Privacy Policy

Last updated: May 12, 2026

1. Introduction

LockUp ("we," "our," or "us") is operated by Elev8 AI Solutions & Services. This Privacy Policy explains how we collect, use, and protect your information when you use the LockUp application and services.

2. Information We Collect

We collect the following types of information:

Account Information: Name, email address, and authentication data provided through Google Sign-In via Clerk.
Scan Data: URLs, domains, and targets you submit for security scanning, along with the resulting findings and reports.
Usage Data: How you interact with the application, including scan history, feature usage, and session information.
Payment Information: Billing data is processed securely by Stripe. We do not store credit card numbers on our servers.

3. How We Use Your Information

To provide and operate the security scanning service
To generate security reports and track your security posture
To process payments and manage subscriptions
To send alerts about security score changes
To improve our scanning accuracy and service quality
To communicate important service updates

4. Data Security

We implement industry-standard security measures to protect your data, including encryption in transit (TLS), secure database storage (Neon Postgres), and access controls via Clerk authentication. Scan results and findings are stored securely and accessible only to your authenticated account.

5. Subprocessors

We do not sell your personal information. We share data only with the subprocessors we need to operate the service. All of our subprocessors hold SOC 2 Type II or PCI DSS Level 1 attestations, or both. The current list is maintained at /security and includes:

Clerk: authentication & session management (SOC 2 Type II)
Stripe: payment processing (PCI DSS Level 1) — card data never touches our servers
Neon: US Postgres database (SOC 2 Type II)
Vercel: US hosting + edge network (SOC 2 Type II)
Anthropic: AI fix generation (SOC 2 Type II). Customer data is not used to train models.
Etherscan: public smart-contract source lookups (no personal data transmitted)

6. Data Retention

Retention differs by tier so that the storage burden matches the service you pay for:

Free tier: scan results are displayed in the dashboard during your session and are not retained long-term. They evaporate when you sign out.
Pro & Enterprise: scan results and reports are retained for 12 months after the scan date by default. Trust Reports remain valid for the life of the certificate (1 year from issuance).
Account closure: all data tied to your account is deleted within 30 days of closure, except where retention is legally required (e.g., billing records for tax compliance).

We never persist Supabase or Postgres connection strings you submit for RLS scanning. They are held only in memory during the scan and discarded when the function returns.

7. Your Rights

You have the following rights with respect to your personal data. EU and UK residents have additional protections under the GDPR / UK GDPR; California residents under the CCPA / CPRA:

Access: ask for a copy of the personal data we hold about you
Correction: ask us to fix inaccurate data
Erasure: ask us to delete your account and associated data (see /delete-account)
Portability: request an export of your scan history in JSON form
Opt out: stop non-essential communications from us
Withdrawal of consent: where we relied on your consent, you can withdraw it at any time

To exercise any of these rights, email powellb.elev8ai@gmail.com and we will respond within 30 days (or sooner where required by law).

8. Cookies

We use essential cookies for authentication and session management. We do not use advertising or tracking cookies.

9. Children's Privacy

LockUp is not intended for use by individuals under the age of 13. We do not knowingly collect personal information from children.

10. Contact Us

If you have questions about this Privacy Policy, contact us at:

Elev8 AI Solutions & Services
Email: powellb.elev8ai@gmail.com
Web: elev8ai.org