Privacy Policy

This Privacy Policy explains how LK Digital Solutions LLC (“LK Digital Solutions LLC,” “we,” “us,” or “our”) collects, uses, processes, discloses, and protects information about you when you access or use AI Integrator, including AI Integrator Chat, AI Integrator Code, AI Integrator Mobile, our websites at https://aiintegrator.dev, and our related applications, APIs, and billing systems (collectively, the “Services”).

We believe privacy disclosures should be transparent, precise, and technically accurate rather than vague marketing statements. Our core commitments to you are simple and binding:

• No Sale of Data: We will never sell your personal data. We do not sell your personal information, chat histories, prompts, or code to data brokers, advertisers, or third parties, and we do not share your data for cross-context behavioral advertising.
• No Human Transcript Inspection: No human at LK Digital Solutions LLC will read your Chat transcripts unless we are required to do so by law, or you explicitly ask us to look at a specific conversation in order to help you.
• No Foundation Model Training: We do not use your private Customer Content, Chat transcripts, files, or code to train our own foundation models.
• Transparent Updates: Material changes to these terms or this policy will be posted on this page.

1. Data controller and contact information

The data controller responsible for personal data processed through the Services is LK Digital Solutions LLC.

If you have any questions, concerns, or requests regarding this Privacy Policy or our data practices, please contact our privacy team:
LK Digital Solutions LLC
Attn: Privacy Officer
Email: hello@aiintegrator.dev

2. Information we collect

We collect personal information directly from you, automatically through your interactions with the Services, and from third-party authentication providers:

• Account Identifiers: When you authenticate via Google OAuth (through Supabase Auth), we receive and store your email address, full name, avatar profile image URL, and a unique, stable Supabase user UUID. We also store user interface preferences (such as theme choices and display names) associated with your profile.
• Chat and Workspace Content: Prompts, conversation histories, model completions, tool call traces, project context instructions, memory facts, scheduled task configurations, and files you upload to Chat (including text files, source code, documents, images, and generated synthetic audio).
• Audio and Speech Data: If you use voice dictation (speech-to-text), we temporarily process the raw audio captured through your microphone to transcribe your input. If you use text-to-speech features, we generate and store synthetic voice audio files in your workspace library.
• Billing and Transaction Records: Subscription plan status (Free, Plus, Pro), wallet credit balances, credit transaction ledgers, Stripe customer IDs, Stripe subscription IDs, invoice line items, and transaction timestamps. We do not collect or store full payment card numbers, card expiration dates, or CVV security codes on our servers; all payment card details are collected and processed directly by Stripe.
• Technical, Log, and Usage Telemetry: IP addresses, browser user-agent strings, operating system versions, client software build identifiers, access timestamps, HTTP referrers, model identifiers invoked, token counts (input, output, and reasoning tokens), speech duration metrics, and latency performance statistics.
• Diagnostic and Crash Data: Application errors, server exception logs, and sanitized client crash reports generated during service operation, used exclusively to identify software defects and ensure system stability.
• Security and Abuse Investigation Records: In the event of suspected violations of our Terms of Service or Acceptable Use Policy (AUP), we may log, correlate, and retain IP history, autonomous system numbers (ASNs), coarse geographic location, rate-limit trigger records, anomalous spend velocity, cryptographic hash fingerprints of abusive inputs or files, and the minimum necessary content snippets strictly required to confirm and remediate the violation.

3. AI Integrator Code: Local-first privacy architecture

AI Integrator Code is engineered with a strict local-first boundary. When you run Code on macOS or Windows:

• Your source code repositories, Git branches, working trees, commit history, and terminal session buffers remain on your local machine;
• Vendor CLI credentials, API keys, and personal access tokens (such as tokens for Anthropic Claude Code, OpenAI, Cursor, or GitHub) stay stored in your operating system’s secure credential store or local environment;
• LK Digital Solutions LLC is not a credential proxy and does not sit between your local CLIs and third-party model providers; and
• We do not copy, mirror, or upload your local repositories to our cloud servers as a condition of using AI Integrator Code.

If you pair AI Integrator Mobile with a desktop instance of Code via our Mobile Gateway relay, the session communicates over an end-to-end authenticated TLS transport. The paired mobile client only displays the run summaries, diff previews, and controls you explicitly authorize within your approved scopes. Pairing does not sync your underlying Git repository to our cloud backend.

4. The Chat inference pipeline (how data flows)

When you submit a message in AI Integrator Chat, your data traverses a specific cloud pipeline:

1. Edge Processing: Your turn is received by our Next.js edge application hosted on Vercel, which verifies your active Supabase session and checks your wallet credit balance.
2. Gateway Routing: The turn (including your prompt, necessary context attachments, and system instructions) is transmitted to the Vercel AI Gateway, tagged with your selected model identifier and our configured privacy headers.
3. Model Inference: The Vercel AI Gateway forwards the request to the designated third-party model provider (such as OpenAI, Anthropic, Google Cloud, or xAI) for completion.
4. Persistence: The prompt, completion tokens, credit debits, and metadata are written to our PostgreSQL database and object storage hosted by Supabase.

