser type, timestamps, error traces) used for security, debugging and capacity planning. If you turn on notifications in the mobile app, we also store that device's push token and platform (Android or iOS) so we can deliver them. Our servers also record a small number of usage events in our own database — such as signing up, first adding data to a module, creating a routine or sending an assistant message — to understand how the product is used. These events are not sent to any analytics provider.

2. Google user data & the Limited Use disclosure

When you connect Google Calendar, Google Fit, Google Drive, Gmail or Google Contacts, the Service accesses only the scopes you grant on the Google consent screen, and uses that data solely to provide the features you asked for (for example, showing your events, syncing health metrics, or letting the assistant search your mail). At your request the assistant can also act in these services — for example send an email from your Gmail, create, change or delete a Google contact, or upload or delete a Drive file — and Calendar sync adds events you create in Lever Today to your Google Calendar. When you ask the assistant or a routine to work with Google data (say, to read an email), the relevant data is sent to our language-model provider to produce that answer (see Section 3).

Lever Today's use and transfer of information received from Google APIs adheres to the Google API Services User Data Policy, including the Limited Use requirements. Specifically: we only use Google user data to provide user-facing features, we do not transfer it except as necessary to provide those features or as required by law, we do not use it for advertising, and we do not allow humans to read it except with your explicit consent, for security purposes, or to comply with law.

Google Keep works differently

Google Keep does not connect through Google's consent screen. To connect it, you give us your Google email address and a Google App Password you create in your Google Account (or a Google master token you obtain yourself), and we read Keep using an unofficial, open-source library (gkeepapi). We use the App Password once, to obtain a long-lived Google token, and do not store the App Password itself. We store your Google email address and that token — the token encrypted at rest — and use them only to import your Keep notes and checklists into Notes, one way; we never write to Keep. An App Password is not limited to Keep the way a consent-screen permission is, so connect Keep only if you are comfortable with that. Disconnecting deletes our copy of the token and makes a best-effort request to Google to revoke it; to be certain access has ended, also revoke the App Password at myaccount.google.com/apppasswords.

You can disconnect any integration at any time — from Connectors on the web, or Settings → Connections in the mobile app. Disconnecting a Google service revokes our access at Google and stops further syncing; anything already imported (for example events, notes or health entries) stays in your account until you delete it. You can also revoke access from your Google Account permissions page.

3. AI processing

Our assistant and routine features send the minimum necessary context to AI model providers acting as our processors (currently DeepSeek for language models and Groq for voice transcription) to generate a response. This content is used only to produce your result; we contractually require processors not to use your content to train their models. You may use the Service fully without enabling AI features.

What reaches the language model is what the assistant needs for your request: your message (or the transcript of your voice message) and the results of any tools it uses to answer — which can include records from your account or from services you have connected, such as the text of an email. Voice recordings go only to the transcription provider, and we do not keep them.

The assistant's card tools only ever see a saved card's last four digits, never its full number. If you type a full card number into a chat, though, that message is sent to the language model like any other — so please don't.

Telegram. If you link your Telegram account, you can chat with the assistant in Telegram and receive routine results there. Messages, voice notes, photos and documents you send to our bot are handled like assistant chats: text and photos go to our language-model provider, voice notes to our transcription provider, and PDF and text files are converted to text first. The bot keeps your recent conversation in memory for context; it is not saved to our database. Telegram itself carries these messages under its own privacy policy. You can unlink Telegram at any time.

WhatsApp. If you link your WhatsApp number, you can chat with the assistant on WhatsApp and receive routine results there. You link it by sending a one-time code to our WhatsApp business number; from then on, the messages you send that number are handled like assistant chats — text and photos go to our language-model provider, voice notes to our transcription provider, and PDF and text files are converted to text first. Nothing is sent to WhatsApp, or read from it, until you link and message us. We store your WhatsApp phone number so we know the conversation is yours, and show you only a masked form of it; the bot keeps your recent conversation in memory for context, not in our database. WhatsApp is operated by Meta Platforms, which carries these messages under its own terms and is listed on our sub-processors page. You can unlink WhatsApp at any time under Settings → WhatsApp, which deletes the stored number.

