Privacy Policy

1. Our Privacy Philosophy

Leako ("we", "us", or "our") is committed to deterministic, zero-trust data protection. We understand that billing data is the lifeblood of your SaaS business. Our core architecture requires strictly read-only Stripe API access. We never request write permissions, checkout capabilities, or access to sensitive financial credentials.

2. Data We Collect & Access

• Account Information: Name, business email, and company details when registering an account.
• Stripe Restricted API Keys: Read-only tokens you provide with specific scoping on Customers, Subscriptions, Invoices, Prices, and Coupons. Keys are encrypted at rest using AES-256-GCM.
• Billing Metadata: Subscription status, invoice retry history, discount durations, and catalog pricing records required to calculate leakage formulas.
• Zero Payment Card Data: We never touch, process, or store raw credit card numbers, CVVs, or bank account numbers. Stripe retains all PCI-DSS compliant payment instruments.

3. How We Use Billing Data

We use accessed billing records exclusively to:

• Identify uncollected invoices, exhausted retries, and invalid coupons.
• Calculate exact dollar leakage formulas and remediation recommendations for your team.
• Generate verified recovery logs and triage workflows within your private console.
• Deliver automated webhook alerts if you are subscribed to continuous monitoring.

We never sell, broker, or aggregate your company's billing figures for third-party benchmarking or advertising.

4. Data Security & Encryption

All communication between your browser, our servers, and Stripe's API endpoints is encrypted using TLS 1.3. Stored tokens, customer IDs, and forensic logs are protected with database-level encryption at rest. Access tokens can be revoked immediately from your Stripe Dashboard at any time.

5. Data Deletion & Retention

You maintain full ownership of your data. If you disconnect your Stripe account or close your Leako account, your restricted API keys and scanned finding snapshots are permanently purged from our active databases within 14 days.

6. Contact Us

If you have any questions about this Privacy Policy or our security architecture, please contact us at [email protected].