Privacy Notice

Who we are

Leox AI Assistant, trading as “Leox AI”, is the data controller for the personal data described in this notice. That means we decide why and how your data is processed. You can contact us about privacy at support@leox.ai.

What we collect and why

• Account data (email address, display name, avatar, password hash, sign-in provider) — to create and secure your account and let you sign in. Legal basis: performance of our contract with you.
• Content you submit (chat messages, prompts, uploaded images, generated images) — to produce AI responses and images and to show you your saved history. Legal basis: performance of our contract.
• Usage data (daily message and image counts, model and feature usage, timestamps) — to apply plan limits, prevent abuse and improve the product. Legal basis: performance of our contract and our legitimate interest in running a reliable, non-abused service.
• Technical data (IP address, device and browser information, log and error data) — for security, fraud prevention and diagnostics. Legal basis: legitimate interests.
• Support messages you send us — to answer your questions. Legal basis: legitimate interests.
• Subscription status (plan, status, renewal dates) — to unlock Premium features. Legal basis: performance of our contract.

We do not use your chat content or uploaded images to train our own AI models. Payment card details are collected and processed by Paddle, not by us.

Who we share data with

• Hosting, database and infrastructure providers that store and serve the application and your saved content.
• AI model providers that process your prompts and images to generate responses, on our behalf and under contract.
• Paddle, our Merchant of Record, for the sale of subscriptions, payments, subscription management, invoicing and tax compliance.
• Email delivery providers, for account and service notifications.
• Professional advisers (legal, accounting) where necessary.
• Public authorities where we are required to disclose by law.

We do not sell your personal data.

International transfers

Some of our providers operate outside the UK and EEA. Where data is transferred outside those areas, we rely on appropriate safeguards such as adequacy decisions or Standard Contractual Clauses.

How long we keep data

Account data, chat history and generated images are retained while your account is active and for up to 30 days after you delete your account or the content, after which they are deleted or anonymised. You can delete individual conversations and images at any time in the app. Billing and tax records are kept for as long as required by law (typically 6–10 years). Security and usage logs are kept for up to 12 months.

Your rights

Depending on where you live, you have rights to access, correct, delete, restrict, port, or object to the processing of your personal data, and to withdraw consent where processing is based on consent. Email support@leox.ai to exercise any of these rights; we respond within one month. If you are in the UK or EEA, you also have the right to complain to your local data protection supervisory authority.

Security

We use appropriate technical and organisational measures to protect your data, including encryption in transit, encrypted storage, row-level access controls so users can only reach their own conversations and images, and restricted internal access.

Cookies and similar technologies

We use essential cookies and browser storage only — to keep you signed in, secure your session and remember basic preferences. We do not use advertising cookies. You can clear or block cookies in your browser settings, but the service will not work correctly without the essential ones.

Changes to this notice

We may update this notice from time to time. Material changes will be announced in the app or by email. Questions: support@leox.ai.