Health & financial data are never sent to the AI without your explicit consent. Because health data is a special category under GDPR Article 9 and financial records are sensitive, AI processing of them is off by default. The assistant and routines are blocked from using your health or financial data until you separately turn each one on under Settings → Privacy. Granting that consent is also what authorises the international transfer described in Section 6 (GDPR Art 9(2)(a) and Art 49(1)(a)). You can withdraw either consent at any time, which immediately re-blocks that category.

4. How we use information

To provide, maintain and improve the Service's features you use.
To run the routines and notifications you configure.
To secure accounts, prevent abuse and debug failures.
To send essential service communications (you control marketing emails separately).

Where the GDPR applies, we must tell you the legal basis for each purpose. Ours are:

What we do	Legal basis
Run your account and the features you use	Contract — Art 6(1)(b)
Take payment for a subscription	Contract — Art 6(1)(b)
Send essential service, security and billing emails	Contract — Art 6(1)(b)
Keep the Service secure, prevent abuse, debug failures	Legitimate interests — Art 6(1)(f), in running a safe service
Record basic usage events in our own database (Section 1) — never shared with analytics providers	Legitimate interests — Art 6(1)(f), in understanding and improving the product
Keep records we are legally required to keep (e.g. tax)	Legal obligation — Art 6(1)(c)
Connect a third-party integration you choose	Consent — Art 6(1)(a); withdraw by disconnecting it
Analytics cookies and third-party analytics (Google Analytics, PostHog, Plausible)	Consent — Art 6(1)(a); off until you accept
Marketing emails	Consent — Art 6(1)(a); unsubscribe any time
AI processing of your health data	Explicit consent — Art 9(2)(a) (health data is a special category, so consent is the only basis we rely on) and Art 49(1)(a) for the transfer
AI processing of your financial data	Explicit consent — Art 6(1)(a), separately controlled

Where we rely on consent you can withdraw it at any time without affecting anything we did beforehand. Where we rely on legitimate interests you can object — see Section 9.

5. Sharing

We share personal data only with:

Processors that host and power the Service (cloud hosting, authentication, the AI providers listed above, push-notification delivery, email delivery, error monitoring and file storage) under data-processing agreements. Every one of them is listed on our sub-processors page, with its purpose and location. Subscription payments are handled by Razorpay: the card or other payment details you enter at its checkout go to Razorpay, not to us.
Integrations you connect, at your direction (e.g., sending a Telegram or WhatsApp message you requested).
People you invite.Adding a contact never emails them. We send a contact an email only when you choose “Invite to Lever Today” on their page and confirm: a one-time invitation to try Lever Today, sent to the email address you saved for them. The email includes your name (or, if you have not set a name, your email address).
Analytics providers — Google Analytics, PostHog and Plausible — but only if you allow analytics. They are off by default: nothing loads and no analytics cookie is set until you accept in the consent banner, and turning analytics off under Settings → Privacy stops them again.
Legal authorities when required by applicable law.

We never sell personal data and never share it for cross-context behavioural advertising.

6. International data transfers

We are based in India and some of our processors are located outside your country, so providing the Service can involve transferring your personal data internationally. Where that happens we rely on an appropriate safeguard under Chapter V of the GDPR (for EU/EEA users) and equivalent protections under India's DPDP Act. Our current cross-border processors are:

