Privacy Policy

Letzte Aktualisierung: October 15, 2026 | Version: 3.2

**Effective Date:** October 15, 2026

**Last Updated:** October 15, 2026

**Version:** 3.2

1. Who We Are and What This Policy Covers

This Privacy Policy explains how Lesuto Technologies, Inc., a Texas corporation ("Lesuto," "we," "us"), with its principal office at 600 Congress Ave, STE 1400, Austin, TX 78701, collects, uses, shares, and protects personal information when you use the Lesuto Chameleon platform, including Lesuto Hub, storefronts powered by Lesuto, the Lesuto mobile apps, the merchant and supplier dashboards, and our websites (together, the "Platform").

It applies to shoppers ("Customers"), Hub users, website visitors, and the people who use the Platform for a business, such as Merchants, Suppliers, Operators, and their staff ("Business Users").

Lesuto is the merchant of record for purchases on the Platform, and is the controller of Customer checkout, account, payment, order, and Hub data. When a Business User uploads personal data to the Platform for its own purposes, Lesuto processes that data for the Business User under our Data Processing Agreement, and the Business User's own privacy notice applies.

2. Information We Collect

**Information you give us**

Account details: name, email address, phone number, password, and profile details.

Order details: shipping and billing address, items purchased, gift messages, and recipient name and address for gifts.

Payment details: entered directly into Stripe's secure fields. Lesuto receives payment metadata (such as card brand, last four digits, and payment status) but never your full card number.

Hub and social activity: posts, reviews, photos, videos, livestream participation, comments, follows, likes, boards, and messages.

Social Studio inbox (Business Users): comments and text-only messages from Instagram and Facebook accounts the Business User connects. Lesuto is the processor for that inbox text. We do not use it for recommendations or advertising. We store text only. We delete it when the account is disconnected, when Meta sends a data-deletion request, or after 90 days for direct messages.

Business User details: business name and address, staff users, tax forms, and payout account details (bank details and identity verification are collected and held by Stripe or Wise).

Communications: support tickets, emails, and feedback.

**Information collected automatically**

Device and usage data: browser and app version, operating system, device type, pages and products viewed, searches, clicks, and session times.

Network data: IP address and approximate location derived from it (country or region). We do not collect precise geolocation.

Push notification tokens, if you allow notifications in the mobile apps.

Cookies and similar technologies, as described in Section 7.

**Information from others**

Stripe and Wise: payment and payout status, and identity-verification results for Business Users.

Shipping carriers: delivery status and tracking events.

Merchants and Suppliers: order fulfilment and support updates.

3. How We Use Information

We use personal information to: (a) provide and operate the Platform; (b) process orders, payments, refunds, commissions, and payouts as merchant of record; (c) deliver orders and provide customer support; (d) personalize product discovery and recommendations (see Section 5); (e) send service messages such as order confirmations, security alerts, and account notices; (f) send marketing messages where you have opted in; (g) keep the Platform secure, moderate content, and prevent fraud and abuse; (h) comply with legal obligations, including tax, accounting, and responding to lawful requests; (i) improve the Platform through analytics; and (j) enforce our terms and defend legal claims.

When a Business User connects a third-party marketplace, Lesuto may use anonymized, aggregated sales from that connection for category benchmarks and platform AI unless the Business User turns sharing off in Connected Marketplaces or Catalog. Other sellers never see identifiable shop, SKU, or order data from that connection. The Business User's own dashboards keep their full data. They can withdraw this sharing at any time.

4. Legal Basis for Processing (GDPR)

If you are in the European Economic Area, the United Kingdom, or Switzerland, we rely on these legal bases:

**Contract:** to create your account, process orders and payments, deliver products, and provide the Platform.

**Legitimate interests:** to keep the Platform secure, prevent fraud, moderate content, run basic analytics, improve our services, and establish or defend legal claims. We balance these interests against your rights, and you may object (see Section 12).

**Legal obligation:** to keep tax and accounting records and to respond to lawful requests.

**Consent:** for non-essential cookies, personalized recommendations where consent is required, push notifications, and marketing messages. You may withdraw consent at any time without affecting earlier processing.

5. Personalization and Automated Decisions

We use your activity on the Platform (such as products viewed, liked, saved, and purchased, and the shopping country you select) to rank and recommend products, stores, and posts. You can turn off personalized recommendations in your settings, and we do not personalize when your browser sends a Global Privacy Control signal. Non-personalized results are then shown.

We use automated tools, including Stripe's fraud screening, to help detect fraudulent payments, and automated moderation tools to screen uploaded images and videos. A person reviews a decision to close an account or permanently remove content when you appeal it. We do not make decisions based solely on automated processing that produce legal or similarly significant effects on you.

6. How We Share Information

We share personal information only as follows:

**Suppliers**, to fulfil your order: your name, shipping address, contact details needed by the carrier, gift message, and order contents. Suppliers may not use it for marketing.

