Privacy Policy
What we collect, why we collect it, who we share it with, and your rights.
The short version
- Who can read what you typeNo one at lePanel reads your panels. We see only what you send us in feedback or support (including any screenshot you attach), or what the law requires.
- The services that write and score your answersThe services that write and score your answers run under zero data retention: they don’t keep your content after they reply, except where the law or abuse prevention requires it.
- SellingWe do not sell your data, and we don’t use it for advertising.
- Where it’s storedAustralia (Sydney). Other processing happens mainly in the United States and the EU; payment and network providers operate globally (see section 4).
- Deleting itExport or delete your data any time in Settings. Your account and content are deleted after a 30-day grace period; billing and tax records we must keep stay for the period the law requires (see section 6).
- Who we areLEPANEL LIMITED, 38 Milson Drive, Auckland, 2110, New Zealand · privacy@lepanel.app
We do not use your data to train AI models. The providers that process it do so under terms that exclude training.
See the subprocessor list and what our providers receive below for exactly what we send to whom, and each provider’s retention terms.
1. Who we are
lePanel is operated by LEPANEL LIMITED under the laws of New Zealand.
Our postal address is 38 Milson Drive, Auckland, 2110, New Zealand.
For privacy questions, email privacy@lepanel.app.
2. What we collect
We collect only what the service needs to run, and what you choose to give us. Here is the full list.
- Account details: your email address, and a display name if you choose to set one. If you sign in with Google or Microsoft, we receive your email address and name from them.
- Sign-in and waitlist requests: the email address you enter to get a sign-in code or join the waitlist. We record it when you submit it, even before you have an account, so we can see who asked for access.
- Abuse-protection counters: short-lived counters, keyed to your IP address, that limit how often a request can be repeated. Counters for sign-in codes are also keyed to your email address.
- Workspace content:
- the panels you compose;
- the questions you ask, including the problem you describe during onboarding to build your panel;
- the advisors’ responses;
- follow-up questions you put to a single advisor, and its replies;
- debate turns, from rounds where you have the advisors respond to each other after the panel has answered;
- signal events.
- Profile details you choose to add: your country, birth year, and how you heard about us. All three are optional. You can add them on the card shown after onboarding, or in Settings → Profile. We use them to tailor advice and to understand our audience. Our basis is legitimate interest, over data you volunteer. You can edit or erase them at any time.
- Marketing consent: whether you have opted in to occasional product-update emails, with a timestamp. We record it on a consent basis. You can withdraw it at any time in Settings → Profile.
- Attribution cookie: a first-party attribution cookie (
panel_attr) records the external site that referred you, any campaign (UTM) tags, and the page you landed on. We set it only with your analytics consent. The cookie lasts about 90 days. If you create a panel, the captured values are also stored with your account profile. They are removed when you delete your account (see section 6). We use them to understand how people find us, and we never share them. - Billing details: billing metadata, through our payment provider, and the country we work out from your IP address at checkout, for tax. We never see your card number.
- Country waitlist: your email address and your country. If we can’t yet accept a subscription from your country, we refund it. We then add you to this waitlist. If you are signed in, you can also join it from the pricing page. You can leave it at any time, through the link in our email or on the pricing page.
- Operational telemetry: HTTP request timings and error stack traces. These hold no request bodies, and personal information is stripped out.
- Consent records: the versions of the Terms and this Privacy Policy you accepted, with a timestamp. On a best-effort basis, we also record your IP address, the coarse country and region it points to, and a device string. We keep these to show that you consented; the country and region are also used as evidence of your location for tax.
3. Why we collect it
We use your data to run the service. That includes running rounds, saving your sessions, and billing subscriptions.
We also use it to find and fix bugs, and to improve the product.
We use the country waitlist only to email you once, when we open in your country.
We do not sell data.
We do not use your content to train models.
Scores and automated feedback
Grill scores, question scores and how much the advisors agree are produced automatically, on a scale of 0 to 100, to help you practice and think.
They are feedback for you only. They don’t decide anything about you, and no one else sees them unless you share a scorecard.
