Levanta Privacy Policy

Last Update: January 13, 2025

Previous Version: August 28, 2024

This Levanta Privacy Policy explains our use of the personal information made available to us when you log into and use our application at app.levanta.io, our Knowledge Hub and other services we make available to Creators, Sellers and other users (the “Platform”). Our separate Landing Page Notice of Collection applies to visitor information collected on our homepage, https://levanta.io, and related landing pages.

Welcome

We designed the Levanta Platform with privacy in mind. Levanta.io Inc. and our affiliated entities (“we”, “us”, “our”, or “Levanta”), respect privacy rights. That’s why we strive to minimize the personal information we process through the Platform and offer the transparency and controls described in this Levanta Privacy Policy (“Policy”). This Policy is grouped into these sections:

	Welcome
	Info we collect & how we use it
	Our disclosures of information
	How long we keep your information
	How to control your privacy
	Information about local privacy laws

Please read this Policy in full before you start to use the Platform. By logging into and using the Platform, you acknowledge this Policy will apply to you and accept our Terms of Service, available at https://levanta.io/Terms-of-Service/ (the “Terms”).

If you do not agree to this Policy and the Terms, you must not access or use the Platform. If you have questions about this Policy, please contact us.

The basics

At the outset, you should know that:

We collect and process limited personal info—any that you include in your User ID, profile, or communications you send through the Platform.
We’re committed to transparency. Most of this Policy describes how we use business information that isn’t personal data, but originates with our customers.
We do not sell or share personal information.
We do not collect consumer data from your connected Marketplace account(s), unless you are a Seller and choose to enable the sharing of such information to us, like providing Levanta access to Amazon Selling Partner API (or similar Marketplace tool), which can include information about consumers who interact with a Seller’s listings. See Authorized API Data under Info We Collect & How We Use It for more information.

Our core service relies on attribution data, which includes nothing about the individuals or businesses who interact with Creator affiliate links, view Seller listings or buy Seller products.

Updates to this Policy

As the Platform changes, we’ll update this Policy. If we intend to materially change how we use your personal information, we will notify you before the changes take effect, typically at least two weeks prior. If we have your email, we will notify you that way. We may also post a temporary notice on the Platform or notify you by other means to the extent required by law.

While we will make reasonable attempts to notify you of updates, you acknowledge and agree that it is your responsibility to review the Last Update date periodically and ensure you remain aware of the content of the Policy.

Contact Us

You may contact us regarding the Platform or this Policy at https://levanta.io/contact-us/ or by writing to us at 1752 NW Market Street #4364, Seattle, WA 98107.

Info we collect & how we use it

This table documents, exhaustively, the information we collect, how we collect it, illustrative use cases, the legal bases and purposes for our use and the general duration of our retention of the information. We may also deidentify and aggregate deidentified information, which we may use to improve the Platform, develop new services or other purposes.