**Merchants**, to operate the storefront you bought from: limited order information shown in their dashboard. Merchants do not receive your payment details.

**Service providers (sub-processors)** that process data for us under contracts that restrict their use of it:

**Stripe, Inc.** (United States): Payment processing, identity verification, payouts, and tax calculation

**Google LLC (Google Cloud Platform)** (United States): Application hosting, databases, and object storage in us-west1; machine translation; AI model inference through Vertex AI

**Amazon Web Services, Inc.** (United States): AI model inference (Bedrock), automated image and video moderation (Rekognition), audio transcription (Transcribe), email delivery (SES), notifications (SNS), and object storage (S3)

**Cloudflare, Inc.** (United States and global edge network): DNS, content delivery, TLS termination, and request filtering

**EasyPost** (United States): Shipping labels and address validation

**Mailgun Technologies, Inc.** (United States): Transactional email

**Wise Payments Limited** (United Kingdom and United States): International payouts

**Functional Software, Inc. (Sentry)** (United States): Application error tracking

**New Relic, Inc.** (United States): Performance monitoring

**Replicate, Inc.** (United States): Premium AI media generation

**650 Industries, Inc. (Expo)** (United States): Mobile push notification delivery

**Legal and safety:** to comply with law, valid legal process, or a lawful request from public authorities; to protect the rights, safety, and property of Lesuto, our users, or others; and to report child sexual abuse material as the law requires.

**Business transfers:** to a successor in a merger, acquisition, financing, or sale of assets, subject to this Policy.

**With your consent** or at your direction.

**We do not sell personal information**, and we do not share it with third parties for their own marketing. Lesuto does not place third-party advertising cookies on Lesuto Hub. See Section 7 for storefronts where a Merchant has enabled advertising tools.

7. Cookies and Tracking

**Essential cookies:** sign-in, cart, checkout, security, and load balancing. These are required and cannot be turned off.

**Functional cookies:** preferences such as language, region, and dashboard state.

**Analytics cookies:** Google Analytics 4 and similar tools that measure usage and performance. These are set only after you consent.

**Merchant advertising tools:** a Merchant may enable advertising tools on its storefront, such as Meta Pixel, TikTok Pixel, or Pinterest Tag. These load only after you consent through the storefront's cookie banner. They may collect device identifiers and browsing activity on that storefront, which may count as "sharing" for cross-context behavioral advertising under California law. Merchants may not configure them to send your name, email, phone number, address, or payment details.

You can decline or withdraw cookie consent at any time through the cookie settings link. Our websites and storefronts treat a "Do Not Track" or Global Privacy Control signal as a refusal of analytics and advertising cookies.

8. Email and Notifications

**We follow an opt-in policy for marketing.** No marketing emails are sent unless you turn them on in your notification preferences.

You can opt in to specific categories, such as promotions, product drops, platform updates, and digests. The master email preference must be on before any category is sent.

**Service messages** (order confirmations, security alerts, password resets, payment notices) are sent as needed to operate the Platform and meet legal obligations.

Every marketing email includes an unsubscribe link, and you can change preferences at any time in your settings.

Push notifications are sent only if you allow them on your device, and you can turn them off in your device settings.

9. Data Retention

We keep personal information only as long as needed for the purposes in this Policy:

**Account data:** for the life of your account, then deleted or anonymized within 30 days after an account deletion request, except as stated below.

**Order and financial records:** 7 years after the transaction, to meet tax and accounting obligations.

**Usage and analytics data:** raw logs deleted after 90 days; analytics aggregated or anonymized after 24 months.

**Support tickets:** 3 years after resolution.

**Hub content:** until you delete it or your account, subject to backups and legal holds.

**Social Studio inbox:** comments and text DMs from connected Instagram and Facebook accounts are deleted when the Business User disconnects the account, when Meta sends a data-deletion request, or after 90 days for direct messages.

**Legal acceptance records:** for the life of the agreement and the period in which claims may be brought. On a valid erasure request, we remove the IP address and user agent but keep the document, version, user identity, and timestamp, which are needed to prove the agreement.

**Legal holds:** we keep information longer where needed to comply with law or to establish, exercise, or defend legal claims.

10. Data Security

We protect personal information with these measures:

Data in transit is protected with TLS 1.2 or higher. Data at rest is encrypted with AES-256 by the underlying cloud providers.

Role-based access controls with least privilege

Lesuto runs automated static code analysis, weekly dependency vulnerability scanning, and automated security tests before every release.

Card payments are processed by Stripe, a PCI DSS Level 1 certified service provider. Card numbers are entered directly into Stripe-hosted fields and are never transmitted to, stored on, or processed by Lesuto's servers.

Multi-factor authentication is available for dashboard accounts.

Lesuto applies rate limiting and request filtering at the API gateway, and audit logging of administrative actions.

No system is completely secure. Lesuto does not claim SOC 2, ISO 27001, or a completed PCI DSS self-assessment.

