Privacy Policy

This Privacy Policy explains how LK Digital Solutions LLC (“LK Digital Solutions LLC,” “we,” “us,” or “our”) collects, uses, processes, discloses, and protects information about you when you access or use AI Integrator, including AI Integrator Chat, AI Integrator Code, AI Integrator Mobile, our websites at https://aiintegrator.dev, and our related applications, APIs, and billing systems (collectively, the “Services”).

We believe privacy disclosures should be transparent, precise, and technically accurate rather than vague marketing statements. Our core commitments to you are simple and binding:

• No Sale of Data: We will never sell your personal data. We do not sell your personal information, chat histories, prompts, or code to data brokers, advertisers, or third parties, and we do not share your data for cross-context behavioral advertising.
• No Human Transcript Inspection: No human at LK Digital Solutions LLC will read your Chat transcripts unless we are required to do so by law, or you explicitly ask us to look at a specific conversation in order to help you.
• No Foundation Model Training: We do not use your private Customer Content, Chat transcripts, files, or code to train our own foundation models.
• Transparent Updates: Material changes to these terms or this policy will be posted on this page.

1. Data controller and contact information

The data controller responsible for personal data processed through the Services is LK Digital Solutions LLC.

If you have any questions, concerns, or requests regarding this Privacy Policy or our data practices, please contact our privacy team:
LK Digital Solutions LLC
Attn: Privacy Officer
Email: integrator@lkdigitalsolutions.com

2. Information we collect

We collect personal information directly from you, automatically through your interactions with the Services, and from third-party authentication providers:

• Account Identifiers: When you authenticate via Google or Sign in with Apple (through Supabase Auth), we receive and store your email address when the provider returns one, full name, avatar profile image URL when the provider supplies one, and a unique, stable Supabase user UUID. Apple may hide your email behind a private relay address or omit it. We also store user interface preferences (such as theme choices and display names) associated with your profile.
• Chat and Workspace Content: Prompts, conversation histories, model completions, tool call traces, project context instructions, memory facts, scheduled task configurations, and files you upload to Chat (including text files, source code, documents, images, and generated synthetic audio).
• Audio and Speech Data: If you use voice dictation (speech-to-text), we temporarily process the raw audio captured through your microphone to transcribe your input. If you use text-to-speech features, we generate and store synthetic voice audio files in your workspace library.
• Billing and Transaction Records: Subscription plan status (Free, Pro, Max), included and extra usage balances, usage receipts, the client that opened the account, the country of the first request that reached the account (kept as a country code, not an IP address, and not replaced by a later request), the model on the first prompt, the time we first said included usage had run out, Stripe customer IDs, Stripe subscription IDs, invoice line items, and transaction timestamps. We do not collect or store full payment card numbers, card expiration dates, or CVV security codes on our servers; all payment card details are collected and processed directly by Stripe.
• Technical, Log, and Usage Telemetry: IP addresses, browser user-agent strings, operating system versions, client software build identifiers, access timestamps, HTTP referrers, model identifiers invoked, token counts (input, output, and reasoning tokens), speech duration metrics, and latency performance statistics.
• Diagnostic and Crash Data: Application errors, server exception logs, and sanitized client crash reports generated during service operation, used exclusively to identify software defects and ensure system stability.
• Automatic Error Reports: When the web, desktop, or mobile app hits an error, it sends us the error message, the place in our code where it happened, the in-app route you were on, the app version, and how many times it repeated. Secrets are stripped on your device before the report is sent, and reports never include your messages, prompts, files, or model output. Identical errors are merged into a single counted record per account rather than stored one by one, capped at 200 records per account, and deleted 30 days after the error was last seen. You can turn this off at any time in Settings → Advanced → Privacy → Automatic error reports; with it off, nothing is collected or sent.
• Bug Reports: What you write in a bug report, any screenshots you attach, the app and version you were using, and the diagnostics you leave switched on when you send it. We use them to find and fix problems, to reply to you about the report, and to credit your account when a report helps.
• Agreement and Email Choices: The versions of the Terms of Service and this Privacy Policy you agreed to, when you agreed, and which app you used. Whether you want product emails, and each time you change that answer.
• Support Notes: Short notes we write when we help you or answer a bug report, such as what you asked for and what we did. They never contain your chats or files.
• Security and Abuse Investigation Records: In the event of suspected violations of our Terms of Service or Acceptable Use Policy (AUP), we may log, correlate, and retain IP history, autonomous system numbers (ASNs), coarse geographic location, rate-limit trigger records, anomalous spend velocity, cryptographic hash fingerprints of abusive inputs or files, and the minimum necessary content snippets strictly required to confirm and remediate the violation.