When you index files or record memory items, text embeddings are generated using embedding models routed through the same Vercel AI Gateway and stored in vector indexes within Supabase.

5. Zero Data Retention and model training controls

In AI Integrator Chat, we provide granular controls for Zero Data Retention (ZDR) and Disallow Prompt Training.

• How the Flags Work: When enabled, our edge application transmits the standardized privacy directives (zeroDataRetention and disallowPromptTraining) through the Vercel AI Gateway on all eligible text inference and embedding calls. We also lock and disable models on our allowlist that do not support or honor these privacy flags.
• Upstream Boundaries: These flags are programmatic requests communicated to upstream providers. While tier-1 providers contractually commit to honoring these headers, ZDR is an instruction to the upstream model provider regarding their own server retention; it is not a protocol we can physically monitor inside an external datacenter.
• ZDR Does Not Delete Your Supabase History: Upstream ZDR governs whether the foundation model provider logs or caches your inference turn on their servers. It does not automatically delete the conversation history saved in your personal AI Integrator account on Supabase. You maintain full control over your stored history and can delete individual conversations, files, or memories at any time directly in the app.

6. Speech processing technical reality (TTS and STT)

Voice processing features (Speech-to-Text dictation and Text-to-Speech audio rendering) operate under different technical constraints than standard text models:

• No ZDR Route on Speech Models: Foundation speech models available via the Vercel AI Gateway currently do not offer Zero Data Retention endpoints.
• Automatic Fallback: If you enable ZDR in your account settings and invoke a voice or audio feature, ZDR is forced off for that specific audio request so that the turn can execute successfully.
• No-Training Enforcement: We continue to pass the disallowPromptTraining flag on speech requests, and we lock speech models that do not support a verified no-training route.
• Safety Logging: Spoken audio inputs may be retained temporarily by upstream speech providers for trust, safety, and abuse monitoring under their respective commercial policies. Do not speak passwords, cryptographic keys, medical records, or highly confidential data into the microphone.
• Saved Audio Files: When synthetic speech or transcribed audio is saved into your workspace Files, subsequent text search, summary, or embedding operations on that stored file honor your standard ZDR and no-training settings.

7. Files and memory: Operational boundaries

Files you upload to Chat and facts stored in Memory are hosted in Supabase object storage and PostgreSQL tables, encrypted at rest. These features serve as an active semantic context library to enable model retrieval, document analysis, and conversational memory.

Files and Memory are not a certified compliance vault: We do not offer customer-managed encryption keys (CMEK), HIPAA Business Associate Agreements (BAAs), or PCI-DSS Level 1 certified storage environments for workspace uploads. Files stored in Chat may be retrieved, tokenized, and transmitted to third-party models that you select during a conversation.

You should not store production database credentials, unencrypted private keys, confidential patient records, tax filings, or highly sensitive proprietary secrets in Chat files or Memory.

8. Legal bases and purposes for processing

Under applicable data protection laws (including the EU/UK General Data Protection Regulation and U.S. state privacy statutes), we process personal data under the following lawful bases:

• Performance of Contract: To create and administer your account, provide Chat and Code functionality, process prompt inferences, manage file and memory storage, meter wallet credit debits, and process subscription renewals.
• Legitimate Interests: To protect the security and integrity of our systems, investigate fraud, enforce our Terms of Service and AUP, diagnose technical bugs, and maintain the operational reliability of the Services.
• Compliance with Legal Obligations: To maintain statutory financial and tax records, satisfy legal process, and fulfill mandatory reporting duties (including CSAM reporting).
• Consent: Where you have granted explicit consent for specific optional features or integrations, which you may withdraw at any time.

9. Third-party subprocessors and service providers

We partner with trusted enterprise service providers to operate the technical infrastructure of the Services. Each subprocessor is bound by contractual data protection commitments:

• Vercel, Inc. (United States): Web application hosting, edge middleware, serverless compute, system logging, and the Vercel AI Gateway model routing layer.
• Supabase, Inc. (United States): Cloud database (PostgreSQL), user authentication services, vector database indexing, and cloud object storage.
• Stripe, Inc. (United States): Payment card processing, subscription lifecycle management, fraud screening, and tax calculation.
• Google LLC (United States): OAuth 2.0 identity authentication provider.
• Model and Speech Providers (Various): Upstream artificial intelligence providers reached via the Vercel AI Gateway (including OpenAI LLC, Anthropic PBC, Google Cloud Vertex AI, and xAI Corp.) that process inference requests according to our model allowlist and transmitted privacy flags.

Beyond these subprocessors, we disclose personal data only in limited circumstances: to comply with a subpoena, court order, or other valid legal process, or to respond to a lawful government request; to enforce our Terms, investigate fraud or abuse, or protect the rights, property, or safety of LK Digital Solutions LLC, our users, or the public; to a successor in the event of a merger, acquisition, financing, or sale of assets, in which case this policy continues to govern the transferred data until you are notified otherwise; or with your direction or consent. Where the law permits, we will tell you about a legal request for your data before we respond to it.

