Privacy Policy

1. Who we are and what this policy covers

Louvain is operated by Louvain AI Ltd, a company registered in England and Wales (company number 17506006) ("we", "us"). Contact us about privacy at privacy@louvain.ai.

We have two roles, and this policy is clear about which applies:

• We are the controller of personal information we collect to run our business: account and sign-in information, billing information, website and demo-booking information, support correspondence, and information about how the Service is used. Most of this policy is about that information.
• We are a processor of Customer Data — the documents, messages, emails, calendar entries, records, questions and conversations that an organisation using Louvain connects to or creates in the Service. We process Customer Data on that organisation's behalf and under its instructions, as set out in our Terms of Service and Data Processing Addendum. Section 4 explains what that means for you.

This policy does not cover a copy of Louvain that an organisation runs on its own infrastructure; that organisation decides how data is handled there.

2. Information we collect

Account and sign-in information

When you create an account, are invited to a workspace, or sign in, we collect your name, email address, the workspace you belong to and your role in it, and details from the sign-in method you use (for example, your name and email address from Google if you sign in with Google). Sign-in is provided by our authentication provider, Clerk, which also records session and device information and IP addresses to keep accounts secure.

Billing information

When you start a trial or buy a plan, we collect your billing contact's name and email address, your company name and address, tax identifiers where relevant, and your subscription and invoice history. Payment card and bank details are collected and held by our payment provider, Stripe; we do not store full card numbers.

Demo bookings and enquiries

When you book a demo at louvain.ai/demo, we collect your first name, last name, work email address, the time you choose and your time zone. The booking is recorded in HubSpot, which we use to manage meetings and our contact records. If you email us, we keep the correspondence.

Usage and technical information

On our public website, if you allow it, we measure how the pages are used — which are read, what is clicked, how fast they load and what fails — using PostHog. You are asked before any of it runs, a browser sending Global Privacy Control or Do Not Track is treated as having declined, and the requests go to our own domain rather than to a third-party address in your browser. Nothing measures what you do inside the product: no session recording, no click tracking and no page measurement runs on any page behind sign-in, because those pages show your own company's knowledge and a script that captures what you clicked would capture that text with it. If you allowed measurement, the one thing sent from a page behind sign-in is who you are, as your account identifier and your workspace's identifier, so that your visit to our website and your account are counted as one person. It carries no page address, no title and nothing shown on the page. If you allowed measurement and arrived from a campaign link or another site, we also remember, for 90 days, the campaign tags in that link and the other site's domain; the ad click identifier an advertising platform adds to a link is remembered only if you also allowed advertising. If you then create a workspace, they are recorded with it so we know which campaign led to it, and deleted with it. We do not send an ad click identifier to any advertising platform, and a browser sending Global Privacy Control or Do Not Track has nothing recorded when it creates a workspace. Our Cookie Notice lists what is stored and how to change your answer.

When you use the Service or visit our website, our servers record technical information such as IP address, browser and device type, the pages and API routes requested, timestamps and error details. We record a fixed set of product events — for example, that a connection was created, that an answer was returned or that a subscription started — using PostHog, in its European Union region. Each event carries a workspace identifier and, where a person caused it, that person's account identifier, so that we can tell how the product is used and by how many people; the one event recorded before any workspace exists, that an account was created, carries only the account identifier. Both are opaque identifiers: these events do not include your name or email address, and they do not include the content of your sources or your questions. Error reports are sent to PostHog, and to Sentry where a deployment configures it; both are designed to exclude request content, and an error message is stripped of quoted values, addresses and identifiers before it leaves our servers. When a page behind sign-in fails to display, your browser tells our servers only which kind of page failed, a reference code, where in Louvain's own code it failed and which version of the app the page was running — never what the page was showing — and that report is handled the same way. If you choose to send feedback or report a problem from inside the product, what you write and any screenshot you add are kept with your account, so that you can see them again with our reply (nobody else in your organisation can), until you leave that organisation or it is deleted, and are sent to the Louvain team through Sentry, together with your account and workspace identifiers, the kind of page you were on, the version of the app and your browser type; nothing else on the page is included. Within Louvain they are read only by named members of our team, in an internal inbox where we record what we did about them; the notice that tells our team something arrived carries neither your words nor your name or organisation.