3. AI Integrator Code: Local-first privacy architecture

AI Integrator Code is engineered with a strict local-first boundary. When you run Code on macOS or Windows:

• Your source code repositories, Git branches, working trees, commit history, and terminal session buffers remain on your local machine;
• Vendor CLI credentials, API keys, and personal access tokens (such as tokens for Anthropic Claude Code, OpenAI, Cursor, or GitHub) stay stored in your operating system’s secure credential store or local environment;
• LK Digital Solutions LLC is not a credential proxy and does not sit between your local CLIs and third-party model providers; and
• We do not copy, mirror, or upload your local repositories to our cloud servers as a condition of using AI Integrator Code.

If you pair AI Integrator Mobile with a desktop instance of Code through the Mobile Gateway, your phone connects to your own computer using a route that you select and manage. Current options are direct LAN, Tailscale, and ZeroTier. LK Digital Solutions LLC does not operate or monitor these routes or administer your router, firewall, tailnet, ZeroTier network, or third-party network account. Connection security depends in part on your configuration, devices, credentials, network membership, security updates, and access controls.

Mobile Gateway sessions use authenticated, scoped application controls and supported routes use encrypted or locally pinned transports as applicable. These safeguards reduce risk but cannot eliminate vulnerabilities, compromised devices or credentials, configuration errors, prompt injection, malicious dependencies or content, unauthorized access, or unintended agent actions. A paired mobile client displays only the run information and controls authorized by its approved scopes, and pairing does not sync the underlying Git repository to our cloud backend. Review the additional remote-agent risks and user responsibilities in the Terms of Service.

We do not currently operate a hosted relay for Code. We may introduce an optional hosted relay in the future, but it is not part of the current data flow. Before offering one, we will update these disclosures to describe its data practices, subprocessors, security boundary, and user choices.

4. The Chat inference pipeline (how data flows)

When you submit a message in AI Integrator Chat, your data traverses a specific cloud pipeline:

1. Edge Processing: Your turn is received by our Next.js edge application hosted on Vercel, which verifies your active Supabase session and checks your remaining included and extra usage.
2. Gateway Routing: The turn (including your prompt, necessary context attachments, and system instructions) is transmitted to the Vercel AI Gateway, tagged with your selected model identifier and our configured privacy headers.
3. Model Inference: The Vercel AI Gateway forwards the request to the designated third-party model provider (such as OpenAI, Anthropic, Google Cloud, or xAI) for completion.
4. Persistence: The prompt, completion tokens, credit debits, and metadata are written to our PostgreSQL database and object storage hosted by Supabase.

When you index files or record memory items, text embeddings are generated using embedding models routed through the same Vercel AI Gateway and stored in vector indexes within Supabase.

5. Zero Data Retention and model training controls

In AI Integrator Chat, we provide granular controls for Zero Data Retention (ZDR) and Disallow Prompt Training.

• How the Flags Work: When enabled, our edge application transmits the standardized privacy directives (zeroDataRetention and disallowPromptTraining) through the Vercel AI Gateway on all eligible text inference and embedding calls. We also lock and disable models on our allowlist that do not support or honor these privacy flags.
• Upstream Boundaries: These flags are programmatic requests communicated to upstream providers. While tier-1 providers contractually commit to honoring these headers, ZDR is an instruction to the upstream model provider regarding their own server retention; it is not a protocol we can physically monitor inside an external datacenter.
• ZDR Does Not Delete Your Supabase History: Upstream ZDR governs whether the foundation model provider logs or caches your inference turn on their servers. It does not automatically delete the conversation history saved in your personal AI Integrator account on Supabase. You maintain full control over your stored history and can delete individual conversations, files, or memories at any time directly in the app.