DeepSeek — China. Language-model processing for the AI assistant and routines. China has not received an EU adequacy decision, so we do notsend special-category (health) or financial context to this provider unless you have given the explicit consent described in Section 3; that consent is the transfer safeguard for such data (GDPR Art 49(1)(a)). Non-sensitive assistant content is covered by a data-processing agreement with standard contractual clauses. You can avoid this transfer entirely by leaving AI features off.
Groq — United States. Voice-to-text transcription when you use voice input. Transfers are covered by a data-processing agreement with standard contractual clauses.
Hosting & authentication providers. Cloud infrastructure and Authara authentication, engaged under data-processing agreements with standard contractual clauses where the provider is outside your region.
Service delivery — United States / India.Expo (United States), which relays push notifications to your phone (through Google's Firebase Cloud Messaging on Android, or Apple's push service on iOS) and serves app updates; Zoho Corporation (Zoho CPaaS / ZeptoMail), United States, which delivers our emails; and Sentry (United States), which receives crash and error reports.
Analytics — United States / EU. Google Analytics and PostHog (US) and Plausible (EU), covered by standard contractual clauses where applicable. These run only with your consent, so you can avoid these transfers entirely by declining analytics.
Connected apps — United States. Composio, which brokers the third-party app integrations you choose to link, under standard contractual clauses.
Telegram. Only if you link your Telegram account (Section 3).
Meta Platforms (WhatsApp) — United States / global. Only if you link your WhatsApp number (Section 3). Meta receives your WhatsApp phone number and the content of the messages exchanged with our business number, under standard contractual clauses. You can avoid this transfer entirely by not linking WhatsApp.

The full, versioned list is on our sub-processors page. You can request a copy of the relevant safeguards by contacting us at the address in Section 12.

7. Retention & deletion

Your content is retained while your account is active. You may delete individual records at any time in-app. Most deleted records (such as contacts, notes, transactions, goals, habits, health entries and routines) disappear from your account straight away but are kept, hidden, in our database until your account itself is deleted.

When you delete your account there is a 30-day grace period during which you can cancel. After it, our next daily purge erases your account and its data from production systems, deletes your sign-in account, cancels any active paid subscription, deletes your profile photo file, revokes your Composio connections and deletes your reports about AI replies. A few records outlive that in a form no longer linked to you: the usage events described in Section 1 (deleted 180 days after they were recorded, on our current settings), other feedback you sent us, and security audit records (their IP address and device details are removed after 90 days, and the records are deleted after a year). If backup copies exist, they expire on a rolling schedule within 90 days of deletion. See our Data Deletion page for step-by-step instructions.

8. Security

Data is encrypted in transit (TLS 1.2+). In addition, some fields are encrypted at rest inside our database: access tokens for Google services, the Google Keep token, full card numbers you choose to save, and the free-text notes and descriptions on financial records and health entries. Personal access tokens are stored only as hashes. Access to production systems is restricted and logged. No method of storage is 100% secure, but we treat your life's data with the seriousness it deserves and will notify you of any breach affecting you without undue delay.

9. Your rights

Subject to applicable law (including India's DPDP Act 2023 and, where applicable, the GDPR), you have the following rights. Use the in-app controls or contact us — we respond within 30 days, free of charge.

Access (Art 15) — get a copy of your data. Settings → Account → Export.
Rectification (Art 16) — correct anything inaccurate, in-app.
Erasure (Art 17) — delete your account and data. Settings → Account.
Restriction (Art 18) — ask us to pause processing while a dispute is resolved.
Portability (Art 20) — your export is machine-readable.
Object (Art 21) — object to processing based on legitimate interests.
Withdraw consent (Art 7(3)) — any time, under Settings → Privacy, without affecting processing already carried out.
Automated decision-making (Art 22) — we do not make decisions with legal or similarly significant effects about you by automated means. The AI assistant only responds to you; it does not decide anything about you.

Complaining to a supervisory authority

If you are in the EU/EEA and think we have handled your data wrongly, you may lodge a complaint with your local data protection authority (Art 77) — the list is at edpb.europa.eu. In India you may complain to the Data Protection Board under the DPDP Act 2023. We would rather hear from you first, but you are not required to contact us before going to a regulator.

Data protection contact

We have not appointed a statutory Data Protection Officer — our processing does not meet the Art 37 thresholds requiring one. Privacy matters are handled directly by our team at privacy@lever.today, which is the contact point for any request or complaint under this policy.

We are established in India and do not currently have an Art 27 EU representative. If our EU-facing activity grows to the point where Art 3(2) applies, we will appoint one and name them here.

10. Children

The Service is not directed to children under 16, and we do not knowingly collect their data.

11. Changes

We will notify you of material changes to this policy by email or in-app notice at least 14 days before they take effect.

12. Contact

Manne IT Solutions Private Limited · Hyderabad, Telangana, India
Privacy questions: privacy@lever.today
General support: support@lever.today