1. Who we are

This Privacy Policy (the "Policy") describes how LEYLA GREENHILL LLC (the "Company", "we", "us") processes the personal data of users of LaunchExpert.ai — the "Lexi" AI assistant for marketing and the information-products business (the "Service").

• Data controller: LEYLA GREENHILL LLC
• Jurisdiction: State of Texas, USA
• Mailing address: 5900 Balcones Drive #18555, Austin, TX 78731, USA
• Privacy contact: legal@greenhillmediagroup.com

By using the Service, you confirm that you have read this Policy.

2. Scope

This Policy applies to data processed when you use the launchexpert.ai website, including in PWA mode (installation as an application). This Policy does not apply to third-party services that may be linked to, or to the platforms of our providers (see Section 7), which operate under their own policies.

3. What data we collect

3.1. Registration data. First name, last name, and email address. An account is created automatically when you purchase a subscription through the Whop platform.

3.2. Payment data. We do not store payment card data. Payment is processed entirely by Whop; we only receive information about the existence of an active subscription (membership), without any card details.

3.3. Conversation content. The content of your chats and messages, as well as files you upload to the Service (PDF, DOCX, XLSX, images).

3.4. Technical data. Email address in operational and error logs; IP address (in rate-limiting mechanisms and sign-in logs); session tokens (JWT).

3.5. Voice input. When you use voice input, audio is transmitted for transcription (see Section 6).

3.6. Text samples (Tone of Voice). The Service previously could collect uploaded text samples for style analysis. This feature is currently disabled and no samples are collected. If the feature is re-enabled, this Policy will be updated.

4. Purposes and legal bases of processing

We process data for the following purposes:

• provision and operation of the Service (account creation, processing requests, generating responses and documents) — basis: performance of a contract;
• sending transactional emails (welcome email with a password, etc.) — basis: performance of a contract;
• security, abuse prevention, rate limiting — basis: legitimate interest;
• error diagnostics and support — basis: legitimate interest;
• accounting for usage and API costs — basis: legitimate interest;
• compliance with legal requirements — basis: legal obligation.

The legal bases are stated by reference to the GDPR (Art. 6). For users outside the EEA, comparable bases apply under local law.

5. Use of data to train AI models

We do not train our own AI models on your data — the Service has no proprietary trainable models. Your requests are sent to the OpenAI API through a commercial account; under OpenAI's API terms, the data is not used to train OpenAI's models.

6. AI technology and transmission of requests

To generate responses, classify requests, and transcribe speech (Whisper), the Service uses the API of a third-party provider — OpenAI. The content of your requests and, where necessary, uploaded materials are transmitted to OpenAI solely to process and generate a response.

Vector search across the knowledge base is implemented using open-source components (AnythingLLM, LanceDB) deployed locally on our server; these components do not transmit data outside the server.

7. Disclosure to third parties (sub-processors)

We engage the following providers, which may process data on our behalf:

We do not sell your personal data and do not share it with third parties for advertising purposes.

8. International data transfers

The Company is registered in the USA, and several providers (OpenAI, Whop, Google) are also located in the USA and/or process data outside your country. If you are located in the EEA or the United Kingdom, transfers of your data outside those territories are carried out using recognized safeguards, including the Standard Contractual Clauses (SCC).

9. Retention periods

• Administrator action logs and chat logs — 30 days.
• Inactive chats — archived after 30 days of inactivity.
• The user-questions journal and the API-cost journal — retained indefinitely (no rotation).
• Tone of Voice profiles — up to 3 versions per user (the feature is currently disabled).

10. Your rights

Depending on your region, you may have the following rights:

For the EEA/UK (GDPR/UK GDPR): access, rectification, erasure, restriction of processing, portability, objection to processing, withdrawal of consent, and the right to lodge a complaint with a supervisory authority.

For California (CCPA/CPRA): the right to know what data is collected, the right to deletion, the right to correction, the right to opt out of the "sale"/"sharing" of data (we do not sell data), and the right to non-discrimination.

How to exercise your rights. Self-service export and deletion through the interface are not yet available. You can delete and archive your own chats in the interface; for other requests (access, account deletion, export), contact legal@greenhillmediagroup.com. We fulfill such requests manually within the timeframes required by applicable law.

11. Age of users

The Service is intended for individuals over 18 years of age. We do not knowingly collect data from individuals below that age.

12. Security

We apply reasonable technical and organizational measures (access control, rate limiting, logging, secured connections) to protect data. No method of transmission or storage is completely secure.

13. Cookies and session technologies

The Service uses session tokens (JWT) and similar technologies necessary to sign in and operate the Service.

14. Changes to this Policy

We may update this Policy. We will notify you of material changes in the Service or by email. The last-updated date is shown at the top.

15. Contact

For privacy matters: legal@greenhillmediagroup.com LEYLA GREENHILL LLC, 5900 Balcones Drive #18555, Austin, TX 78731, USA