Cookies and similar technologies

We use a small number of cookies and local storage entries that the site needs to work, such as keeping you signed in and remembering your theme, plus the measurement described above on our public pages if you allow it. We use no advertising or cross-site tracking cookies. See our Cookie Notice.

Security reports

If you report a vulnerability to security@louvain.ai, we keep your report and our correspondence.

3. How we use information, and our legal bases

Where the EU or UK General Data Protection Regulation applies, we rely on the legal bases shown.

Where we rely on legitimate interests, we have considered your interests and rights, and you can object as described in section 9. Where we rely on consent, you can withdraw it at any time.

We do not sell personal information. We do not share personal information for cross-context behavioural advertising. We do not use personal information to make decisions about you that have legal or similarly significant effects by automated means alone.

4. Customer Data and AI processing

Your organisation is in charge of Customer Data. If you use Louvain through your employer or another organisation, that organisation decides which sources to connect, who can read what, and how long content is kept. If your personal information appears in Customer Data — for example, in an email or a document someone connected — please direct privacy requests to that organisation. If you contact us instead, we will pass your request to them where we can identify them.

How Customer Data is processed. To answer questions, run the Ask assistant, and write Today briefings, the Plate and meeting briefs, the Service reads the relevant passages of Customer Data that the person asking is permitted to read and sends that text to language models run by the providers listed on our Subprocessors page. Those providers process the text to return a result. Search indexes and embeddings are built on our own infrastructure. Web search is used only when a workspace administrator turns it on, and then only search queries are sent to the search provider. When someone saves a link, Louvain's servers fetch that address, and fetch it again on the schedule they choose, without any of their cookies or sign-ins. The site sees a request from Louvain, not from them, and the page is stored in the collection they saved it to. When someone mirrors a collection to their own file store (for example their Google Drive), Louvain writes copies of that collection's files into a private folder there, through their own sign-in and only after they allowed it; the copies are then held by that provider under their account, and who can open them there is decided in that store, not in Louvain.

We do not use Customer Data to train AI models. Model providers' retention of request data is governed by their terms with us; the Subprocessors page describes the current position.

Access within your organisation. The Service applies the permissions of connected sources, or the audience an administrator chooses, before it retrieves anything. Workspace administrators can see administrative information such as members, connections and the audit log, and can see how answering is going across the workspace — how many questions were asked, refusal reasons, response times and feedback. The words of a question are shown only to the person who asked it, whether it was asked on the Ask page, through the answer API or by an agent acting for them, and conversations in the Ask assistant are private to the person who started them.

5. How we share information

We share personal information only as follows:

• With our subprocessors and service providers, who process it for us under contract, including hosting, database, authentication, payments, analytics, error monitoring, email delivery and scheduling providers. They are listed on our Subprocessors page.
• Within your organisation's workspace, according to its permissions and settings — for example, your name is shown to other members.
• With professional advisers, such as lawyers and accountants, under duties of confidentiality.
• Where the law requires it, or where we believe in good faith that disclosure is needed to protect the rights, property or safety of Louvain, our customers or others.
• In a business transfer, such as a merger, acquisition or sale of assets, subject to this policy.
• With your consent or at your direction.
• With your browser's push service, only if you turn on notifications. If you turn on notifications on a device, each one travels through the push service your browser's maker runs for it (Apple for Safari, Google for Chrome, Mozilla for Firefox, Microsoft for Edge), chosen by your browser, not by us. What it carries is a title of up to 60 characters, a line of up to 140 and the page of the app it opens, encrypted to that device before it leaves our servers, so the push service carries bytes it cannot read; it sees the device's push address, when a notification was sent, its size and an opaque tag, and is asked to discard it after 24 hours if it cannot be delivered.

6. International transfers

We are based in the United Kingdom. The Service is hosted in the European Union (Frankfurt, Germany), including its database and the authorisation broker for connected sources. Some of our providers process information outside the European Union, mainly in the United States, in the locations listed on our Subprocessors page. Your information may therefore be processed outside the country where you live.

