Privacy policy
Effective September 27, 2026
This explains what Levelfile collects when you visit levelfile.com or buy a Levelfile product (The Levelfile Kit, Levelfile Complete, the Holiday and Summer Schedule Planner or the Levelfile Complete upgrade), why we collect it, who else sees it, and what you can tell us to do about it.
We are based in Austria, so European data protection law applies to everything below, wherever in the world you live. If you are in the United States there is a section further down that adds rights your state gives you.
Who is responsible
Emanuel Chereji, sole trader (Einzelunternehmen), Hofmannsthalweg 20/1/4, 4030 Linz, Austria. Levelfile is a trading name of that business, and that business is the controller of the personal data described here.
Email: support@levelfile.com. Full business details are in our Legal Notice.
We have no data protection officer, because the law does not require a business of this size to appoint one. Write to the address above and it reaches the person who decides.
The short version
To sell you a file we need an email address and a payment. To find out whether our advertising is worth paying for, we measure which pages people read and we tell Meta when a purchase happens. We do not sell your data for money. Every tool that touches it is named below, by name, not as "third parties".
What we collect
When you buy. Your name, email address, billing address, and what you ordered. Card details go straight to the payment processor. We never see them and we could not store them if we wanted to.
On your order. When you check out, we store on your order which ad or link brought you to us (the campaign and ad identifiers and the time since that click) and the anonymous analytics identifiers of your visit, so we can tell which advertising works. We do not use them to identify you as a person.
When you visit. Which pages you opened and when you left them, how far down you scrolled, which buttons and questions you clicked, your device and browser, screen size, language, and how fast the page loaded. Your IP address, from which an approximate country and city is worked out. If you arrived from an advertisement or an email, the campaign tags in the link.
When you email us. Whatever you write, and your address, so we can answer.
We do not record your screen. No session replay, no video of your cursor, no capture of what you type into a field before you submit it.
Why we collect it, and what allows us to
| What we do | Why we are allowed to |
|---|---|
| Take your order, deliver the download, honour the guarantee | Performing our contract with you (Art 6(1)(b) GDPR) |
| Answer your emails | Performing our contract, or our legitimate interest in running a business people can reach (Art 6(1)(b) and (f)) |
| Keep invoices and accounting records | A legal obligation on us under Austrian tax law (Art 6(1)(c)) |
| Measure how the page performs, so we can improve it | Your consent where we ask for it (the EEA, the UK and Switzerland; Art 6(1)(a)); elsewhere our legitimate interest in knowing whether the page and our advertising work, which you can object to at any time (Art 6(1)(f)) |
| Measure and target advertising | Your consent where we ask for it (the EEA, the UK and Switzerland; Art 6(1)(a)); elsewhere our legitimate interest in knowing whether the page and our advertising work, which you can object to at any time (Art 6(1)(f)) |
| Send you marketing email | Your consent (Art 6(1)(a)), which you can take back at any time |
Where we rely on legitimate interest, the interest is a plain commercial one: knowing whether the page and the advertising work, so that money is not spent on things that do not. We weighed that against your side of it, which is why session replay is switched off and why we do not build a profile of you as a named person.
Who processes data for us
- Shopify International Limited, Ireland, runs the store, the checkout and the order records.
- Shopify Payments, executed by Stripe Technology Europe Limited, Ireland, takes the payment.
- PostHog provides the page analytics described above. It receives your IP address and works out an approximate location from it.
- Shopify Email sends order emails and, if you asked for them, marketing emails.
- Meta Platforms Ireland Limited handles advertising. Meta is a special case and has its own section below.
- hCaptcha (Intuition Machines, Inc., USA) checks that a form on this site is sent by a person; it sees your IP address and browser details when you use a form.
- Microsoft Ireland Operations Limited hosts the mailbox that receives your support email.
These providers act on our instructions and may not use your data for their own purposes, except where a section below says otherwise.
Advertising, and the part where Meta and we are jointly responsible
A Meta pixel runs on our pages and reports page views, checkout steps and purchases. Our store separately sends the same purchase events to Meta from the server, including a scrambled (hashed) version of your email address, so Meta can match the sale to the advertisement you clicked.
For that collection and transmission, Meta Platforms Ireland Limited and we are joint controllers under Art 26 GDPR. This is the essence of the arrangement between us, which we are required to make available to you:
- We are responsible for having a legal basis for collecting the data and sending it to Meta, for telling you about it (which is what this section does), and for making this summary available.
- Meta is responsible for its own security, for keeping records of the processing, and for handling your requests about the data once it has arrived.
- Once the data has reached Meta, what Meta does with it afterwards is Meta's own responsibility, not ours, and not covered by the joint arrangement.
- You can exercise your rights against either of us. Whichever one you contact, the request is valid.
