Privacy notice

This website and dashboard are an early development preview. Account registration, organization creation, CSV and XLSX imports, deterministic detection, finding review, CSV exports, and a grounded analyst are enabled. Account details are processed by Supabase Auth. Imported files are parsed into validated rows; the original files are not retained. Derived findings and import metadata are stored in the application database. Beyond account details, organization membership, and the records you import, the only technical information handled is what is required to serve the website, subject to the hosting configuration documented before launch.

• Account details such as name, email address, and authentication data handled by Supabase Auth.
• Organization details and membership roles.
• Uploaded CSV and XLSX files, processed to extract and validate financial rows. Original uploaded files are not retained.
• Derived findings, review status and timestamps, import metadata, and the source-row references attached to findings.
• Support communications and product usage needed to operate the service.
• Plan, subscription, and monthly usage records — imports created, valid rows confirmed, and member count — used to enforce plan limits. No payment method or card data is collected while billing is disabled.

To provide financial analysis to the correct organization, secure accounts, investigate errors, provide support, enforce plan limits, and meet legal obligations. Financial records are not used to make automated decisions about individuals, and findings remain subject to human review.

The operator of LeakHunt AI has not yet finalized its business jurisdiction. A lawful basis for each processing activity — such as contract performance, legitimate interests, or consent where required — must be identified and documented before commercial launch.

The current application uses PostgreSQL through Supabase with organization-level isolation, Row Level Security, and server-side authorization. Extracted rows, findings, and import metadata are stored there. Original uploaded files are not retained, and private document storage is not built. Application code does not use a Supabase service-role key, and cross-organization access tests are part of the test suite. No system can be guaranteed perfectly secure.

Service providers may process data on the operator's behalf for hosting, database, email, monitoring, and eventually payments. They will be bound by appropriate contractual obligations. LeakHunt AI does not intend to sell customer data or share it with other customers.

The grounded analyst runs locally by default. If the operator configures an external AI provider, the question and a limited set of retrieved records — the selected finding, counts, estimates, and up to 10 open findings — may be sent to that provider. Original uploaded files are never sent. External answers are checked before display, with fallback to local mode.

Retention periods will depend on the type of record, the customer relationship, and legal requirements. Account and data deletion workflows, including deletion of stored extracted rows, derived findings, import metadata, and unnecessary audit entries, are required before commercial launch. Any legally required retention will be stated at that time.

Depending on applicable law, individuals may have rights to access, correct, export, or delete personal information, or to object to certain processing. The request process and contact details will be published before commercial launch.

Hosting and processor locations have not been finalized. Any cross-border transfer safeguards required by applicable law will be documented before launch.

LeakHunt AI is a business tool and is not intended for children or for personal household use.

This notice will be updated as the product is built. Material changes will be communicated before they take effect. Contact details for privacy questions will be published before commercial launch.

See also the terms of service.