Where the EU GDPR, UK GDPR or Swiss data protection law applies to a transfer, we use appropriate safeguards: the European Commission's Standard Contractual Clauses (Decision 2021/914), the UK International Data Transfer Addendum, and their Swiss equivalents, together with the additional measures described in our Data Processing Addendum. You can ask for a copy of the relevant safeguards at privacy@louvain.ai.

7. How long we keep information

• Account information: for as long as your account is active, and for up to 12 months after it is closed, so we can handle questions and disputes, unless you ask us to delete it sooner and no legal reason requires us to keep it.
• Billing records: for seven years after the transaction, as required for tax and accounting purposes.
• Customer Data: as your organisation directs while its subscription is active, kept for 30 days after its agreement with us ends and then deleted, as described in our Terms of Service. A file or folder deleted from the Library is kept in Recently deleted for 30 days, so it can be restored, and then deleted; it is not searched or used to answer while it waits. Copies in backups are deleted as those backups expire.
• Demo booking and enquiry records: for up to 24 months after our last contact with you, unless you ask us to delete them sooner.
• Server logs and error reports: for up to 90 days.
• Product analytics events: for up to 24 months.
• Campaign attribution recorded with a workspace: for as long as that workspace exists.
• Security reports: for as long as needed to investigate and fix the issue, and then for up to 24 months.

We may keep information longer where the law requires it or to establish, exercise or defend legal claims.

8. Security

We protect personal information with technical and organisational measures appropriate to the risk, including encryption in transit, encryption at rest provided by our hosting and database providers, sealing of stored connector credentials, access controls that are applied before any content is retrieved, and audit logging of administrative actions. Our Security page and Annex II of our DPA describe these measures in more detail. No system is perfectly secure; if we learn of a breach affecting your personal information, we will notify you and the relevant regulators where the law requires it.

9. Your rights

Depending on where you live, you may have the right to:

• access the personal information we hold about you and receive a copy;
• correct information that is inaccurate or incomplete;
• delete your information;
• restrict or object to our use of your information, including for direct marketing;
• receive your information in a portable format and have it sent to another organisation;
• withdraw consent where we rely on it; and
• complain to a data protection authority.

EU, UK and Swiss residents have the rights listed above under the GDPR, the UK GDPR and the Swiss Federal Act on Data Protection.

California residents have the right to know what personal information we collect, use and disclose; to delete it; to correct it; and not to be discriminated against for exercising these rights. We do not sell or share personal information as those terms are defined in the California Consumer Privacy Act. You may use an authorised agent to make a request, and we may ask for proof of the agent's authority.

Hong Kong residents have the right under the Personal Data (Privacy) Ordinance (Cap. 486) to request access to and correction of their personal data. We may charge a fee for a data access request where the Ordinance permits it.

Australian and New Zealand residents have rights of access and correction under the Privacy Act 1988 (Cth) and the Privacy Act 2020 (NZ).

How to make a request. Email privacy@louvain.ai. We will need to verify your identity before acting on a request, and we will respond within the time the applicable law requires — generally within one month. If your request is about Customer Data held by an organisation that uses Louvain, we will refer you to that organisation, as described in section 4.

Marketing emails. You can opt out of marketing emails at any time by using the unsubscribe link in the email or by writing to us.

10. Children

The Service and our website are for businesses and are not directed to children. We do not knowingly collect personal information from anyone under 16. If you believe a child has given us personal information, contact us and we will delete it.

11. Changes to this policy

We may update this policy. We will post the new version on this page with its date, and if a change is significant we will tell account owners by email or in the Service before it takes effect.

12. Contact and complaints

Contact us at privacy@louvain.ai, or write to Louvain AI Ltd, registered in England and Wales (company number 17506006), at the address we will provide on request.

If you are not satisfied with our response, you can complain to your local data protection authority — for example, the UK Information Commissioner's Office, a supervisory authority in the EU member state where you live, the Office of the Privacy Commissioner for Personal Data in Hong Kong, the Office of the Australian Information Commissioner, or the Office of the Privacy Commissioner in New Zealand.

Questions about this document: privacy@louvain.ai.