Type and Description	How We Collect It	Why We Use It	Legal Basis	Retention
Attribution information Aggregate data from interactions with Platform-generated Attribution links on Marketplaces and referring sources, like total clicks and purchases on listings (typically over a daylong period), including identifiers for Sellers and Creators	Passively, once you directly authorize collection through your Marketplace account, and only until you revoke it.	To provide the core features of the Platform, such as data reporting, invoicing, contract facilitation, analytics and calculations.	Performance of our contracts with the applicable Seller and Creator. Our legitimate interest in improving the Platform.	No less than 24 months, or longer where required by our compliance and reporting efforts under law.
Authorized API data Enhanced data made available by a Marketplace API a Seller connects to the Platform, like Amazon’s Selling Partner API. Where inclusive of consumer-level personal data, see next row.	Passively, once you directly authorize collection, and only until you revoke it.	To provide additional features on the Platform by accessing the further information, like stock levels and product pricing.	Performance of our contracts with the applicable Seller and Creator. Our legitimate interest in improving the Platform.	No less than 24 months, or longer where required by our compliance and reporting efforts under law.
subtype Consumer personal data in Authorized API data Any personal data from a Customer’s Marketplace accounts among its Authorized API data.	Passively, through Authorized APIs	We only process consumer personal data on behalf of the originating Customer, namely to provide that Customer reporting and analytics	Performance of our contract with the originating Seller.	As determined by the originating Customer; deleted upon the termination or expiration of our contract with the originating Seller.
Creator Connections affiliate data: Data from the profiles of affiliates Seller has partnered with through Creator Connections (“Amazon Affiliates”), including their names, biographies, and linked social media and websites.	Directly, once you authorize Levanta’s access to Creator Connections, and only until you revoke it.	To provide and improve the Platform. To display such accessed content or data to users on the Platform.	Our legitimate interest in improving the Platform.	No less than 24 months, or longer where required by our compliance and reporting efforts under law, unless deleted per your request.
User ID information: Name, address, email, phone number, mailing address, age.	Directly, as provided during registration, form submission, content upload, or communication with support.	To provide and improve customer service. To send important notices and updates. For marketing, and promotional purposes, unless you opt-out.	Performance of our contracts with the applicable Seller and Creator. Our legitimate interest in improving the Platform.	User ID lifetime, unless deleted per your request or retained beyond for legal or compliance purposes.
Professional or employment-related information: Information you choose to include in your profile and bio on the Platform about your employer or association with businesses, including history of promoting companies via affiliate marketing.	Directly, as provided by the user.	To provide and improve the Platform. To display such content or data you disclose to users on the Platform.	Performance of a contract. Our legitimate interest in improving the Platform.	User ID lifetime, or until deleted or removed per your instructions.
Commission and payment records: Information related to commission rates, calculations of commissionable amounts, records of transaction amounts and timing.	Directly, as set or determined by you and passively, from Marketplace data and payment provider records.	To provide the Platform, ensure compliance, and improve customer service.	Performance of our contracts with the applicable Seller and Creator. Fraud and legal compliance.	No less than 24 months, or longer where required by our compliance and reporting efforts under law.
Geolocation data: General region or area where you access the Platform, derived in part from IP address.	Passively, through automatic data collection (cookies, web beacons).	To detect unusual or potentially unauthorized logins. To set language preferences. To tailor Creator and Seller suggestions.	Performance of a contract. Fraud and legal compliance.	User ID lifetime, unless deleted per your request or retained beyond for legal or compliance purposes.
Platform activity: Referral channels, browsing and click history, device and browser information, IP address, page views, button clicks, navigation patterns. Support communications	Passively, through first-party technology, Google Analytics and other tracking tools. Directly, as provided by users, for support communications.	To provide and improve customer service, analyze usage trends, and for relevant updates, marketing, and promotional purposes.	Our legitimate interest in improving the Platform’s usability and features. Performance of a contract.	Periodically deleted in the ordinary course.
Inferences: Inferences based on any collected information, except (1) consumer personal data and (2) Platform communications.	Derived from other collected data, other than Platform communications.	To enrich aggregate datasets and create audiences. To analyze and act on predictions. To tailor Seller and Creator suggestions.	Performance of a contract. Our legitimate interest in improving the Platform.	Any collected information contained in inference data is only retained for the period described in the applicable row of this table.
Platform communications: Anything communicated to other users, including information or content uploaded using the Platform.	Directly, as provided by users.	To deliver your message and any content or data you transmit to recipients. Where necessary, to comply with our legal obligations	Performance of a contract.	Periodically deleted in the ordinary course.

Information Storage and Security

We use commercially reasonable security technologies and procedures to help protect your personal information from unauthorized access, use or disclosure. However, we cannot guarantee or warrant the complete safety of information you provide us, and you provide it at your own risk. We are not responsible for the circumvention of any of our privacy or security measures.

We receive, store and process your information in the United States. However, where we have established a service provider or processor relationship with another business, we may transfer your information to that business, which may process the information in other countries.

Our disclosures of information

This section details the ways Levanta discloses your information.

We do not sell, ‘share,’ trade, or rent your personal information: This means we do not provide or exchange your personal information with others to facilitate behavioral ads (i.e., ads targeted to you) or otherwise sell it. For clarity, we have never shared or sold any personal information collected by the Platform for that purpose.
With your consent or at your request: We may disclose your personal information with your consent or as requested by you.
With service providers: We rely on service providers to facilitate some operations of the Platform. Our service providers are contractually bound to process information solely for the purpose of providing their service to us. For example, we may share information with vendors and contractors who conduct email marketing for us or who assist us with developing and providing the Platform and customer support. In the past twelve (12) months, we have disclosed these types of information to the following types of contractors:

Analytics providers, namely Google Analytics, to tell us how the Platform is doing, such as which parts interest visitors and how long they visit before leaving. Among other data, they may receive your IP address.
Various hosting services and data processors to provide the infrastructure of the Platform, such as Amazon Web Services, Inc., which ensures that traffic is from real people, not computers. Among other data, they may receive your IP address.
Payment providers, namely Stripe, Inc., to store payment-account data and process payments between Sellers, Creators and Levanta.
Support providers, namely HubSpot, Inc., to provide assistance to you when you request it. They are able to retrieve information about you that is relevant and necessary to your requests, such as account information.

