← Back to Levamio Brief-Erklärer

Privacy Policy – "Levamio Brief-Erklärer" (letter explainer app for iOS and Android)

Version 1.0 – release candidate 1.0 – not yet approved. Internal header, as of 20 Oct 2026: launch version; approval by Tassilo pending; law-firm review after first revenue. Release lock: DRAFT until approval („Freigabe Rechtstexte Levamio 1.0“) – do not publish. This header (all „>“ lines below the title) is removed after approval; publicly only “As of: 20 October 2026” remains at the end. Created with AI assistance following the structure of the "Unser Dubai" template; not legal advice, not reviewed by a lawyer. Open wording and missing details: FREIGABE_KOMPAKT.md. English version of datenschutz-brief-erklaerer.md; in case of discrepancies the German version prevails. Planned URL: https://levamio.com/apps/briefe/privacy (enter in App Store Connect and Google Play Console).
Based on a code review of apps/brief-erklaerer/ on 20 Oct 2026 (docs/privacy-notes.md, worker/wrangler.toml, worker/src/*, src/screens/*): no accounts, no analytics, advertising or tracking SDKs, no push server; server on Cloudflare Workers with counters in Durable Objects (no longer Workers KV) and reports in Workers KV, AI via Anthropic (direct API, USA), device attestation via Apple App Attest / Google Play Integrity, subscriptions via RevenueCat and App Store / Google Play (monthly and yearly only, no family plan).
Internal note – Apple guideline 5.1.2(i): before sharing personal data with a third-party AI the app must disclose what is shared and with whom and obtain explicit permission. The consent screen and section 4 must match.

1. Controller

NEXTLEVEL CORPORATE SERVICE PROVIDER - FZCO, Building A1, IFZA Business Park, Dubai Digital Park, Dubai Silicon Oasis, Dubai, United Arab Emirates (DIEZ License No. 67837), represented by Tassilo Peter Seitz. Levamio is an offering of NEXTLEVEL CORPORATE SERVICE PROVIDER - FZCO ("we", "us").
Privacy contact: [email protected] (general support: [email protected])

EU representative (Art. 27 GDPR): We are not established in the EU. If we appoint a representative under Art. 27 GDPR, we will name them here. You can always contact us directly with any data protection matter.
Data protection officer: none appointed at present. Your contact is the controller at the address above.

2. Key points

• No account needed. We do not know your name or email address.
• Your letter (photo or PDF) is sent via our server to our AI provider Anthropic (USA) only with your explicit consent and only to produce the explanation.
• We do not store your letters on our server. Content is processed in memory for the duration of the request only. Sole exception: you report an AI result and separately agree that it is included (section 6a, deleted after 90 days).
• Results, your folder and deadlines stay on your device only, encrypted – or not at all if you choose "Save nothing".
• No tracking, no advertising, no analytics tools.

3. Overview: what we process, why, and on what legal basis

You are not obliged to provide data. Without consent you can open the app but not have letters explained. We do not make automated decisions with legal effect (Art. 22 GDPR). The scam-check traffic light is an indication, not a decision about you. We do not sell your data or use it for advertising.

4. AI analysis of your letter

Consent: Before the first analysis the app shows a dedicated screen explaining what is sent, to whom, that we store nothing on the server, and that letters may contain sensitive information. Nothing is sent until you actively tick the box and tap "Agree and continue". Our server also rejects any analysis without consent. If the recipient or scope changes, we ask again.

Special categories (Art. 9 GDPR): Letters from authorities, health insurers, job centres, courts or debt collectors may contain information on health, social benefits, residence status or religion (e.g. church tax). We ask for your explicit consent under Art. 9(2)(a) GDPR.

Letters about criminal or administrative fine proceedings (Art. 10 GDPR): Please do not upload letters about criminal or administrative fine proceedings; the app is not intended for them. If such a letter is sent nevertheless, it is transmitted and analysed by the AI like any other letter, because that is how the app recognises it; we do not store it. If the app detects that a letter concerns such proceedings (e.g. a fine notice, hearing form or penalty order), it provides no explanation and no draft reply, only a general notice; the result is not saved in the folder. This detection is automated and not exhaustive.

Other people's data: Letters often contain information about third parties (e.g. case workers, family members). We process it only so that you can understand your letter (Art. 6(1)(f) GDPR). Please only submit letters addressed to you or that you handle with permission.

How it works:

1. The app resizes the photo on your device and sends it (or the PDF) encrypted (HTTPS) to our server, a Cloudflare Worker.
2. The server checks file type and size (max. 5 pages), your consent, the free allowance or your subscription, and usage limits; for the free letter also the device check (section 6).
3. It forwards the image or PDF with instructions to Anthropic (Anthropic PBC, USA, "Claude" language model). If the model is overloaded or the answer is unusable, the request is sent once to another Claude model of the same provider.
4. The answer (sender, plain-language summary, deadlines with verbatim quote, next steps, scam check, reply draft) is returned to your app.