6. Speech processing technical reality (TTS and STT)

Voice processing features (Speech-to-Text dictation and Text-to-Speech audio rendering) operate under different technical constraints than standard text models:

• No ZDR Route on Speech Models: Foundation speech models available via the Vercel AI Gateway currently do not offer Zero Data Retention endpoints.
• Automatic Fallback: If you enable ZDR in your account settings and invoke a voice or audio feature, ZDR is forced off for that specific audio request so that the turn can execute successfully.
• No-Training Enforcement: We continue to pass the disallowPromptTraining flag on speech requests, and we lock speech models that do not support a verified no-training route.
• Safety Logging: Spoken audio inputs may be retained temporarily by upstream speech providers for trust, safety, and abuse monitoring under their respective commercial policies. Do not speak passwords, cryptographic keys, medical records, or highly confidential data into the microphone.
• Saved Audio Files: When synthetic speech or transcribed audio is saved into your workspace Files, subsequent text search, summary, or embedding operations on that stored file honor your standard ZDR and no-training settings.

7. Files and memory: Operational boundaries

Files you upload to Chat and facts stored in Memory are hosted in Supabase object storage and PostgreSQL tables, encrypted at rest. These features serve as an active semantic context library to enable model retrieval, document analysis, and conversational memory.

Files and Memory are not a certified compliance vault: We do not offer customer-managed encryption keys (CMEK), HIPAA Business Associate Agreements (BAAs), or PCI-DSS Level 1 certified storage environments for workspace uploads. Files stored in Chat may be retrieved, tokenized, and transmitted to third-party models that you select during a conversation.

You should not store production database credentials, unencrypted private keys, confidential patient records, tax filings, or highly sensitive proprietary secrets in Chat files or Memory.

8. Legal bases and purposes for processing

Under applicable data protection laws (including the EU/UK General Data Protection Regulation and U.S. state privacy statutes), we process personal data under the following lawful bases:

• Performance of Contract: To create and administer your account, provide Chat and Code functionality, process prompt inferences, manage file and memory storage, meter account usage, and process subscription renewals.
• Legitimate Interests: To protect the security and integrity of our systems, investigate fraud, enforce our Terms of Service and AUP, diagnose technical bugs, and maintain the operational reliability of the Services.
• Product Improvement and Support (Legitimate Interests): To see which features and models accounts use, from the usage records we already keep for billing, so we can improve the Services and help you when you contact us. This never involves reading your content.
• Product Emails (Consent): To send news about the Services only to accounts that said yes. You can say no at any time.
• Compliance with Legal Obligations: To maintain statutory financial and tax records, satisfy legal process, and fulfill mandatory reporting duties (including CSAM reporting).
• Consent: Where you have granted explicit consent for specific optional features or integrations, which you may withdraw at any time.

9. Third-party subprocessors and service providers

We partner with trusted enterprise service providers to operate the technical infrastructure of the Services. Each subprocessor is bound by contractual data protection commitments:

• Vercel, Inc. (United States): Web application hosting, edge middleware, serverless compute, system logging, and the Vercel AI Gateway model routing layer.
• Supabase, Inc. (United States): Cloud database (PostgreSQL), user authentication services, vector database indexing, and cloud object storage.
• Stripe, Inc. (United States): Payment card processing, subscription lifecycle management, fraud screening, and tax calculation.
• Google LLC (United States): OAuth 2.0 identity authentication provider, and Google Analytics 4 for first-party website and web-app usage measurement on aiintegrator.dev.
• Apple Inc. (United States): Sign in with Apple identity authentication provider for the website, desktop app, and iPhone companion.
• Model and Speech Providers (Various): Upstream artificial intelligence providers reached via the Vercel AI Gateway (including OpenAI LLC, Anthropic PBC, Google Cloud Vertex AI, and xAI Corp.) that process inference requests according to our model allowlist and transmitted privacy flags.

