Privacy Notice
Version 2026-08-13 · Effective 13 August 2026
LevelUpWith is operated by Zapital Ltd, a company registered in England and Wales under company number 09161415, with its registered office at 32 Stone Hall Road, London, England, N21 1LP.
For privacy, legal, customer-service and other direct enquiries, email levelupwith@zapital.com. Other direct contact information may be requested through that address. Enquiries are handled by the LevelUpWith Privacy & Safety Team.
Zapital Ltd is the controller of personal data processed through LevelUpWith. This notice explains what we process, why, on what lawful basis, for how long, and your rights. It is acknowledged, not "consented to" — the processing described here relies on the bases stated below, not on consent, unless a use is expressly marked as consent-based.
1. What we collect
- Account data — your email address, sign-in events, passkey public keys if you register one. Sign-in is by emailed code or link; we store no passwords.
- Learning data — the courses you study and create, quiz and exam history, progress, and preferences.
- Created content and uploads — courses you build, and any source document you upload to ground a course (stored with extracted text while your course exists).
- Tutor conversations — messages you exchange with the AI tutor (see section 4).
- Payment data — handled by Stripe; we store your subscription status and plan, never card details.
- Usage analytics — first-party, minimal analytics (see section 5). No advertising or cross-site tracking.
- Correspondence — messages you send us.
2. Purposes and lawful bases
| Processing | Lawful basis |
|---|---|
| Account, authentication and passkeys | Contract |
| Course creation, learning progress, created content | Contract |
| Uploaded documents (generation, retry, agreed retention) | Contract |
| Payments and subscriptions | Contract; legal obligation |
| Financial records | Legal obligation |
| Tutor conversations (delivery, safety, quality) | Contract; legitimate interests |
| Administrator access and audit | Legitimate interests; legal obligation where applicable |
| Security and fraud prevention | Legitimate interests |
| First-party analytics | Legitimate interests |
| Course invitations | Legitimate interests |
| Marketing email (none today; if introduced) | Consent or soft opt-in, separately and optionally |
| Complaints and legal claims | Legitimate interests; legal obligation |
A documented Legitimate Interests Assessment supports each legitimate-interests use.
3. AI processing
Course generation, narration and the tutor run on large language models reached through OpenRouter, our AI gateway. Relevant text (your course brief, lesson content, extracts of an uploaded source, your tutor question) is sent to the model providers to produce the output you asked for. We record model usage (tokens and estimated cost) for cost control; after 24 months those records are anonymised.
4. Tutor conversations and administrator review
AI tutor conversations are stored and may be reviewed by authorised administrators for service operation, quality assurance, abuse prevention, safety, complaint handling and investigation of suspected breaches. This is disclosed in the tutor panel itself. Administrator actions on accounts and content are themselves logged and retained for 24 months. Do not include unnecessary confidential, sensitive or third-party personal information in tutor messages or uploaded documents.
5. Analytics and cookies
We run a first-party analytics system to understand how the site is used. It stores no raw IP addresses and uses no third-party or advertising cookies; visitors who are not signed in are not tracked across days. Signed-in accounts have their product activity linked server-side so we can operate and improve the service. Details of all browser storage are in the Cookie and Local Storage Notice.
6. Who receives data (processors)
We use these providers, under data-processing agreements, with UK-appropriate transfer safeguards where processing leaves the UK:
| Provider | Role |
|---|---|
| Supabase | Database and authentication |
| Vercel | Hosting and edge functions |
| Cloudflare R2 | File storage (uploads, covers, audio) |
| Stripe | Payments |
| Resend | Transactional email |
| OpenRouter | AI gateway, and through it the model providers that generate content |
We do not sell personal data and do not share it with advertisers.
7. How long we keep data
| Data | Retention |
|---|---|
| Account and authentication data | Account lifetime; deleted or anonymised within 30 days of account deletion |
| Private course content and drafts | Account lifetime — we never auto-delete your drafts |
| Published courses (Zapital-owned) | Until withdrawn; creator attribution removed after account deletion |
| Source document, extracted text and summary (successful build) | Lifetime of the course; deleted with it |
| Failed-build source material | 30 days, then deleted |
| Abandoned uploads | Swept on next upload, plus a 7-day scheduled backstop |
| Tutor conversations | 12 months, unless attached to an active investigation |
| Learning and quiz history | Account lifetime, then deleted within 30 days |
| First-party analytics | 13 months |
| Administrator audit records | 24 months |
| Contact and support correspondence | 24 months after closure |
| Pending invitation email | 90 days; suppression record retained |
| Build-job records | 90 days |
| AI cost telemetry | 24 months, then anonymised |
| Financial and subscription evidence | Six years / statutory period |
| Legal complaints and disputes | Resolution plus limitation period |
These windows are enforced by scheduled jobs, not by policy alone.
8. Your rights
You have the right to access your data, correct it, delete it, restrict or object to processing based on legitimate interests, and receive a machine-readable export. Contact levelupwith@zapital.com, or use the tools in your account as they become available. We respond within one month.
Account deletion removes your data across our systems (authentication, courses and progress, uploads and their files, tutor history) except records we must keep by law, such as financial evidence. If you are unhappy with how we handle your data you can complain to the Information Commissioner's Office (ico.org.uk).
9. Changes
We will ask you to re-acknowledge this notice if it changes materially. The version at the top identifies the current notice.