Back to Leqvanta

Updated 27 October 2026 · 2026-10-27-customer-data-1

Privacy Policy

How we handle personal information across the scanner, reviews, workspaces and automation services.

Dardy Partners Limited (RC 1689744), Nigeria, operates Leqvanta. Contact osobayeholdingsltd@gmail.com for privacy matters. We decide how account, billing, security and service-administration information is used. When we process a business client’s customer or staff records only on that client’s instructions, we act as its processor under an agreed data-processing arrangement. The client remains responsible for its lawful instructions and notices to those people.

We use account email, business details, service choices, payment references, submitted records, report questions, support messages and access history to provide the requested service, manage payment, protect accounts and answer enquiries. Hosting and security providers may process IP addresses, device information and request metadata. We do not ask for payment-card details inside Leqvanta; checkout is handled by the payment provider. Do not submit passwords, full card numbers, identity documents or unnecessary sensitive information.

Scanner answers stay in this tab’s memory and are sent to our server for calculation. We do not save free-scan answers in the application database, local storage or session storage. Refreshing or closing the page clears them. Downloaded reports remain on your device. Hosting and security metadata are separate from scan answers.

Where GDPR applies, we use contract or requested pre-contract steps for services supplied to an individual; legitimate interests for business-contact administration, fraud prevention, account security and service reliability; legal obligation for records the law requires; and consent where a genuinely optional activity requires it. You may object to processing based on legitimate interests. Agreeing to service terms is not blanket consent to every use of personal data. Processing client records on instructions is governed by the client’s lawful basis and our processing agreement.

Document extraction processes uploaded files to prepare reviewable values. Original files are not sent to the report model by this integration. Selected record facts, row references and any clarification question may be sent to OpenAI for recommendations when model processing is enabled. Row references reduce direct identification; they do not guarantee anonymity. Do not put personal information into free-text questions. Standard reports are automated; a human check is identified separately. Analyst access requires a current assignment, your permission and staff authentication. Permission can be withdrawn without extending the original retention period. We do not use the review to make binding decisions about individuals automatically.

Our service uses Vercel for hosting, Supabase for authentication, private records and reports, Paystack for payments, OpenAI for enabled report processing, and configured Gmail or Resend services for email. Approved analysts may access assigned records. A client’s agreed automation may also use Google Sheets and n8n with separately agreed recipients and scope. Providers may act as processors or as independent controllers for their own legal duties. Processing and authorised remote access can occur outside your country. Where GDPR transfer rules apply, the relevant recipient, location and valid safeguard, such as applicable adequacy or standard contractual clauses with an assessment, must be established. You may ask for recipient details and a copy or explanation of relevant safeguards. We do not promise country-only storage or claim that a provider’s compliance establishes ours.

We store review uploads and working records privately while the job is open so processing and an authorised analyst check can continue across visits. Save or download the report before finishing. Accepting the final version starts deletion of original uploads, extracted text, record facts, questions, analyst drafts, published reports and correction copies. Unfinished sources and working contents expire within 30 days of order creation. Failed file deletion remains pending and is retried; we show completion only after the known active source objects are verified absent and the record contents are cleared from the active database. We do not keep completed report contents for 12 months. Your sign-in email and minimal payment/order receipt details are separate; they are shown or explained rather than described as erased. Automation enquiries normally expire after 90 days or can be deleted in Your data; separately agreed automation projects, support correspondence and provider records have their own scope and retention. We do not create an application-level backup archive of your uploaded files. Hosting/database/provider retention may exist independently, so active-system deletion is not a promise that every external copy has immediately disappeared. Ask us for the applicable provider handling and any lawful retained minimum.

Sign in to Your data to see saved review entries and minimal receipts, download your remaining review data, delete review contents or remove an automation enquiry. Deleting an open review stops the remaining work. The page distinguishes deleted contents from pending files and separately retained account/payment information. For full account deletion, support correspondence, connected projects or provider-held data, contact us through the privacy-request page. No purchase or sign-in is required to make that request. Where applicable you can also request correction, restriction, objection and portability, or withdraw consent. We verify identity proportionately, protect other people and explain any retained data or lawful exception. GDPR requests normally receive a response within one month; a permitted extension needs notice and reasons within that first month. Where a business client controls the records, we assist that controller.

You can complain to the Nigeria Data Protection Commission and, where GDPR applies, a competent EEA supervisory authority, including in your usual residence, workplace or place of the alleged infringement. You may contact a regulator without first contacting us. Account and service details marked as required are needed to provide that service; declining optional processing does not authorise an extra charge. We do not sell personal information or add advertising trackers. Services are intended for business users, not children. Material changes are published with a new date and communicated where required before a new use begins. This notice is a description of practices, not a GDPR certification.

osobayeholdingsltd@gmail.com

Dardy Partners Limited · RC 1689744 · Nigeria