Beyond these subprocessors, we disclose personal data only in limited circumstances: to comply with a subpoena, court order, or other valid legal process, or to respond to a lawful government request; to enforce our Terms, investigate fraud or abuse, or protect the rights, property, or safety of LK Digital Solutions LLC, our users, or the public; to a successor in the event of a merger, acquisition, financing, or sale of assets, in which case this policy continues to govern the transferred data until you are notified otherwise; or with your direction or consent. Where the law permits, we will tell you about a legal request for your data before we respond to it.

10. Cookies, tracking, and web analytics

We maintain a privacy-respecting stance regarding tracking and analytics:

• We do not deploy third-party advertising tracking pixels, cross-app trackers, or behavioral marketing beacons on our websites or applications;
• We do not sell personal data to data brokers or advertising networks;
• On the public website and web app at aiintegrator.dev, we use Google Analytics 4 to understand how many people visit marketing pages and the web product. Google receives the page URL after we strip chat, project, and other account identifiers, plus standard technical data such as truncated IP address, browser, and device. We do not send prompts, transcripts, files, or account emails to Google Analytics;
• Google Analytics sets first-party cookies (such as _ga) on that host. We also use strictly necessary first-party cookies and browser localStorage to maintain your authenticated session, remember interface preferences (such as light or dark appearance mode), and safeguard against cross-site request forgery (CSRF); and
• If your browser sends a Global Privacy Control or Do Not Track signal, we do not load Google Analytics.

Google Analytics does not run in AI Integrator Code on your computer, in the iPhone companion talking to your desktop, or on local and preview hosts. It is not required to use the Services.

11. Data security measures

We use technical and organizational safeguards reasonably designed to protect personal data against unauthorized access, destruction, loss, or alteration, including:

• Encryption in Transit: All communications between your client devices and our servers, and between our servers and upstream providers, are encrypted using modern Transport Layer Security (TLS 1.3 / HTTPS);
• Encryption at Rest: Cloud databases, object storage buckets, and backups are encrypted at rest using industry-standard AES-256 algorithms;
• Row-Level Security (RLS): Our database employs strict Row-Level Security policies in PostgreSQL, ensuring that data queries are cryptographically and logically isolated to your authenticated user identifier; and
• Access Controls: Administrative access to production databases and cloud consoles is restricted to authorized personnel using multi-factor authentication (MFA) on a strict principle of least privilege.

No safeguard or system is perfectly secure. Despite our efforts, cyberattacks, software vulnerabilities, malicious insiders, third-party service failures, compromised credentials, and other events may result in unauthorized access, disclosure, alteration, or loss. We cannot guarantee that the Services or personal data will never be accessed, compromised, or lost. You are responsible for protecting your Google account, devices, credentials, paired devices, and user-managed LAN, Tailscale, and ZeroTier routes. If we learn of a breach affecting your personal data, we will notify you and any required regulator without undue delay and within the timeframes applicable law requires, using the email address on your account. The allocation and limits of liability for security incidents are described in the Terms of Service, subject to rights and obligations that cannot lawfully be limited.

12. Who at LK Digital Solutions LLC can see your account

Only the owners of LK Digital Solutions LLC can open our internal account tools, and only after signing in with Google or Apple. Each time they open an account, a bug report, or the product-email list, the tools record who opened it and when. Those records are kept for two years.

The account tools show:

• your email address, name, and profile picture from your sign-in provider;
• when you joined, which app you joined from, and when you were last active;
• your plan, balance, and purchases, and counts of your usage by feature, model, and day;
• the apps and devices signed in to your account;
• bug reports you sent, with any screenshots and diagnostics you attached;
• how many automatic error reports your apps sent, and their messages;
• whether you agreed to the Terms and want product emails; and
• support notes we wrote.

The account tools do not show your chats, prompts, model replies, files, memories, agents, projects, or images. They show nothing from Code, which runs on your computer and never reaches us. We look at your content only as described under Security and Abuse Investigation Records in Section 2, when the law requires it, or when you ask us to. You can ask for a copy of the notes we keep about you, and they are deleted with your account.

