Privacy

Privacy Policy

Last updated: 8 October 2026

Your data, protected

We know what we're asking. To use lvlst, you trust us with sensitive information — from company pay and employee records to leave requests and supporting documents. We treat that data with the utmost confidentiality, and we hold ourselves to clear commitments:

Your data belongs to you. Your organisation controls the business and workforce data it submits, subject to individuals' privacy rights. We process it to provide, secure, and support the services described below.
We never sell your data. Full stop. Your salary, employee, leave, and performance data is never sold, rented, or shared with third parties for their own purposes.
We never use it for advertising.
We don't use your confidential data to train AI models.
Your salaries are not pooled into the benchmarks others see. lvlst's market benchmarks come from our own data sources — the figures you upload are kept separate and are not added to the market data shown to other customers.
Access is restricted and controlled. Only authorised users of your account can see your data. lvlst staff access it only where strictly necessary to operate the service or to support you, and such access is logged.
Protected in transit and at rest. We use technical and organisational safeguards appropriate to the information we process.
Shared reports are limited. Report share links are read-only and expire after 30 days.
You can delete it. You can request deletion of your account and data, subject to records we must retain under applicable law.

The detail behind these commitments is set out below.

1. Who we are

lvlst ("lvlst", "we", "us", "our") provides online job evaluation, salary structures, Performance Management, Leave Management, and Payroll services for organisations in the GCC and Egypt.

Contact: support@lvlst.com
Website: https://lvlst.com

For employee and dependent information your organisation provides, your organisation decides what to collect, why it is needed, and who within the organisation may use it. We process that information to provide the service, subject to the uses and disclosures explained here. This does not limit individuals' rights under applicable privacy law.

2. What we collect

Account data: your name and work email. Authentication and login are handled by our provider (Clerk); passwords/credentials are managed securely by them.

Free-evaluation enquiries: if you complete the public free-evaluation form, we collect the email, phone, company name, company size, country, and page you submitted from. This is a separate enquiry record, not a verified account or a demo request. We use it to help you start the self-service evaluation and follow up about your enquiry.

For the one-per-company free Job Evaluation offer, we check whether your primary email is verified and belongs to a company domain. We retain the claimed domain to prevent repeat claims, including after an account is removed. We may use a one-way network fingerprint to flag unusual claims for human review. The offer-specific fingerprint is removed after the short review window; ordinary security rate limits are handled separately.

Company and workforce data: company name, location and organisation size, plus the employee names, contact details, job titles, departments, reporting lines, work countries, employment and contract details that your organisation enters to use the people services.

Evaluation data: the job titles, role information, and salary figures (basic, gross, total) you enter to grade roles and position employees. This is confidential business and personal data, and we treat it as described in "Your data, protected" above.

Performance-management data: if you use the Performance Management module, you (and the employees you invite) provide employee details — names, work emails, job titles, departments, divisions, branches, and reporting lines — together with the content of evaluation cycles: goals and their weights, self-assessments, manager ratings and comments, competency scores, feedback, appeals, and finalised results. This includes personal data about your employees; your organisation is responsible for having a lawful basis to provide it.

Leave Management data: leave policies and entitlements, requests and dates, reasons and comments, approval decisions, holidays, and any supporting documents you upload. Supporting files may contain sensitive information, such as medical certificates. Please provide only what is needed for the request.

Payroll and benefits data: pay and allowance amounts, deductions, payroll inputs and results, salary-slip information, bank and payment details (such as IBAN), nationality, and employment information. Where your organisation uses dependent or schooling benefits, this may also include dependents' names and dates of birth, school and claim details, and uploaded receipts. These records may be especially sensitive.

Payment data: processed securely by our payment provider, Stripe. We do not store your full card details. We receive the transaction confirmation, the bundle or subscription plan purchased, subscription status and renewal dates, and order references.

Usage data: basic technical/log data (device, browser, interactions) used to operate and secure the platform.

Public guide assistant: if you use the guide assistant, your messages are sent to an AI service provider to generate a reply. We do not keep the conversation text in the assistant usage ledger, but do record usage information needed to operate and limit the service. Do not enter confidential company or employee data in the public assistant.

Company HR assistant: when your organisation enables this separate, signed-in assistant, your question, relevant authorised policy sections and the minimum permitted employee, leave, payslip or performance records needed to answer it are sent to the configured AI provider (OpenAI by default). Managers cannot use it to read their team's payslips. Bank details, identity documents, medical attachments and private appraisal notes are excluded from these record tools. Conversations and source references are retained for up to 90 days; answers are withheld when their records or access permissions change. The usage ledger records tokens and cost, not prompts or salary figures. Requests disable provider-side conversation storage; the provider's applicable security-retention terms still apply. Your organisation should review this processing against its employee privacy obligations before enabling the assistant for live workforce data.