Meta's own description of its side is at facebook.com/legal/controller_addendum. What Meta lets you change about the advertising you see is in your Facebook or Instagram settings, under Ads.
Under several US state privacy laws, sending these events to Meta counts as sharing personal information for cross context behavioural advertising. We say so plainly here rather than leave you to work it out. It is not a sale. No money moves in either direction for your data.
Data leaving Europe
Some of the providers above are in, or send data to, the United States.
Where a provider is certified under the EU to US Data Privacy Framework, the transfer relies on the European Commission's adequacy decision for that framework. Where it is not, the transfer relies on the European Commission's Standard Contractual Clauses, together with the extra technical and organisational measures the provider has in place.
Shopify is not certified under the Data Privacy Framework. Transfers to Shopify rely on Standard Contractual Clauses.
You are entitled to a copy of the safeguards we rely on. Email support@levelfile.com and we will send them to you.
How long we keep things
| What | How long | Why |
|---|---|---|
| Orders, invoices, accounting records | 7 years from the end of the year they relate to | Austrian tax law requires it (§ 132 BAO) |
| Analytics events | Up to 84 months, and never joined to your name | The tool's retention setting |
| Marketing subscription | Until you unsubscribe, plus a suppression record afterwards | So that unsubscribing actually works and we do not email you again by mistake |
| Support email | As long as the thread is useful, then deleted | Nothing requires us to keep it |
Your rights
You can ask us for a copy of your data, to correct it, to delete it, to restrict what we do with it, to object to anything we do on the basis of legitimate interest, and to receive your data in a portable form. Where we rely on your consent, you can withdraw it at any time, and doing so does not make anything we did before that unlawful.
Email support@levelfile.com. We answer within one month. There is no charge.
If you think we have got this wrong, you can complain to the Austrian data protection authority: Österreichische Datenschutzbehörde, Barichgasse 40-42, 1030 Vienna, Austria, dsb@dsb.gv.at. You can also complain to the authority where you live.
Cookies and similar technologies
Strictly necessary cookies keep your cart and your session working. They run without consent because the site cannot function without them.
If you visit from the European Economic Area, the United Kingdom or Switzerland, or from somewhere we cannot tell, analytics and advertising run only if you accept them in the banner. Rejecting is exactly as easy as accepting, on the same screen, in one click. You can change your mind at any time through the cookie settings link in the footer, and withdrawing is as easy as giving it was.
Everywhere else, including the United States, they run from your first page, and you can switch them off at any time: the cookie settings link in the footer turns them off, "Your privacy choices" opts you out of sharing for advertising, and we honour Global Privacy Control signals from your browser.
Marketing email
We only send marketing email to people who asked for it. The order confirmation, which carries your download links, is not marketing and will reach you either way, because it is part of delivering what you bought.
Every marketing email carries an unsubscribe link. Unsubscribing takes effect straight away, and in any event within 10 business days.
If you are in the United States
These rights come from state law and apply on top of everything above.
We share personal information for targeted advertising. That is the Meta pixel and the server side purchase events described earlier. We do not sell personal information for money, and we do not process it to make automated decisions that have legal effects on you.
You can opt out of targeted advertising, of any sale, and of profiling, by emailing support@levelfile.com with the words "opt out" in the subject line. We operate entirely online and have a direct relationship with our customers, so an email address is the route the law provides. We also honour Global Privacy Control browser signals where they reach us.
You can also ask for a copy of the data we hold about you, ask us to correct it, and ask us to delete it. We will answer within 45 days. If we say no, you can appeal by replying to that answer, and we will respond to the appeal within 60 days.
Exercising any of these rights costs nothing and we will not treat you differently for it.
Residents of Texas, Washington, Connecticut, Nebraska, Montana, Oregon, Colorado, Virginia, Utah, and every other state with a comprehensive privacy law have the rights set out above.
If you are in Washington State. Some of what the kit covers may be treated as consumer health data under the My Health My Data Act, including where that status is inferred from which pages you looked at rather than from anything you told us. We collect that data only to sell you the kit and to measure the advertising that brought you here. We do not sell it. You may ask us to delete it, and we will delete it from our own systems and instruct our providers to do the same, by emailing support@levelfile.com. The categories of third party who receive it are named in the "Who processes data for us" section above.
Children
Levelfile is sold to adults. We do not knowingly collect data from anyone under 16, and we have no reason to. If you believe a child has given us data, email support@levelfile.com and we will delete it.
Changes to this policy
If we change it, the new version appears here with a new effective date. Changes apply going forward. They do not change what we already agreed with you about a purchase you have already made.
Levelfile is a trading name of Emanuel Chereji, Hofmannsthalweg 20/1/4, 4030 Linz, Austria. Full business details are in our Legal Notice.