Privacy Policy

Learaprovides a generative interface runtime for SaaS products. In this policy, "Leara", "we", "us", and "our" mean Techtale AB, unless the context says otherwise.

For privacy questions, requests, or complaints, contact us at privacy@leara.dev. For general support, contact support@leara.dev.

• Provide, operate, secure, and improve Leara.
• Manage the waitlist, prioritize access, and contact you about availability.
• Create and manage accounts, workspaces, projects, and API keys.
• Authenticate users and prevent unauthorized access.
• Compose, validate, render, meter, and debug generated interface output.
• Process subscriptions, invoices, taxes, payments, and plan limits.
• Respond to support requests and product feedback.
• Measure public website usage when optional cookies are accepted.
• Detect abuse, enforce limits, comply with law, and protect rights.

Where EU, UK, or similar privacy laws apply, we rely on the following legal bases:

• Contract: to provide the product, accounts, API access, support, and billing.
• Legitimate interests: to secure the service, prevent abuse, understand aggregate product usage, and improve reliability.
• Consent: for optional analytics cookies, waitlist access updates, and similar storage on public pages.
• Legal obligation: for accounting, tax, compliance, and lawful requests.

Leara may process prompts, context, retrieved data, generated interface trees, and related metadata to provide the product. Do not submit special category data, payment card numbers, health records, or other regulated data unless your agreement with us explicitly permits it and appropriate safeguards are in place.

Generated output can be incomplete or incorrect. You and your organization are responsible for reviewing outputs before using them for decisions that affect people, customers, finances, or legal rights.

We use strictly necessary cookies for authentication, security, and remembering cookie preferences. We use Google Analytics only after you accept optional cookies on public pages. See the Cookie Policy for details and how to change your choice.

We share personal data with service providers that help us host, secure, operate, analyze, and bill for Leara. These providers may include Render, MongoDB, Google, Stripe, and OpenAI depending on the features used. Our current list is available on the Subprocessors page.

We may also disclose data if required by law, to protect rights and security, or in connection with a merger, financing, acquisition, or similar corporate transaction.

Leara and its subprocessors may process personal data in countries outside your own. Where required, we rely on appropriate transfer safeguards such as adequacy decisions, standard contractual clauses, or equivalent contractual and technical protections.

We keep personal data only for as long as needed for the purposes described in this policy, unless a longer period is required by law. Typical retention periods are:

• Account and workspace data: while the account or workspace is active.
• Waitlist entries: until access is granted, you ask us to remove the entry, or the waitlist is no longer needed.
• API keys: metadata while active; full secrets are shown once and then stored only as hashes.
• Usage, trace, and security logs: as needed for reliability, abuse prevention, debugging, billing, and audit trails.
• Billing records: as required for tax, accounting, chargeback, and compliance obligations.
• Support messages: for as long as needed to respond and maintain a useful support history.
• Analytics data: according to the configured Google Analytics retention settings.

Depending on where you live, you may have rights to access, correct, delete, restrict, object to, or export your personal data. Where processing is based on consent, you may withdraw consent at any time.

Contact privacy@leara.dev to exercise these rights. We may need to verify your identity and, if your data is controlled by your organization, direct your request to that organization.

Signed-in users can also open Account settings, then Privacy & data, to download an account export or delete eligible Leara account data directly from the app.

We use technical and organizational measures designed to protect personal data, including access controls, secret hashing where appropriate, encryption for two-factor authentication secrets, server-side API key handling, transport security, provider-level infrastructure protections, and operational monitoring. No system is perfectly secure, but we work to reduce risk by default.

Leara is intended for business use and is not directed to children. Do not use Leara if you are under the age required to enter into a binding agreement in your jurisdiction.

We may update this policy as Leara changes. Material changes will be posted on this page, and where appropriate we will provide additional notice.

For general background on EU data protection concepts, see the European Commission data protection overview.