Levelset

Privacy Policy

Last updated: September 27, 2026

1. Introduction

Levelset ("we," "our," or "us") provides workforce operations software for Chick-fil-A Operators and their teams: the website at levelset.io, the dashboard at app.levelset.io, and the Levelset mobile app. This Privacy Policy explains what information we collect, how we use it, and the choices you have.

2. Two kinds of people use Levelset

Customers and visitors. If you sign up for Levelset, run an organization on it, or browse our website, we collect information from you directly, and this policy applies to you in full.

Team members of our customers. Most of the information inside Levelset is entered by your employer about its team: rosters, position ratings, accountability records, evaluations, and schedules. For that information, your employer decides what is collected and who can see it, and we process it on their behalf. If you are a team member with questions about your records, or you want something corrected or deleted, start with your employer; we support them in honoring those requests.

3. Information we collect

Account information

  • Name, email address, and optionally a phone number when an account is created for you
  • Business information such as operator name and store number
  • Messages you send us through the contact form or support email

Workforce information entered by your organization

  • Team rosters: names, roles, positions, hire dates, and schedules (including imports from the scheduling system your organization connects)
  • Position ratings and comments recorded by leaders
  • Accountability records: infractions, point totals, disciplinary actions, and related notes
  • Evaluations and their scores
  • Signatures captured on accountability forms, and photos or files attached to records
  • Documents your organization uploads, such as handbooks and policies

Payment information

Payments are processed by Stripe. Your card number never touches our servers; we store only what Stripe returns to us, such as a customer reference and subscription status. Invoices and receipts are handled by Stripe on our behalf.

Collected automatically

  • Product analytics: pages and screens visited, features used, browser and device type, and approximate location derived from IP address
  • On the website and dashboard we use session replay to understand usability problems; keystrokes and typed input are masked
  • Log data kept for security and debugging

From the mobile app

  • A push notification token for your device, if you enable notifications
  • Photos or files you choose to attach to a record, using the camera or photo library you grant access to
  • If you turn on Face ID or Touch ID sign-in, the biometric check happens entirely on your device. We never receive or store biometric data.

4. How we use information

  • To provide the service: dashboards, ratings, accountability tracking, evaluations, scheduling, and forms
  • To set up your organization, including reading documents and forms you upload so they can be converted into Levelset configuration
  • To power AI features for organizations whose plan includes them, as described below
  • To bill subscriptions, send transactional email (invitations, receipts, alerts your organization configures), and provide support
  • To understand product usage and improve Levelset
  • To protect the service against fraud, abuse, and unauthorized access

We do not sell personal information, we do not run third-party advertising inside the product, and the product does not track you across other companies' apps or websites. Our marketing website may use a Facebook pixel to measure advertising; the product itself does not.

5. AI processing

Some Levelset features use large language models: the Levi assistant (in Levelset and in Slack), document and form import, AI-generated summaries, and AI-assisted shift setups. When your organization uses these features, the content a feature needs (for example a question you ask, a document you upload, or rating data) is sent to OpenRouter, which passes each request to the company that makes the model and returns the result. The models in use today are:

  • Google Gemini models: Levi's answers, reading documents and forms, short summaries, and search
  • A Meta Llama model: summaries of discipline records
  • An OpenAI model: indexing uploaded documents so they can be searched
  • Jev, a model from Typesafe: sorting text into categories and suggesting which Slack member matches which person on your roster

Every request to a Google Gemini model and to Jev instructs OpenRouter to use only providers that do not collect the data. Documents your organization uploads are also indexed by PageIndex so Levi can find answers in them. AI features are only active for organizations whose plan or settings include them.

6. Service providers

We share information only with providers that help us run Levelset, bound by agreements limiting their use of it:

  • Supabase: database, authentication, and file storage
  • Stripe: payments and invoicing
  • Vercel and Fly.io: application hosting
  • PostHog: product analytics and masked session replay
  • Resend: transactional email
  • Google: maps and business profile data for locations, and the Gemini models described above
  • OpenRouter: AI processing, passing requests to Google, Meta, OpenAI, and Typesafe as described above
  • PageIndex: indexing uploaded documents for search
  • DeepL: translation
  • Apple and Expo: mobile app delivery, updates, and push notifications

We may also disclose information if required by law, or as part of a merger, acquisition, or sale of assets, in which case this policy continues to apply to it.