13. Emails from us

• Service emails: We email you about your account, billing, security, changes to our terms, and bug reports you sent. These are part of the Services and do not depend on your email choice.
• Product emails: News about the Services goes only to accounts that said yes, when signing up or in Settings. In the United States the box starts checked; everywhere else it starts empty. You can turn product emails off at any time in Settings → Account, or by replying to any product email and asking us to stop. We act on that within ten business days.
• How we send: We send email ourselves, without a separate email delivery service. If we start using one, we will add it to Section 9 before we do.

14. Data retention and account deletion

• Active Chat and Workspace Content: Prompts, completions, files, and memories are retained in your account until you delete them or your account is terminated.
• Billing and Transaction Data: Subscription and credit transaction records are retained for statutory periods mandated by commercial, tax, and accounting regulations (typically seven years).
• Security and Investigation Logs: Telemetry collected in connection with security incidents or AUP violations is retained for the duration of the investigation, any applicable statutory limitation period, or required legal hold.
• Agreement Records, Email Choices, and Support Notes: Kept while your account exists and deleted with it. Records of which owner opened an account keep only the account's ID and are deleted after two years.
• System Backups: Database snapshots and operational backups are purged on a rolling schedule (typically within thirty days).
• Account Deletion: You may delete individual chat threads, uploads, and memories directly in the application interface at any time. To request complete, permanent deletion of your account and associated personal data, submit a request through your account settings or email integrator@lkdigitalsolutions.com. Upon identity verification, we will permanently purge your user profile, threads, files, and memories from our active databases within thirty (30) days.

15. Your legal privacy rights

Depending on your jurisdiction (including the European Economic Area, the United Kingdom, California, Virginia, Colorado, and other U.S. states), you may have specific statutory rights regarding your personal data:

• Right to Know and Access: The right to request confirmation of whether we process your personal data and to obtain a copy of your personal data in a portable format.
• Right to Correction / Rectification: The right to request that we correct inaccurate or incomplete personal data.
• Right to Deletion / Erasure: The right to request the deletion of personal data we collected from you, subject to legal exceptions (such as tax compliance or security defense).
• Right to Restrict or Object: The right to restrict or object to certain processing activities based on legitimate interests.
• California Disclosures (CCPA/CPRA): We do not sell personal information or share personal information for cross-context behavioral advertising. We do not use or disclose sensitive personal information for purposes other than providing the Services. In the preceding twelve (12) months, we have collected the categories of personal information disclosed in Section 2 of this policy for the business purposes described in Section 8.
• Non-Discrimination: We will never discriminate against you, deny you services, charge different prices, or provide a lower quality of service because you exercised any of your statutory privacy rights.

To exercise any of these rights, please email us at integrator@lkdigitalsolutions.com with the subject line “Privacy Rights Request.” To safeguard your privacy, we will verify your request against the authenticated email address associated with your account before acting.

16. Children’s privacy

The Services are strictly designed for and directed to adults. The Services are not intended for, and we do not knowingly collect personal information from, individuals under 18 years of age (or under 13 for purposes of the U.S. Children’s Online Privacy Protection Act, COPPA). If we learn that we have inadvertently collected personal data from a minor under 18 without verified parental consent, we will take immediate steps to permanently delete that account and purge the associated data. If you believe a minor has registered an account, please contact us immediately at integrator@lkdigitalsolutions.com.

17. International data transfers

LK Digital Solutions LLC and its primary cloud infrastructure are headquartered in the United States. If you access or use the Services from the European Union, the United Kingdom, or other jurisdictions with laws governing data collection and use, please note that your personal data will be transferred to, stored, and processed in the United States and other global regions where our subprocessors operate. We implement appropriate safeguards (such as standard contractual clauses) to ensure your data receives an adequate level of legal protection.

18. Modifications to this Privacy Policy

Material changes to these terms or this policy will be posted on this page. When we make material revisions, we will update the Effective Date at the top of this page and, where appropriate, provide prominent notice through the user interface or via email. Your continued use of the Services following the publication of an updated Privacy Policy constitutes your binding acceptance of the updated terms.

19. Copyright and legal notice

AI Integrator © 2026 LK Digital Solutions LLC. All rights reserved. AI Integrator is a product and trademark of LK Digital Solutions LLC.

Privacy inquiries may be submitted to: integrator@lkdigitalsolutions.com.