Privacy Policy

This policy explains what information LevelUp ("we", "us") collects through this website and member account, how we use it, and the choices available to you. Optional analytics and marketing tools stay off unless you choose to enable them.

Who we are

LevelUp is operated by Met in Dubai, United Arab Emirates. For privacy questions or to exercise your rights, email met@levelup-nly.com.

Information we collect

Depending on how you use the Service, we may collect:

Diagnostic assessment: your name, email address, optional Instagram handle, and your answers to the Freedom OS™ scoring questions.
Mentorship applications: your name, email address, WhatsApp number, company role and description, answers about your business, and referral or campaign details when available.
Book and Library requests: your email address, the book or Library Pass you asked about, and whether you agreed to receive an availability email.
Member account: your account identifier, name, primary email, diagnostic results, saved titles, and other activity associated with your account.
Library activity: books you view, podcasts you listen to, slide decks you open, saved titles, and waitlist or notification entries.
Purchases: item, amount, currency, purchase and access status, and subscription information. Stripe processes payment-card details; LevelUp does not store full card numbers.
Results and Library access: an email address and one-time verification code used to confirm access. If you verify a different purchase email while signed in, we use that verified address to connect eligible purchases to your account.
Privacy requests: your account name, email address, account identifier, and the request you ask us to review, such as a request to delete your data.
Browser and campaign information: the page you arrived on, referral URL, and campaign tags may be kept in session storage and sent with a form submission. If you allow optional tracking, the enabled analytics providers may collect technical usage data.

Analytics providers may process information such as pages viewed, approximate location, device and browser type, and referral source when you enable analytics. When a relevant pixel or audience-measurement integration is configured, and consent is obtained where required, hashed contact details may be shared with Meta or Google to measure campaigns or match audiences. Hashing does not make personal data anonymous. Opt out at any time by emailing met@levelup-nly.com.

How we use your information

To provide the diagnostic, save and show your results, and manage your account
To review and respond to mentorship applications, book requests, and privacy requests
To connect eligible purchases to your account and provide purchased materials
To send transactional messages, including verification codes, purchase confirmations, and one welcome email after signup
To email you about availability when you ask us to notify you
To understand site usage when you enable analytics and to measure campaigns when you enable marketing

We do not sell personal information for money. Some privacy laws may treat optional advertising measurement as sharing for targeted advertising. You can disable it in Cookie Settings; we honor a Global Privacy Control signal by keeping marketing tracking off.

Legal grounds

Where the GDPR or UK GDPR applies, we rely on your consent for optional analytics, marketing, and notifications you request; on a contract or steps you ask us to take for accounts, assessments, mentorship applications, purchases, and Library access; on legitimate interests for security, fraud prevention, and operating the Service; and on legal obligations for required records. Under UAE data protection law, we process information on consent or another ground permitted by law, including when needed to provide a requested service or comply with a legal obligation. Where Turkey's KVKK applies, processing relies on the conditions permitted by that law, including contract performance, legal obligations, legitimate interests where permitted, and explicit consent when required.

We share information with service providers only as needed to operate the Service:

Resend — delivers verification, welcome, purchase, and privacy-request emails on our behalf.
Google Forms — receives a copy of assessment submissions as a backup record for the founder.
Google Sheets — stores founder application, book-interest, and purchase records for the LevelUp team.
Clerk — provides sign-in, account management, and account metadata used to prevent duplicate welcome emails.
Stripe — processes checkout and subscription payments.
Replit — hosts the website, application, and application data.
Google Analytics and Microsoft Clarity — process site-usage information when configured and permitted by your cookie choices.
Meta — may process campaign or audience-measurement information when a Meta pixel is configured and permitted by your cookie choices.
Google — may receive hashed contact details for audience measurement when an eligible integration is configured and permitted by law.

We may also disclose information if required by law, or to protect the rights, safety, or property of LevelUp or others.

International processing. Our providers may process information outside the UAE, including in the countries where their services operate. Where required, we use a transfer mechanism permitted by applicable law, such as an adequacy decision or contractual safeguards. You can request details of applicable transfer safeguards by emailing us.

Cookies and browser storage

Optional tracking is off until you give consent. Analytics scripts for Google Analytics 4 and Microsoft Clarity load only after analytics consent; the Meta Pixel loads only after marketing consent, when the relevant service is configured. When you withdraw consent, the site updates the providers immediately, stops sending new page-view events for that category, and clears optional cookies it can remove from this site. We apply a Global Privacy Control signal to keep marketing tracking off. You can enable, reject, or change your choices at any time in Cookie Settings.

Cookie choice: the first-party levelup_cookie_consent cookie stores your selected categories, policy version, timestamp, and expiry for about 12 months; a matching localStorage copy is the fallback if cookies are unavailable. The banner stays hidden across prototype and Shell pages and return visits until the choice expires or the policy version changes. We also keep a server-side consent record with the policy version and categories selected.
Library access: the HTTP-only levelup_library_access cookie supports verified purchase access for 30 days.
Sign-in: Clerk uses necessary session cookies; the default maximum session lifetime is 7 days, subject to Clerk’s configured settings.
Analytics and marketing: Google Analytics, Microsoft Clarity, and Meta Pixel may set the cookies listed in Cookie Settings after the corresponding consent.
Podcast downloads: downloaded files and their details may be stored in your browser's Cache API and IndexedDB until you remove them or clear browser storage.
Other browser storage: campaign attribution is kept in session storage for the current browser session, and local storage remembers whether the browser has already been asked to preserve podcast downloads.

Data retention

Verification codes expire after 10 minutes and are deleted after expiry. The Library access cookie lasts 30 days, and your cookie choice lasts about 12 months (365 days), unless the policy version changes first. Account, assessment, library activity, and saved-title records are kept while an account is active and are scheduled for deletion or anonymization within 30 days of a verified account-closure request, except where needed for legal claims, security, or required records. Waitlist details are kept for up to 24 months after last interaction. Purchase and accounting records may be retained for up to 7 years where required. Privacy-request and consent records may be retained for up to 3 years to document compliance. Email delivery and suppression records are kept as needed to deliver messages and honor opt-outs. Provider settings and legal requirements may require different periods.

Google Analytics 4 event and user-level retention is controlled by its property setting (standard options are 2 or 14 months); the website code cannot confirm which setting is active. Microsoft Clarity states that playback data is retained for 30 days and click data and labeled or favorited sessions for up to 9 months. Provider settings and aggregate reports may have different retention periods.

Your rights and choices

Depending on the law that applies—including the GDPR, UK GDPR, UAE PDPL, and Turkey KVKK—you may request access, correction, deletion, and portability; object to or restrict processing; and withdraw consent. You may complain to an EEA supervisory authority, the UK Information Commissioner's Office, the competent UAE data protection authority, or Turkey's Personal Data Protection Authority (KVKK Board), as applicable. Where applicable, you can opt out of marketing tracking by enabling Global Privacy Control in your browser or using Cookie Settings. To make a request, use the Account section of your profile or email met@levelup-nly.com. We may ask you to verify your identity. Some information may need to be retained for legal or transaction records.

Security

We use reasonable technical safeguards to protect your information. No method of transmission or storage is completely secure, and we cannot guarantee absolute security.

Children's privacy

This site is not directed at children under 16, and we do not knowingly collect information from them.

Changes to this policy

We may update this policy from time to time. Changes take effect when posted on this page, with an updated "Last updated" date.

Contact

Questions about this policy or your data? Email met@levelup-nly.com.