10. Cookies, tracking, and web analytics

We maintain a privacy-respecting stance regarding tracking and analytics:

• We do not deploy third-party advertising tracking pixels, cross-app trackers, or behavioral marketing beacons on our websites or applications;
• We do not sell personal data to data brokers or advertising networks; and
• We use strictly necessary first-party cookies and browser localStorage solely to maintain your authenticated session, remember interface preferences (such as light or dark appearance mode), and safeguard against cross-site request forgery (CSRF).

Because we do not track you across sites or sell or share personal data, there is nothing for a browser Do Not Track or Global Privacy Control signal to switch off; we treat every visitor as though the signal were set.

11. Data security measures

We implement industry-standard technical and organizational security measures to safeguard personal data against unauthorized access, destruction, loss, or alteration:

• Encryption in Transit: All communications between your client devices and our servers, and between our servers and upstream providers, are encrypted using modern Transport Layer Security (TLS 1.3 / HTTPS);
• Encryption at Rest: Cloud databases, object storage buckets, and backups are encrypted at rest using industry-standard AES-256 algorithms;
• Row-Level Security (RLS): Our database employs strict Row-Level Security policies in PostgreSQL, ensuring that data queries are cryptographically and logically isolated to your authenticated user identifier; and
• Access Controls: Administrative access to production databases and cloud consoles is restricted to authorized personnel using multi-factor authentication (MFA) on a strict principle of least privilege.

No system is perfectly secure, and you are responsible for keeping your Google account and devices protected. If we learn of a breach affecting your personal data, we will notify you and any required regulator without undue delay and within the timeframes applicable law requires, using the email address on your account.

12. Data retention and account deletion

• Active Chat and Workspace Content: Prompts, completions, files, and memories are retained in your account until you delete them or your account is terminated.
• Billing and Transaction Data: Subscription and credit transaction records are retained for statutory periods mandated by commercial, tax, and accounting regulations (typically seven years).
• Security and Investigation Logs: Telemetry collected in connection with security incidents or AUP violations is retained for the duration of the investigation, any applicable statutory limitation period, or required legal hold.
• System Backups: Database snapshots and operational backups are purged on a rolling schedule (typically within thirty days).
• Account Deletion: You may delete individual chat threads, uploads, and memories directly in the application interface at any time. To request complete, permanent deletion of your account and associated personal data, submit a request through your account settings or email hello@aiintegrator.dev. Upon identity verification, we will permanently purge your user profile, threads, files, and memories from our active databases within thirty (30) days.

13. Your legal privacy rights

Depending on your jurisdiction (including the European Economic Area, the United Kingdom, California, Virginia, Colorado, and other U.S. states), you may have specific statutory rights regarding your personal data:

• Right to Know and Access: The right to request confirmation of whether we process your personal data and to obtain a copy of your personal data in a portable format.
• Right to Correction / Rectification: The right to request that we correct inaccurate or incomplete personal data.
• Right to Deletion / Erasure: The right to request the deletion of personal data we collected from you, subject to legal exceptions (such as tax compliance or security defense).
• Right to Restrict or Object: The right to restrict or object to certain processing activities based on legitimate interests.
• California Disclosures (CCPA/CPRA): We do not sell personal information or share personal information for cross-context behavioral advertising. We do not use or disclose sensitive personal information for purposes other than providing the Services. In the preceding twelve (12) months, we have collected the categories of personal information disclosed in Section 2 of this policy for the business purposes described in Section 8.
• Non-Discrimination: We will never discriminate against you, deny you services, charge different prices, or provide a lower quality of service because you exercised any of your statutory privacy rights.

To exercise any of these rights, please email us at hello@aiintegrator.dev with the subject line “Privacy Rights Request.” To safeguard your privacy, we will verify your request against the authenticated email address associated with your account before acting.

14. Children’s privacy

The Services are strictly designed for and directed to adults. The Services are not intended for, and we do not knowingly collect personal information from, individuals under 18 years of age (or under 13 for purposes of the U.S. Children’s Online Privacy Protection Act, COPPA). If we learn that we have inadvertently collected personal data from a minor under 18 without verified parental consent, we will take immediate steps to permanently delete that account and purge the associated data. If you believe a minor has registered an account, please contact us immediately at hello@aiintegrator.dev.

15. International data transfers

LK Digital Solutions LLC and its primary cloud infrastructure are headquartered in the United States. If you access or use the Services from the European Union, the United Kingdom, or other jurisdictions with laws governing data collection and use, please note that your personal data will be transferred to, stored, and processed in the United States and other global regions where our subprocessors operate. We implement appropriate safeguards (such as standard contractual clauses) to ensure your data receives an adequate level of legal protection.

16. Modifications to this Privacy Policy

Material changes to these terms or this policy will be posted on this page. When we make material revisions, we will update the Effective Date at the top of this page and, where appropriate, provide prominent notice through the user interface or via email. Your continued use of the Services following the publication of an updated Privacy Policy constitutes your binding acceptance of the updated terms.

17. Copyright and legal notice

AI Integrator © 2026 LK Digital Solutions LLC. All rights reserved. AI Integrator is a product and trademark of LK Digital Solutions LLC.

Privacy inquiries may be submitted to: hello@aiintegrator.dev.