Privacy Policy^{[via Lx7.ca]}

Our Privacy Commitment

Lx7.ca is built on the principle of sovereignty — your data belongs to you. We collect the minimum data necessary to provide our services, and we never sell, share, or use your data for advertising or AI training.

This policy explains what we collect, why, and how you can control it.

Who We Are

Lx7.ca is wholly owned and operated by Humanjava Enterprises Inc., a corporation registered in British Columbia, Canada.

Contact: privacy@lx7.ca

Address: Vancouver Island, BC, Canada

What Data We Collect

Account Information

When you create an account, we collect:

• Email address — for login, password recovery, and essential notifications
• Username — your chosen display name
• Password — stored securely using industry-standard hashing (never in plain text)

If you sign in with GitHub, we receive your GitHub username and email from GitHub's OAuth.

Profile Information (Optional)

You may optionally provide:

• Display name
• Bio and tagline
• Social links (GitHub, Twitter, LinkedIn, website)
• Avatar image

This information is only displayed publicly if you choose to make your profile public.

Payment Information

Payment processing is handled entirely by Stripe. We never see or store your full credit card number. We receive from Stripe:

• Stripe customer ID (to link your subscription)
• Subscription status (active, canceled, etc.)
• Last 4 digits of card (for your reference only)

Usage Data

We use Plausible Analytics, a privacy-focused analytics service that:

• Does NOT use cookies
• Does NOT track individuals across sites
• Does NOT collect personal information
• Is fully GDPR, CCPA, and PECR compliant

We collect aggregate data like page views and referral sources, but we cannot identify individual users from this data.

Chatroom & AI Conversations

We do not log or store your AI conversations. When you interact with Muse or other AI features:

• Conversations are processed in real-time and not retained
• We do not train AI models on your conversations
• We do not share conversation content with third parties

Chatroom messages in public rooms are ephemeral (peer-to-peer) and not stored on our servers.

What We Do NOT Collect

• We do NOT track you across other websites
• We do NOT build advertising profiles
• We do NOT sell your data to anyone
• We do NOT train AI models on your data
• We do NOT use invasive tracking cookies
• We do NOT collect biometric data

How We Use Your Data

• Provide services — authenticate you, process payments, deliver features
• Communicate — password resets, subscription updates, security alerts
• Improve — understand aggregate usage patterns (via Plausible)
• Protect — prevent fraud and abuse

We will NEVER use your data for advertising or sell it to third parties.

Data Storage & Security

Where we store data:

• Account data is stored in Supabase (hosted in secure data centers)
• Payments are processed by Stripe
• Emails are sent via Resend

Security measures:

• All data transmitted over HTTPS (TLS encryption)
• Passwords hashed with bcrypt
• Database access restricted and audited
• Regular security reviews

Your Rights

You have the right to:

• Access — request a copy of your personal data
• Correct — update inaccurate information
• Delete — request deletion of your account and data
• Export — receive your data in a portable format
• Object — opt out of certain processing

To exercise these rights, email privacy@lx7.ca.

Account deletion: You can delete your account from Settings → Account → Delete Account. This removes your personal data from our systems (excluding data we must retain for legal/financial records).

Data Retention

• Account data: Retained while your account is active
• After deletion: Personal data deleted within 30 days
• Financial records: Retained 7 years (legal requirement)
• Security logs: Retained 90 days (fraud prevention)

Third-Party Services

We use these third-party services that may process your data:

International Users

Lx7.ca is operated from Canada. If you access our services from outside Canada, your data may be transferred to and processed in Canada. Canada has been recognized by the European Commission as providing adequate data protection.

For EU/EEA users: We comply with GDPR requirements. Our lawful basis for processing is:

• Contract performance (providing the service you signed up for)
• Legitimate interests (security, fraud prevention)
• Consent (optional profile information)

Children's Privacy

Lx7 services are not intended for children under 13 (or 16 in the EU). We do not knowingly collect data from children. If you believe a child has provided us data, contact privacy@lx7.ca.

Changes to This Policy

We may update this policy periodically. For significant changes, we will:

• Update the "Last updated" date
• Notify users via email (for material changes)
• Post a notice on our website

Continued use after changes constitutes acceptance of the updated policy.

Contact Us

For privacy questions or to exercise your rights:

• Email: privacy@lx7.ca
• General: support@lx7.ca

We aim to respond to all privacy requests within 30 days.