Privacy Policy
1. Who we are
CoreLever is operated by CoreLever LLC, a single-member limited liability company organized in South Carolina, United States. In this policy, "CoreLever," "we," "us," and "our" refer to that entity. "You" refers to the person or business using our website or services.
Questions about this policy, or about data we hold about you, go to privacy@core-lever.com.
2. What we collect
2.1 Information you give us directly
- Contact and account information — your name, business name, email address, phone number (if you provide one), and the login credentials for your client portal account.
- Assessment submissions — everything you send us as part of an assessment. Depending on how you submit, this can include: answers to our guided intake form; uploaded documents and spreadsheets (process documentation, KPI data, org charts, and similar); photographs (whiteboards, floor plans, schedules); and audio recordings in which you describe your business, along with the text transcript we generate from them.
- Correspondence — emails, contact-form messages, and portal messages you send us.
Assessment submissions frequently contain confidential business information, and sometimes financial information. We treat all of it as confidential (Section 6). Please do not upload personal data about your employees or customers, protected health information, payment card numbers, or government identification numbers — we do not need any of it to build your roadmap, and our systems are not designed to hold it.
2.2 Information collected automatically
- Server logs — IP address, browser and device type, pages requested, referring page, and timestamps. Our hosting provider generates these automatically for every website.
- Cookies — see Section 8.
2.3 Information from payment processing
Payments are handled by a third-party, PCI-compliant payment processor. Your card number never touches our servers. We receive only what the processor passes back to us: your billing name, billing address, the last four digits of the card, the card brand, and whether the transaction succeeded.
3. Why we use it, and on what basis
| What we use it for | What that involves |
|---|---|
| Producing your roadmap | Reviewing your submission for gaps, interpreting your figures against how comparable operations run, drafting the report, and editing and approving it before delivery. |
| Running your account | Authenticating your login, showing you your submissions and delivered reports, and (if you subscribe) storing the status, priority, and notes you set against each lever. |
| Communicating with you | Delivery notifications, replies to your questions, service and billing notices. |
| Billing | Processing Setup fees and Subscription charges, and meeting our tax and accounting obligations. |
| Security and reliability | Detecting abuse, debugging faults, maintaining backups. |
| Improving our service | Understanding, in aggregate, which intake methods and report sections are useful. Where we use your submission to improve our internal reference materials, we do so in de-identified, generalized form — never as an identifiable example of your business without your written permission. |
If the GDPR or UK GDPR applies to you, our legal bases are: performance of a contract (producing your roadmap, running your account, billing), legitimate interests (security, service improvement, responding to enquiries), consent where we ask for it explicitly (for example, before publishing a case study about your business), and legal obligation (tax and accounting records).
4. How your submission is processed — including our use of AI
We want this to be stated plainly rather than buried.
Your assessment submission is not sent to an AI provider. Your form answers, your uploaded files and any audio walkthrough are read and worked through by the CoreLever team. They are stored in our own database and file store, and they are not transmitted to Anthropic or to any other model provider — not in whole, not as extracted text, and not as a transcript.
Where AI assistance is used is after delivery, and only when you ask for it. Once your roadmap is live in the workspace, you can request a review of how your plan has drifted from what we recommended. Pressing that button — and nothing else in the product — sends a structured summary of your roadmap to Anthropic, PBC through its commercial API. That summary contains lever names and codes, planned and actual costs, dates, progress states, your KPI names and readings, and the names of systems in your architecture map. It does not contain any uploaded file, your intake answers, anyone's name or email address, the owners you assign to levers, or the free-text notes you write.
No AI output is ever published to you directly. A review drafted with AI assistance goes to a CoreLever reviewer, who reads, fact-checks and edits it before it appears in your workspace. This human review step is a permanent feature of how we work, not a temporary measure.
Anthropic is a subprocessor, not an independent controller of your data. Under Anthropic's commercial terms, business customer inputs and outputs are not used to train Anthropic's models. Anthropic's commercial API maintains SOC 2 Type I and Type II attestations and ISO/IEC 27001:2022 and ISO/IEC 42001:2023 certifications; we can supply the current versions of those on request for your security questionnaire. Anthropic's own privacy terms are published at anthropic.com/legal/privacy.
If you would prefer that no summary of your workspace is ever sent for AI-assisted review, tell us and we will disable that feature on your account. Everything else works exactly as described; you simply lose the on-demand review button.