7. Slack and other integrations

An organization's administrator can connect other services to Levelset. This section explains what we receive from them, what we keep, and what disconnecting removes.

Slack

When an organization connects a Slack workspace, Levi, the assistant inside Levelset, works in that workspace.

What we receive from Slack

  • The workspace's name and id, and the access token Slack issues when the workspace approves Levi. We store the token encrypted.
  • For each workspace member: their Slack id, name, email address, and phone number as shown in their Slack profile, so an administrator can link them to the right person on the store roster
  • Messages people send to Levi in a direct message or by mentioning Levi in a channel, and Levi's replies
  • The members of the channels Levi is in, so Levi knows who can read its answer
  • Only for a channel an administrator turns on for Levi to learn from: that channel's messages from the last 90 days, then new messages as they are posted

Other messages in channels Levi has been added to are ignored when they arrive. We do not read or store them.

How we use it

  • To answer the person who asked, using only what that person may see in Levelset. Levi answers a Slack member only after an administrator links them to a Levelset login that is allowed to use the AI assistant.
  • Levi never shares pay in Slack, in a channel or in a direct message. Pay stays in Levelset for the people allowed to see it.
  • In a channel, Levi shares only what every member of the channel may see in Levelset. It never shares a specific person's discipline, ratings, or contact details in a channel. Levi does not answer in channels shared with another organization or that include guests.
  • To post the alerts your organization's automations send to the channels your administrator chose
  • In channels turned on for learning: to learn from a whole conversation, Levi holds a channel's messages, encrypted, until the conversation goes quiet, then keeps only short notes about how your store runs. The messages are deleted within 24 hours. When a message is edited or deleted in Slack, the notes that came from it are removed.
  • In a channel turned on for learning, when someone asks Levi a question there, Levi reads that channel's recent messages to answer it. They are not kept beyond the 24 hours above.

What we keep and for how long

  • The access token is kept until Slack is disconnected or Levi is removed from the workspace, and is then erased.
  • Notes learned from a channel are kept until that channel is turned off for learning or Slack is disconnected.
  • Messages from a channel turned on for learning are kept encrypted for at most 24 hours, then deleted.
  • Levi's Slack conversations, the links between Slack members and your roster, member link suggestions, and channel member lists are kept while your organization uses Levelset. To have them deleted sooner, email support@levelset.io.

Disconnecting Slack

An administrator can disconnect Slack at any time in Levelset under Organization Settings, then Integrations, or remove Levi from the workspace in Slack. Either way, the access token is erased, Levi stops learning from every channel, and the notes learned from those channels are removed. Disconnecting in Levelset also revokes Levi's access at Slack.

Connecteam

When an organization connects Connecteam, we store the Connecteam API key encrypted and use it to import the forms and form submissions your organization chooses and to send the messages your automations are set up to send. Removing the connection deletes the stored key. Forms and submissions already imported stay in Levelset as your organization's records.

8. Retention and deletion

We keep information for as long as the organization's account is active, because the record over time is the product. When an organization ends its subscription, we delete or anonymize its data on request; otherwise we retain it for a reasonable period in case the organization returns, and then delete it. Backups age out on a rolling basis. Team member records are retained or deleted according to the employer's instructions and applicable employment record-keeping laws.

9. Security

Data is encrypted in transit and at rest. Access inside Levelset is controlled by roles and permissions your organization configures. On mobile, sign-in credentials are stored in the device keychain. No method of transmission or storage is completely secure, and we cannot guarantee absolute security.

10. Your rights and choices

  • Access, correct, or delete the personal information we hold about you
  • Opt out of marketing email at any time; transactional email is part of the service
  • Disable push notifications in your device settings
  • Manage cookies in your browser settings

To exercise these rights, email support@levelset.io from the address on your account. If you are a team member of a Levelset customer, we may refer your request to your employer, since they control those records. Texas residents and residents of other states with privacy laws may have additional rights under those laws; we honor them as they apply.

11. Account deletion

To delete your Levelset account, email support@levelset.io from the account's email address, or ask your organization's administrator to remove you. We confirm deletion when it is complete.

12. Children

Levelset is workplace software and is not directed at children. We do not knowingly collect personal information from children under 13. Workforce records managed by an employer may describe employees who are minors under local employment law; those records are controlled by the employer.

13. Changes to this policy

We may update this policy from time to time. We will post changes on this page and update the date above; for material changes we will notify account owners by email.

14. Contact us

Questions about privacy: support@levelset.io.