To comply with applicable law: We may disclose your information where required by our efforts in respect of legal, tax, regulatory and accounting rules. We also disclose information where compelled, required or prudent under applicable law, including in response to subpoenas and other lawful requests by public authorities to provide information to deter and combat fraud, money-laundering and for other legal purposes.
In connection with a corporate transaction involving Levanta: In the context of a reorganization, merger, or sale we may transfer your personal information to the buyer, surviving entity or assignee.

How long we keep your information

We maintain your information for the time necessary to fulfill the purpose for which it was collected, as generally specified under Info We Collect & How We Use It. You acknowledge that longer retention may be required by our compliance efforts toward applicable legal, tax, accounting and regulatory requirements.

Our retention determinations always consider the amount, nature, and sensitivity of the personal information, the potential risk of harm from its unauthorized use or disclosure, and whether we can achieve the purpose for which it was collected without using the personal information.

No children

Only adults are eligible to use the Platform, as described in our Terms. We do not knowingly collect personal information about anyone under the age of 18. If we obtain actual knowledge that we have collected personal information from children, then we will promptly delete it.

If you are under 18, please leave the Platform. If you have already sent us information, please contact us first so we can delete it.
If you are a parent or guardian of a person under 18 and you believe that person provided information to us, please contact us.

How to control your privacy

You have certain choices regarding how we treat your personal information, described below:

Modifications to Platform information: You may review and request modifications to your personal information on the Platform by editing your profile directly on our website or by contacting us. If you provide us with updated information, we will make good-faith efforts to make requested changes in any active database as soon as practicable.
Marketing communications: You can opt out of promotional marketing communications by unsubscribing through the Platform or contacting us. We may give you the option to opt-out of other emails and communications you receive from us. If you opt out, we may still send you non-promotional communications, such as those about your account or our ongoing business.
Rights under local privacy laws: If you have any rights under local privacy laws, please follow the instructions under Requesting Information to exercise them.

International Data Transfers

We receive the information you provide in the United States. By providing your information to us, you consent to the processing of the information in the United States. The transfer of this information to the United States is necessary for the performance of our contract for use of the Platform.

U.S. law is not equivalent to laws in other countries, such as GDPR in Europe or PIPEDA in Canada. As of the Last Update, the U.S. has not been deemed an ‘adequate’ jurisdiction under GDPR for the purposes of international data transfers. However, the EU and the U.S. are negotiating the terms of an adequacy determination that may go into effect in the years to come.
If we transfer personal data subject to GDPR outside of Levanta, we use standard contract clauses approved by the EU for this purpose, or another appropriate transfer mechanism. For example, we may also choose to become party to the Data Privacy Framework between the U.S. and the EU, U.K. or Switzerland.

Requesting Information

Submitting requests: To exercise any rights described in this Policy, please contact us. Your request must:

provide sufficient information to identify you and the law that applies to you, such as your name, email, mailing address, or other information we maintain.
not include social security numbers, driver’s license numbers, third-party account numbers, credit or debit card numbers, or health information.

Verifying requests: We verify requests by first confirming the source of the request and then by matching the information submitted to the information we maintain. If your request is unclear or we are unable to authenticate your identity, we will respond with direction on how to remedy the deficiencies, in accordance with law that applies to you. If we cannot verify the identity of the individual making the request, we may deny it, in full or in part.

Responses to requests: We will respond to your request as quickly as we can, taking into account the nature of your request and the volume of pending requests. The content of our response will vary with the nature of your request, but will always respond in accordance with any deadlines or requirements specified by the laws that apply to you.

Under certain circumstances, we may be unable to provide responsive personal information, such as when disclosure would create a substantial, articulable and unreasonable risk to the security of certain user information or accounts, or the security of our systems or networks.
Please understand, however, that we must retain certain data as described under How long we keep your information. We are unable to delete anything among aggregate deidentified data that may have been derived from information about you.

Appealing decisions: Where the law that applies to you provides an appeal right—such as laws in California, Colorado, Connecticut, and Virginia—you may appeal a decision we have made regarding your request by contacting us.