5. Who else we share it with
We do not sell your information, we do not rent it, and we do not share it for anyone else's advertising. We share it only with the following categories of service provider, and only to the extent they need it to do their job for us:
| Subprocessor | What they handle |
|---|---|
| Anthropic, PBC (United States) | AI-assisted review of a live roadmap, on request only (Section 4). Never receives uploaded files or intake answers. |
| Vercel Inc. (United States) | Hosting and serving the client workspace application. |
| Supabase Inc. (United States) | The database your roadmap lives in, and storage for files you upload. |
| Stripe, Inc. (United States) | Card processing and subscription billing. We never see or store your card number. |
| Zoho Corporation (United States) | Our business mailboxes — the address you write to when you email us. |
| Resend, Inc. (United States) | Automated messages only: password resets, invitations, and the notification we get when you use the contact form. |
We will also disclose information where we are legally required to (a valid subpoena, court order, or comparable legal process), or where disclosure is necessary to protect our rights, your safety, or the safety of others. If we are ever compelled to disclose your data, we will tell you unless we are legally prohibited from doing so.
If CoreLever's business is ever sold or merged, your information may transfer as part of that transaction. You will be notified before it happens, and this policy will continue to apply until you are given notice of a replacement.
6. How we protect it
- In transit: the entire site, including every upload, is served over TLS (HTTPS). We do not accept submissions over unencrypted connections.
- At rest: uploaded files are stored outside the public web root, with access controls scoped to your account, and encrypted at rest.
- Least privilege: only the people reviewing your assessment can access your raw submission. Access to client files is logged.
- Payments: handled entirely by a PCI-compliant processor; we never store card numbers.
- Backups: the application database and client file storage are backed up on a regular schedule, and restores are tested.
- Confidentiality: we treat every client's submission as confidential business information, at every pricing tier — not only where a signed NDA or Enterprise agreement is in place.
No system is perfectly secure, and we will not claim otherwise. If a breach affects your data, we will notify you without undue delay, describe what happened and what data was involved, and tell you what we are doing about it.
7. How long we keep it
| What | How long |
|---|---|
| Raw assessment submissions (uploaded files, audio, transcripts) | 12 months after your report is delivered, then deleted automatically. Tell us sooner and we will delete them sooner. |
| Your delivered roadmap report | For as long as your portal account is open, so you can re-download it. |
| Portal account and roadmap edits (status, priority, notes) | For as long as your account is open. Ask us to close it and we delete the workspace that day, and confirm back to you. |
| Billing and tax records | As long as US federal and South Carolina tax law require — generally seven years. This is a legal obligation and we cannot delete these on request. |
| Contact-form enquiries | Kept so we can find a conversation you started last year. Ask and we delete yours. |
| Server logs | As retained by our hosting provider, currently a rolling short window. They contain request metadata, not the contents of your workspace. |
8. Cookies
One, and only inside the client workspace.
- Strictly necessary — a single signed session cookie that keeps you logged in to the workspace. It is
HttpOnly, so scripts cannot read it, and it expires after a week. Blocking it means you cannot sign in. - Analytics — we do not currently use analytics cookies, and the marketing pages set no cookie at all.
We do not use advertising or cross-site tracking cookies. You can block or delete cookies in your browser settings; blocking the strictly necessary ones will prevent you from logging in.
9. Your rights
Whoever and wherever you are, you can ask us to:
- Show you what we hold about you.
- Correct anything inaccurate.
- Delete your data, subject to the billing and tax records we are legally required to keep.
- Export your data in a portable format.
- Stop marketing emails — every one has an unsubscribe link, and service and billing notices are separate from marketing.
Email privacy@core-lever.com. We will respond within 30 days, and we will not charge you or make the service worse because you exercised a right.
If you are in the EU or UK: you also have the right to object to processing based on legitimate interests, the right to restrict processing, and the right to complain to your national supervisory authority. Data you send us is processed in the United States; where we transfer personal data out of the EEA or UK, we rely on the European Commission's Standard Contractual Clauses (and the UK Addendum) with our subprocessors.
If you are in California: the CCPA/CPRA gives you rights to know, delete, correct, and opt out of "sale" or "sharing" of personal information. We do not sell or share personal information as those terms are defined, and we do not use it for cross-context behavioral advertising. Exercise your rights at the same address above.
10. Children
CoreLever is a business service and is not directed at anyone under 18. We do not knowingly collect information from children. If you believe a child has given us information, contact us and we will delete it.
11. Changes to this policy
If we change this policy materially, we will post the updated version here with a new "last updated" date and email active clients before it takes effect. Continuing to use CoreLever after that date means the updated policy applies to you.
12. Contact
CoreLever LLC
1226 Beck Drive
Mount Pleasant, South Carolina 29466, United States
privacy@core-lever.com