Download Lesuto Hub & Seller - Shop and sell on iOS and Android
Download Lesuto Hub & Seller - Shop and sell on iOS and Android
Last Updated: November 3, 2026 | Version: 3.2.2
Effective Date: October 15, 2026
Last Updated: November 3, 2026
Version: 3.2.2
This Privacy Policy explains how Lesuto Technologies, Inc., a Texas corporation ("Lesuto," "we," "us"), with its principal office at 600 Congress Ave, STE 1400, Austin, TX 78701, collects, uses, shares, and protects personal information when you use the Lesuto Chameleon platform, including Lesuto Hub, storefronts powered by Lesuto, the Lesuto mobile apps, the merchant and supplier dashboards, and our websites (together, the "Platform").
It applies to shoppers ("Customers"), Hub users, website visitors, and the people who use the Platform for a business, such as Merchants, Suppliers, Operators, and their staff ("Business Users").
Lesuto is the merchant of record for purchases on the Platform, and is the controller of Customer checkout, account, payment, order, and Hub data. When a Business User uploads personal data to the Platform for its own purposes, Lesuto processes that data for the Business User under our Data Processing Agreement, and the Business User's own privacy notice applies.
Information you give us
Information collected automatically
Connected social accounts in Social Studio
A Business User can connect its own Facebook Pages, Instagram professional accounts, Threads, Pinterest, LinkedIn Company Pages, X, YouTube, and TikTok accounts to Social Studio, so it can publish and schedule its own posts and see how they perform. Connecting is optional and happens only when the Business User signs in to the network and approves the permissions that network shows. From each connected account we receive and store:
We use this information only to publish and schedule the Business User's posts, show their status and performance in its dashboard, and keep the connection working. We do not use it for advertising, we do not sell it, and we do not use it to build profiles of the people who follow or interact with the Business User's accounts. We do not read a connected account's other posts or private content except as needed for those features.
YouTube and other Google services. Social Studio uses the YouTube API Services to upload videos the Business User chooses to its own YouTube channel, set their title, description, and privacy, and read the channel name and the statistics of those videos. By connecting a YouTube channel, you agree to the YouTube Terms of Service (https://www.youtube.com/t/terms), and Google's use of your information is governed by the Google Privacy Policy (https://policies.google.com/privacy). You can remove Lesuto's access at any time in your Google Account permissions page (https://myaccount.google.com/permissions) or by disconnecting the channel in Social Studio. Lesuto's use and transfer of information received from Google APIs to any other app will adhere to the Google API Services User Data Policy (https://developers.google.com/terms/api-services-user-data-policy), including the Limited Use requirements. We do not use Google user data to develop, improve, or train generalized AI or machine learning models.
Removing access. Disconnecting an account in Social Studio deletes its access and refresh tokens straight away, and deletes any inbox comments and messages from it. You can also remove Lesuto in the network's own settings, for example: Facebook and Instagram (Settings, Apps and websites), Threads (Settings, Account, Website permissions), Pinterest (Settings, Security and logins, Apps), LinkedIn (Settings, Data privacy, Permitted services), X (Settings, Security and account access, Apps and sessions), TikTok (Settings and privacy, Security, Apps and services permissions), and Google (the Google Account permissions page above). When Meta (for Facebook and Instagram) or Threads sends us a data-deletion request, we delete that account's tokens and inbox data. Removing access in another network's settings stops Lesuto's access straight away; the account then shows as needing to reconnect, and you can disconnect it to delete its tokens. To have the rest deleted, follow the instructions at https://www.lesuto.com/legal/data-deletion or contact privacy@lesuto.com.
Information from others
We use personal information to: (a) provide and operate the Platform; (b) process orders, payments, refunds, commissions, and payouts as merchant of record; (c) deliver orders and provide customer support; (d) personalize product discovery and recommendations (see Section 5); (e) send service messages such as order confirmations, security alerts, and account notices; (f) send marketing messages where you have opted in; (g) keep the Platform secure, moderate content, and prevent fraud and abuse; (h) comply with legal obligations, including tax, accounting, and responding to lawful requests; (i) improve the Platform through analytics; (j) enforce our terms and defend legal claims; and (k) run the Seller Referral Program: attribute sign-ups to referring Stores, calculate and reverse referral credit, and detect self-referrals, linked accounts, and orders placed by a referrer's own team. For those checks we compare account, team, contact, device, network, payment, and order information across the Stores and buyers involved.
When a Business User connects a third-party marketplace, Lesuto may use anonymized, aggregated sales from that connection for category benchmarks and platform AI unless the Business User turns sharing off in Connected Marketplaces or Catalog. Other sellers never see identifiable shop, SKU, or order data from that connection. The Business User's own dashboards keep their full data. They can withdraw this sharing at any time.
If you are in the European Economic Area, the United Kingdom, or Switzerland, we rely on these legal bases:
We use your activity on the Platform (such as products viewed, liked, saved, and purchased, and the shopping country you select) to rank and recommend products, stores, and posts. You can turn off personalized recommendations in your settings, and we do not personalize when your browser sends a Global Privacy Control signal. Non-personalized results are then shown.
We use automated tools, including Stripe's fraud screening, to help detect fraudulent payments, and automated moderation tools to screen uploaded images and videos. A person reviews a decision to close an account or permanently remove content when you appeal it. We do not make decisions based solely on automated processing that produce legal or similarly significant effects on you.
We share personal information only as follows:
Suppliers, to fulfil your order: your name, shipping address, contact details needed by the carrier, gift message, and order contents. Suppliers may not use it for marketing.
Merchants, to operate the storefront you bought from: limited order information shown in their dashboard. Merchants do not receive your payment details.