No storage by us: Our server stores neither the image, nor the PDF, nor the answer (exception: reported results with your separate consent, section 6a). Our logs contain only technical metrics without content and without device identifier.

At Anthropic: Anthropic processes the request as our processor under its commercial terms and Data Processing Addendum. According to Anthropic's current information, API data is not used to train models and is usually deleted within 30 days; it is kept longer only in exceptional cases, in particular where content is flagged as violating Anthropic's usage policy (according to Anthropic up to 2 years) or where the law requires it. We have no influence on this retention. Processing takes place in the USA (section 9).

AI labelling: Every result is labelled "AI-generated" in the app and in the PDF export (transparency within the meaning of Art. 50 EU AI Act). The explanation is automated, may be wrong or incomplete and is not legal or tax advice. Always check deadlines in the original letter.

Withdrawal: You can withdraw consent at any time in Settings ("Withdraw consent") with effect for the future (Art. 7(3) GDPR). The app then no longer sends letters. Analyses already carried out remain lawful; no content of them is held on our server.

5. Data on your device

• Folder, results, deadlines, reply drafts: only if "Save encrypted" is on, in the app's local database (IndexedDB), encrypted with AES-GCM-256. The key is kept in the iOS Keychain (this device only, no iCloud sync) or the Android Keystore; on Android, cloud backup and device-to-device transfer are disabled for the app. With "Save nothing" the result stays in memory only while you view it. We do not receive this data and cannot view or restore it.
• Settings: language, display options, time and version of your consent, the random device identifier. You can view and copy the identifier under "Settings → Your device ID".
• Reminders: deadline reminders (7 days, 2 days and on the day) are local notifications without a server, containing no letter content, only a neutral text (e.g. "Deadline in 2 days – open Levamio"); they may be visible on the lock screen. The app asks for permission only when you set a reminder.
• Camera and photos: access only after you allow it in the system dialog. When picking from the gallery, the app only receives the images you select.
• Read aloud: uses your device's speech engine. Depending on the installed speech engine (especially on Android), its provider may process the text online under its own terms.
• Share, copy, PDF: only when you trigger it, the app passes the text or PDF to the app or clipboard you choose.

Delete this data in the app ("Delete all local data" removes the data and the key), by deleting individual entries or by uninstalling the app. The random device identifier is kept when local data is deleted and is only removed when you uninstall the app.

6. Free allowance, abuse protection and device check

On first use the app generates a random device identifier (not a hardware or advertising ID), sent with each analysis and each report. Our server stores it only as a salted hash with counters in Cloudflare Durable Objects:

• rate-limit counters (currently max. 5 letters per 10 minutes and 30 per day): between 15 minutes and 2 days depending on the window, then automatically deleted;
• free-allowance counter (currently one free letter): 400 days, then automatically deleted;
• one-time challenge for the device check: 15 minutes;
• cache of the last confirmed subscription status (for RevenueCat outages): 24 hours.

IP address: The free letter is available at most three times per internet connection per day. For this our server derives a daily-salted hash from your IP address (IPv6 truncated to the first 64 bits) and stores only this hash with a counter for 2 days. We do not store or log the IP address itself (for Cloudflare's technical processing see section 3); hashes from different days cannot be linked. There is also an overall daily cap for all free letters. Subscribers are not affected by these free-letter limits.

Device check (attestation): The free letter is only available if the app confirms that it is the genuine app running on a genuine device. On iOS the app uses Apple App Attest; your device communicates with Apple and our server verifies the result. On Android the app uses Google Play Integrity; our server sends the token to Google for evaluation. Apple and Google process device and app data under their own terms. We do not store the result, only that the challenge has been used. In our understanding Apple and Google act as independent controllers; data may also be transferred to the USA (section 9).

Without your device we cannot link the hashes to you; they are nevertheless pseudonymous personal data to which the GDPR applies. Legal basis: Art. 6(1)(f) GDPR; our legitimate interest is to distribute the free allowance fairly and to prevent abuse and excessive costs.

6a. Reporting a result

With "Report result" you can tell us about a wrong, offensive or dangerous AI result. We receive the reason, your optional comment (please no personal data) and technical details (prompt version, model, traffic-light colour, language, app version). Only if you tick the separate box (off by default) is the AI result included as well; it may contain content of your letter (e.g. sender, quotes). Photos or PDFs of your letter are never sent. Without the tick our server rejects any content.