11. International Data Transfers

The Platform is hosted in Google Cloud us-west1 (Oregon, United States). If you are outside the United States, your information is transferred to and processed in the United States, which may not have the same data protection laws as your country. For transfers from the EEA, the UK, and Switzerland, we use the European Commission's Standard Contractual Clauses, the UK International Data Transfer Addendum, and their Swiss equivalent, together with the security measures in Section 10. You may request a copy of the relevant safeguards from eu-privacy@lesuto.com.

12. Your Rights

**Everyone.** You may ask to access, correct, delete, or receive a portable copy of your personal information, and you may object to processing based on legitimate interests. You can use the privacy and data tools in your account settings or contact us (see "How to make a request" below). We will not discriminate against you for exercising your rights.

**EEA, UK, and Switzerland (GDPR).** You also have the right to rectification, erasure, restriction of processing, data portability, and objection, to withdraw consent at any time, and to lodge a complaint with your local data protection supervisory authority. We respond within one month, extendable by two months for complex requests.

**California (CCPA/CPRA).** California residents have the right to know what personal information we collect, use, and disclose; to delete it; to correct it; to opt out of its sale or sharing; and to limit the use of sensitive personal information. In the past 12 months:

**Categories collected:** identifiers (name, email, phone, IP address, account ID); customer records (address, payment metadata); commercial information (orders and returns); internet activity (browsing, searches, interactions); approximate geolocation (from IP address); audio and visual information (photos, videos, and livestreams you upload); professional information (for Business Users); inferences (shopping preferences used for recommendations); and sensitive personal information limited to account login credentials and, for Business Users, tax identification numbers.

**Sources:** you, your device, Stripe and Wise, carriers, and Merchants and Suppliers.

**Purposes:** those in Section 3.

**Disclosed for business purposes to:** Suppliers and Merchants (as described in Section 6), service providers, payment processors, and carriers.

**Sold:** none. **Shared for cross-context behavioral advertising:** only device identifiers and browsing activity, through advertising tools a Merchant enables on its storefront and only after you consent (Section 7). To opt out, decline or withdraw cookie consent, or enable Global Privacy Control.

**Sensitive personal information:** used only to provide the Platform, verify identity, and meet legal obligations, so the right to limit does not apply.

**Retention:** as described in Section 9.

**Notice of financial incentive:** some storefronts offer loyalty programs that give points or rewards for purchases and activity, using your account, order, and activity information. Joining is optional, and you can leave at any time by contacting support@lesuto.com. We consider the value of your information to be reasonably related to the value of the rewards, based on the costs of providing the program.

**Texas and other U.S. states.** Residents of Texas, Virginia, Colorado, Connecticut, Utah, Oregon, Montana, and other states with comprehensive privacy laws may have the right to confirm whether we process their personal data, and to access, correct, delete, and obtain a portable copy of it, and to opt out of targeted advertising, the sale of personal data, and profiling that produces legal or similarly significant effects. We do not sell personal data, including sensitive data, and we do not engage in that kind of profiling. To opt out of targeted advertising, use the cookie controls in Section 7 or Global Privacy Control.

**Appeals.** If we decline your request, you may appeal by replying to our decision or emailing privacy@lesuto.com with the subject "Privacy appeal." We will respond within the period the law requires (for example, 60 days in Texas). If your appeal is denied, you may contact your state attorney general.

**Other countries.** If you live in Canada, Australia, Brazil, or another country with a privacy law, you have the rights that law gives you, and you may contact us or your local privacy regulator.

**How to make a request.** Use the privacy and data tools in your account settings, or email privacy@lesuto.com (EEA and UK: eu-privacy@lesuto.com). We will verify your identity before acting, normally by confirming control of your account email. You may use an authorized agent, who must provide written permission from you, and we may ask you to confirm your identity directly. We respond within 45 days under U.S. state laws, extendable once by 45 days where permitted, and within the GDPR periods stated above.

13. Children's Privacy

The Platform is not intended for anyone under 18 (or the age of majority where they live), and we do not knowingly collect personal information from children under 13, or under 16 in the EEA and UK. If we learn that we have, we delete it promptly. If you believe a child has given us personal information, contact privacy@lesuto.com.

14. Data Breach Notification

If a personal data breach is likely to put your rights at risk, we will notify you without undue delay, and we will notify supervisory authorities within 72 hours of becoming aware of the breach where the law requires. We will explain what happened, what data was affected, what we are doing about it, and what you can do to protect yourself.

15. Changes to This Policy

We may update this Policy. We will tell you about material changes through the Platform or by email at least 30 days before they take effect. The "Last Updated" date shows the latest revision.

16. Contact

Privacy questions and requests:

Email: privacy@lesuto.com

Mail: Lesuto Technologies, Inc.

600 Congress Ave, STE 1400

Austin, TX 78701

United States

EEA, UK, and Swiss residents: eu-privacy@lesuto.com

Privacy Policy

Letzte Aktualisierung: October 15, 2026 | Version: 3.2

PDF herunterladen