Information about local privacy laws

The Platform operates from the US, but this Policy applies worldwide. Our practices generally do not differ based on your location, but your rights and choices depend in part on the law where you live. If any of these local privacy laws apply to you, that section overrides any contrary descriptions elsewhere in the Policy as they relate to you.

Information for EU, UK and Swiss residents

If you are a resident of the European Economic Area (“EEA”), you have certain rights and protections under applicable law regarding the processing of your personal information. The term “Personal Information” has the meaning given to it by the European General Data Protection Regulation (“GDPR”). When we process your Personal Information as described in this Policy, we will only do so when (i) we have a legitimate interest in processing your Personal Information (for example, our legitimate interest in providing the Platform, responding to your inquiries, or sending you marketing communications), (ii) the processing is necessary for the performance of a contract between you and us, (iii) the processing is necessary for us to comply with the law, or (iv) you give us consent to process your Personal Information. You have the right to revoke your consent at any time.

All our users have control over their information and can revise information from their account. Users in the European Union and Switzerland have additional rights that you can exercise by contacting us. Those rights include:

Right of access to your personal data
Right to rectify your personal data if they are incorrect
Right to erase your personal data
Right to limit the processing of your personal data
Right to the portability of your personal data
Right to object to the processing of your personal data
Right to withdraw consent (withdrawing consent does not affect the lawfulness of processing based on consent before withdrawal)

If you have a concern about our processing of personal data that we are not able to resolve, you have the right to lodge a complaint with the data privacy authority where you reside. For contact details of your local Data Protection Authority, please see: https://ec.europa.eu/justice/article-29/structure/data-protection-authorities/index_en.htm.

Information for users in Canada

Canadian users have the right to certain additional information with respect to their personal information under the Personal Information and Electronic Documents Act (“PIPEDA”). If you are a Canadian resident, this section applies to you.

Exercising your rights: Users in Canada can exercise additional rights by contacting us. Those rights include:

Right of access to your personal data
Right to rectify your personal data if they are incorrect
Right to withdraw consent (withdrawing consent does not affect the lawfulness of processing based on consent before withdrawal)
Right to file a complaint regarding the processing of your personal data with the Office of the Privacy Commissioner of Canada

Additionally, you may contact Levanta’s Privacy Officer by contacting us.

Information for users in certain U.S. States

If you are a resident of California, Colorado, Connecticut, Utah, Virginia or another state with a similar data-privacy law, you may have additional rights that you (or your authorized agent) can exercise by contacting us, including the right to:

Obtain information about the categories and specific pieces of personal information we have collected and disclosed for a business purpose in the last 12 months
Access and/or receive a copy of certain personal information we hold about you
Correct your personal information
Delete certain personal information we hold about you
Receive information about the financial incentives that we offer to you, if any
Opt out of the processing of your personal information for purposes of profiling, in furtherance of decisions that produce legal or similarly significant effects, if applicable
Not be discriminated against for exercising your rights

You may also have the right to opt out of the sale or “sharing” of your information and “sharing/processing of your information for targeted advertising.” We don’t offer a mechanism for exercising these rights, as we don’t sell or share your personal information and we always limit our use of any sensitive information that you provide us to necessary uses consistent with the purpose of your disclosure.

Certain information may be exempt from disclosure or deletion under applicable law. For example, we need to retain certain information in order to provide our services to you.

Even more information for users in California

In addition to the rights described above, consumers residing in California are afforded the right to certain additional information with respect to their personal information under the California Consumer Privacy Act (“CCPA”):

We collect the personal information specified under Info we collect & how we use it above. If you have any doubt about which CCPA category anything described above falls into, contact us.
To the extent we collect or use sensitive personal information as defined by law (such as the CCPA), we do so in accordance with applicable legal requirements, and we do not use or disclose it other than for purposes for which there is not a right to limit under the CCPA.
We collect personal information for the business and commercial purposes described in the Why We Use It and Legal Basis columns under Info we collect & how we use it above.
We may disclose your personal information with service providers and third parties for business or commercial purposes as described under Our disclosures of information above.
The CCPA sets forth certain obligations for businesses that sell or “share” personal information. We do not sell or share your personal information as those terms are defined in the CCPA.
You can make choices with respect to your information as outlined under How to control your privacy above.
We retain personal information as described under How long we keep your information above.

52331-00002/5252877.8