We store the report in Cloudflare Workers KV without device identifier and without IP address; it is automatically deleted after 90 days. The server uses the device identifier and IP address only in hashed form to limit reports (max. 10 per device and 30 per connection per day). The purpose is improving and securing AI results; Google Play requires such a reporting feature for AI content. Legal basis: Art. 6(1)(f) GDPR; for included letter content your explicit consent (Art. 6(1)(a), Art. 9(2)(a) GDPR). As reports are not linked to a person, please give us the date and time of the report if you want to withdraw consent or have it deleted early.

7. Subscriptions and purchases

You subscribe in the Apple App Store or on Google Play. Payment, invoicing, cancellation and refunds are handled by the store, which is an independent controller. We receive no payment data, only which subscription is active.

We use RevenueCat (RevenueCat, Inc., USA) as our processor to manage subscriptions. RevenueCat receives the random device identifier as customer ID, receipts and subscription status from the store, product, price, store country, technical device/OS/app details and the IP address. Our server asks RevenueCat whether your subscription is active. Legal basis: Art. 6(1)(b) GDPR.

8. Retention

• Letter content and answers on our server: not stored (only during the request); exception section 6a.
• At Anthropic: according to Anthropic's current information usually no longer than 30 days, longer in exceptional cases (section 4).
• Hashes and counters (Durable Objects): rate limit 15 minutes to 2 days; free allowance 400 days; IP hash 2 days; challenge 15 minutes; subscription cache 24 hours.
• Reports on AI results: 90 days, then automatically deleted.
• Technical metrics and server logs: usually no longer than 30 days (Cloudflare Workers Logs; invocation logs off, 10 % sampling).
• Subscription data at RevenueCat: while the subscription exists and thereafter per RevenueCat's retention rules or our legal obligations.
• Data on your device: until you delete it or uninstall the app.
• Support requests: up to 3 years after closure.

9. Recipients and international transfers

USA: Transfers rely on the EU-US Data Privacy Framework adequacy decision (Art. 45 GDPR) where the recipient is certified, otherwise on the EU Standard Contractual Clauses (Art. 46(2)(c) GDPR) with supplementary measures (encryption in transit, no storage by us, data minimisation by resizing images).

United Arab Emirates: We are established in the UAE; there is no EU adequacy decision. Your letter content does not reach our systems in the UAE because we do not store it. We may view reported AI results (section 6a) from the UAE via secure connections in order to handle the report. We apply the GDPR to the extent it applies to our services.

10. Your rights

Under the GDPR you have the right of access (Art. 15), rectification (Art. 16), erasure (Art. 17), restriction (Art. 18), data portability (Art. 20) and to object to processing based on legitimate interests (Art. 21). You can withdraw your consent in the app at any time (Art. 7(3)). Withdrawal does not affect the lawfulness of processing before the withdrawal.

Right to object (Art. 21 GDPR): Where we process data on the basis of legitimate interests (Art. 6(1)(f) GDPR, e.g. abuse protection, reports, operation), you may object at any time on grounds relating to your particular situation. We will then stop processing unless we demonstrate compelling legitimate grounds which override your interests, rights and freedoms, or the processing serves the establishment, exercise or defence of legal claims. An informal message to [email protected] is sufficient.

As we keep no accounts and do not store letters, we only hold the hashes with counters and – for subscriptions – the data at RevenueCat; reports (section 6a) are not linked to a person. For access or erasure, please give us the device identifier shown in the app under "Settings → Your device ID" (can be copied there); without it we cannot link the data to you (Art. 11 GDPR). Contact [email protected]; we usually respond within one month.

You may lodge a complaint with a data protection supervisory authority, in particular in the EU/EEA member state of your habitual residence, place of work or the alleged infringement; in the UK with the ICO, in Switzerland with the Federal Data Protection and Information Commissioner (FDPIC).

11. Children

The app is intended for adults. The AI analysis may only be used from the age of 16 (cf. Art. 8 GDPR); by consenting you confirm that you are at least 16. We do not knowingly collect data from children. If we learn that data of a child is nevertheless held by us, we delete it as far as we can identify it.

12. Security

HTTPS in transit, no storage of letter content on the server, file type and size checks, instruction to the AI to treat letter content as data and not as instructions, validation of AI output against a fixed schema, salted hashes instead of identifiers and IP addresses, device check for the free letter, encrypted folder on the device with the key in Keychain/Keystore, no cloud backup on Android, secret keys only on the server.

13. Changes

We update this policy when features, service providers or the law change. If a change affects your consent, the app asks again. The current version is in the app and at https://levamio.com/apps/briefe/privacy.

As of: 20 October 2026