Privacy Policy

Google sign-in

If you choose Google sign-in, we receive the Google account identifier, email, email verification status and name for authentication and account linking. We do not request Gmail, Drive or Contacts access and do not retain Google access or refresh tokens. Linking an existing account with the same email requires its password. Deleting your account removes the Google account link.

What Leostu collects, why, and what you can do about it.

What we collect

Account: email, name, password (stored only as a hash), language, time zone, currency.

Your business content: orders, client names and contacts, agreement terms, payment details, logo, signature image.

When a client signs: their name, drawn signature, time, IP address and browser.

Payments: handled by Stripe. We never see card numbers; we keep the Stripe customer ID, subscription status and payment records.

Technical logs: IP address and request time, for security (such as login throttling) and debugging.

How we use it

To run the service: show your orders, generate documents, show agreements and invoices to your clients.

Necessary emails: email confirmation, password reset, signature notices (can be turned off), billing notices.

We don't sell your data or use it for advertising.

AI assistant (AI plan)

The text and images you send to the AI assistant, plus the order and client details needed for that request (such as client name, project, amounts and dates), are sent to the third-party AI model provider we use, to generate the reply. Processing may happen outside your country or region. Client signature images, access codes and passwords are never sent.

Conversations are stored in your account and you can delete them at any time; deleting a conversation also deletes its images. Uploaded images are deleted automatically after a while (90 days by default).

Chat screenshots may contain your clients' personal data. Make sure you are allowed to process it before uploading, and crop out anything unrelated.

AI can misread things. Nothing is added or changed until you press confirm on the card. If you don't use the AI assistant, no data is sent to the AI provider.

Third parties

Stripe (payments). Our hosting provider (storage and computing). Email is sent through our own mail server.

Your clients' information

Client details are entered and managed by you, the designer. Clients can ask the designer, or email us, to access or delete their information.

Retention and deletion

We keep your data while your account exists. Export your orders any time; delete your account in Settings → Account to remove orders, tokens and uploaded images. Payment records are kept as required for accounting and law.

Security

HTTPS everywhere; passwords and API tokens stored only as hashes; data separated per account at the query level; client links need an access code and lock after repeated wrong attempts.

Contact

Privacy questions: support@eeoo.dev.