3. How we use your data

To provide the service — grade roles, generate salary bands, build reports, position employees, run performance reviews, manage leave and approvals, and prepare payroll calculations, salary slips, and benefit records for your organisation.
To manage your account, evaluations, subscriptions, and purchases.
To check free-offer eligibility, prevent repeat company claims, and review unusual claims.
To process payments and subscription renewals (via our payment provider).
To send invitations, workflow notifications, and service emails for performance, leave, payroll, and related people services.
To send essential service communications (verification, security, account, and support emails).
To secure, maintain, and improve the platform.

We do not sell your data, use it for advertising, or use confidential salary and employee records to train AI models.

4. Who we share it with

We share data only with the service providers needed to run lvlst, under appropriate safeguards:

Authentication: Clerk — secure login and verification.
Payments: Stripe — to process purchases securely and issue receipts.
Email delivery: our connected Google mail service — to send workflow and support messages to their recipients.
AI services: Replit's managed AI integration routes messages you choose to submit to the public guide assistant to an AI model provider so it can respond.
Hosting / infrastructure: Replit — to host the application and data.

We may disclose data if required by law. We do not share confidential workforce data with anyone for their own purposes.

5. Where your data is stored

Your data is stored on servers operated by our infrastructure provider, located in the United States. We apply reasonable technical and organisational measures to protect it in transit and at rest.

6. Confidentiality of workforce data

Salary, payroll, bank, leave, dependent, and performance data can be sensitive. We restrict access accordingly:

It is stored against your account and accessible to authorised users according to their permissions, subject to any report links you choose to share and the provider access described above.
Performance-management data is visible strictly on a need-to-know basis within your organisation: employees see their own goals and finalised results, managers see their team, and HR sees the organisation. Manager ratings remain hidden from the employee until HR finalises the result.
Payroll, leave documents, and dependent-benefit records are subject to role-based permissions and employee scope. Authorised administrators, approvers, and employees see information according to their assigned access.
lvlst administrators access it only where strictly necessary to operate the service or provide support, and such access is logged.
Report share links are read-only and automatically expire after 30 days.
Your uploaded figures are not pooled into the market benchmark data shown to other customers.

7. Data retention

Free-evaluation enquiries are shown to authorised administrators for 180 days. Older records are removed when a new enquiry arrives or an administrator opens the dashboard; you can request deletion sooner. Authorised administrators can export current records for follow-up; they are not made public.

We keep account, evaluation, performance, leave, payroll, and benefits data for as long as needed to provide the service and meet applicable obligations. You may request deletion by contacting support@lvlst.com. Some records (such as transactions) may need to be retained for legal or accounting reasons. Backups and copies held by service providers may take additional time to be removed under their processes.

A claimed company domain may remain after account deletion so that the one-per-company limit cannot be reset. Review decisions are recorded in an administrative audit trail. Contact support@lvlst.com about access or correction requests relating to a claim.

8. Your rights

Depending on your jurisdiction, you may have rights to access, correct, delete, restrict, or export your personal data. To exercise these, contact support@lvlst.com. We will respond in line with applicable law, including the UAE PDPL and Saudi PDPL where they apply.

9. Cookies and analytics

We use essential cookies to operate the platform (e.g. to keep you logged in).

With your consent, we use Google Analytics on public marketing pages to understand page visits, browser and device type, approximate location, and cookie identifiers. Analytics does not run on private app screens, including payroll, leave, performance, and admin pages. Page addresses, titles, and referrers sent to Analytics exclude query strings, private record IDs, names, email addresses, and access tokens.

Analytics is not loaded before you accept. You can reject analytics or withdraw consent at any time using Cookie settings in the footer of a public page. We remember your choice for 12 months, then ask again.

If you request human support on a public marketing page, we load Tawk.to to provide the chat. Tawk.to uses cookies and browser storage to maintain chat sessions and recognise returning visitors. Human chat is not loaded on private app screens.

10. Children

The service is intended for business use by adults and is not directed at children. An employer using dependent or schooling benefits may enter information about an employee's child. That information is used to administer the benefit, not to create an account for the child.

11. Changes

We may update this policy from time to time. Material changes will be posted here with a revised "Last updated" date.

12. Contact

Questions about this policy or your data: support@lvlst.com