Referring Stores, if a business signs up with a referral code: its business name, whether it is a merchant or supplier, the referral's status, its sign-up date, the date the referral stops earning, its credit cap, and the referral credit it has generated as monthly totals, never per sale. Referring Stores do not receive customer, order, product, sale amount, fee, payout, or contact information through the program. Credit amounts can indicate the general level of a referred business's sales. The referred business is told this at sign-up.
Social networks a Business User connects, to carry out its instructions: the post text, images, and video it chooses to publish, sent to that network under the Business User's own account. Information from one Business User's connected accounts is never shared with another Business User.
Service providers (sub-processors) that process data for us under contracts that restrict their use of it:
Stripe, Inc. (United States): Payment processing, identity verification, payouts, and tax calculation
Google LLC (Google Cloud Platform) (United States): Application hosting, databases, and object storage in us-west1; machine translation; AI model inference through Vertex AI
Amazon Web Services, Inc. (United States): AI model inference (Bedrock), automated image and video moderation (Rekognition), audio transcription (Transcribe), email delivery (SES), notifications (SNS), and object storage (S3)
Cloudflare, Inc. (United States and global edge network): DNS, content delivery, TLS termination, and request filtering
EasyPost (United States): Shipping labels and address validation
Mailgun Technologies, Inc. (United States): Transactional email
Wise Payments Limited (United Kingdom and United States): International payouts
Functional Software, Inc. (Sentry) (United States): Application error tracking
New Relic, Inc. (United States): Performance monitoring
Replicate, Inc. (United States): Premium AI media generation
650 Industries, Inc. (Expo) (United States): Mobile push notification delivery
Legal and safety: to comply with law, valid legal process, or a lawful request from public authorities; to protect the rights, safety, and property of Lesuto, our users, or others; and to report child sexual abuse material as the law requires.
Business transfers: to a successor in a merger, acquisition, financing, or sale of assets, subject to this Policy.
With your consent or at your direction.
We do not sell personal information, and we do not share it with third parties for their own marketing. Lesuto does not place third-party advertising cookies on Lesuto Hub. See Section 7 for storefronts where a Merchant has enabled advertising tools.
You can decline or withdraw cookie consent at any time through the cookie settings link. Our websites and storefronts treat a "Do Not Track" or Global Privacy Control signal as a refusal of analytics and advertising cookies.
We keep personal information only as long as needed for the purposes in this Policy:
We protect personal information with these measures:
No system is completely secure. Lesuto does not claim SOC 2, ISO 27001, or a completed PCI DSS self-assessment.
The Platform is hosted in Google Cloud us-west1 (Oregon, United States). If you are outside the United States, your information is transferred to and processed in the United States, which may not have the same data protection laws as your country. For transfers from the EEA, the UK, and Switzerland, we use the European Commission's Standard Contractual Clauses, the UK International Data Transfer Addendum, and their Swiss equivalent, together with the security measures in Section 10. You may request a copy of the relevant safeguards from eu-privacy@lesuto.com.
Everyone. You may ask to access, correct, delete, or receive a portable copy of your personal information, and you may object to processing based on legitimate interests. You can use the privacy and data tools in your account settings or contact us (see "How to make a request" below). We will not discriminate against you for exercising your rights.
EEA, UK, and Switzerland (GDPR). You also have the right to rectification, erasure, restriction of processing, data portability, and objection, to withdraw consent at any time, and to lodge a complaint with your local data protection supervisory authority. We respond within one month, extendable by two months for complex requests.
California (CCPA/CPRA). California residents have the right to know what personal information we collect, use, and disclose; to delete it; to correct it; to opt out of its sale or sharing; and to limit the use of sensitive personal information. In the past 12 months:
Texas and other U.S. states. Residents of Texas, Virginia, Colorado, Connecticut, Utah, Oregon, Montana, and other states with comprehensive privacy laws may have the right to confirm whether we process their personal data, and to access, correct, delete, and obtain a portable copy of it, and to opt out of targeted advertising, the sale of personal data, and profiling that produces legal or similarly significant effects. We do not sell personal data, including sensitive data, and we do not engage in that kind of profiling. To opt out of targeted advertising, use the cookie controls in Section 7 or Global Privacy Control.
Appeals. If we decline your request, you may appeal by replying to our decision or emailing privacy@lesuto.com with the subject "Privacy appeal." We will respond within the period the law requires (for example, 60 days in Texas). If your appeal is denied, you may contact your state attorney general.
Other countries. If you live in Canada, Australia, Brazil, or another country with a privacy law, you have the rights that law gives you, and you may contact us or your local privacy regulator.
How to make a request. Use the privacy and data tools in your account settings, or email privacy@lesuto.com (EEA and UK: eu-privacy@lesuto.com). We will verify your identity before acting, normally by confirming control of your account email. You may use an authorized agent, who must provide written permission from you, and we may ask you to confirm your identity directly. We respond within 45 days under U.S. state laws, extendable once by 45 days where permitted, and within the GDPR periods stated above.
The Platform is not intended for anyone under 18 (or the age of majority where they live), and we do not knowingly collect personal information from children under 13, or under 16 in the EEA and UK. If we learn that we have, we delete it promptly. If you believe a child has given us personal information, contact privacy@lesuto.com.
If a personal data breach is likely to put your rights at risk, we will notify you without undue delay, and we will notify supervisory authorities within 72 hours of becoming aware of the breach where the law requires. We will explain what happened, what data was affected, what we are doing about it, and what you can do to protect yourself.
We may update this Policy. We will tell you about material changes through the Platform or by email at least 30 days before they take effect. The "Last Updated" date shows the latest revision.
Privacy questions and requests:
EEA, UK, and Swiss residents: eu-privacy@lesuto.com