4. Subprocessors
We share data only with the companies we need to run the service, listed below. Each one receives only what its job requires.
| Company | What it does | Where it processes data |
|---|---|---|
| Supabase | Database, authentication, and background jobs | Australia (Sydney), where your workspace data is stored |
| Anthropic | Writes the panel’s responses and scores practice answers | United States |
| OpenRouter | Writes the panel’s responses where enabled (see section 5) | United States |
| Voyage | Embeddings, so the panel can search your material | United States |
| Airwallex | Billing and payments | Global |
| Resend | Email delivery | United States |
| Sentry | Error reporting | EU (Germany) |
| Vercel | Hosts the app and runs its server code | Australia (Sydney), where your requests are processed |
| Cloudflare | Delivers static files (images, fonts, and scripts) | Global edge network, serving from the location nearest you |
5. What our providers receive
Every offshore processor handles your content solely to provide its service to us, under data-processing terms. It does not use your content for advertising, resale, or training its own models.
AI providers
Your questions are sent to the AI provider that writes the panel’s responses. So is any material you add for interview practice: the role, the scenario, and any notes or documents you provide. Your practice answers are also sent to the provider that scores them.
Those providers are Anthropic and, where enabled, OpenRouter.
OpenRouter routes each request to one of a small set of United States serving providers that we pin in advance. Routing cannot leave that allowlist. On every response, we verify which provider served it.
All processing by these providers is on a no-training basis.
Zero data retention. The services that write and score your answers run under zero data retention: they don’t keep your content after they reply, except where the law or abuse prevention requires it.
These providers state that their services are hosted in the United States. The specific physical region that processes a given request is not contractually guaranteed on the routed path.
Who at lePanel can see your content
No one at lePanel reads your panels, questions or files as a matter of practice.
We see only what you send us in feedback or support (including any screenshot you attach to a problem report), or what the law requires.
Search across your material
Voyage embeds the questions you ask, your practice answers, and the material you add, so the panel can retrieve them.
Voyage receives only the text. No account details are attached.
Training permission on our Voyage account has been switched off since 3 July 2026.
No customer content was submitted under Voyage’s earlier default terms. The only data sent before that date was our own pre-launch test content. (Note added 15 August 2026.)
Your display name
If you set a display name in Settings → Profile, it is sent with your questions and your practice answers. That way the panel knows what to call you.
Bot and abuse protection
Our sign-up, sign-in, and waitlist forms use Cloudflare Turnstile to tell real people apart from automated abuse.
When you use those forms, it processes limited device and interaction signals, including your IP address, for that purpose only.
Those signals are not used for advertising, and they are not sold.
See Cloudflare’s Turnstile Privacy Policy.
6. How long we keep it
Most of what you create stays until you remove it. Where the law or a payment record makes us keep something longer, it is named here.
| Data | How long we keep it |
|---|---|
| Workspace data | Kept until you delete it. |
| Profile details you add | Kept until you delete your account, or clear the fields in Settings → Profile. |
| Marketing consent | Kept on a consent basis until you withdraw it. |
| Account deletion | You can delete your account in Settings → Privacy. This schedules a permanent deletion 30 days later. You can cancel it within those 30 days. |
| Audit log rows | Kept after your workspace is deleted, for compliance forensics. The link to the deleted workspace is cleared. |
| Billing records (payment provider) | Invoices and payment records stay at our payment provider after account deletion, for tax and accounting compliance. The customer record itself is anonymized (every field we collected is cleared), or deleted where the provider supports it. The cardholder name on a saved card cannot be removed there. Nor can the name and email the provider recorded on each payment attempt. Both stay with the payment record. |
| Consent records | Kept as an anonymized record of what you accepted (versions and timestamps). Your IP address and browser details are removed when your account is erased. |
| Feedback screenshots | Deleted after your account is erased. Abandoned uploads are cleared within about 24 hours. |
| Account-deletion log | Kept as a pseudonymous record (a job number and timestamps), as proof the erasure ran. The reason you gave is removed at erasure. The payment-provider reference is removed once the provider’s side of the erasure completes. |
| Sign-in and waitlist requests | Kept until you delete your account. If you have no account, it is kept until you ask privacy@lepanel.app to remove it. When an account is erased, the address is removed. We keep only a one-way hash of it, so it is not added back to the waitlist if someone types it in again. |
| Country waitlist | Deleted 30 days after we email you that we are open in your country. It is also deleted when your account is deleted. In any case, it is deleted 24 months after you joined. Leaving the waitlist stops that email. If we sent you that email, we keep only a one-way hash of your email address and country once the entry is deleted. We keep that hash even after your account is deleted, only so we never send you that email twice. |
| Abuse-protection counters | Deleted by a daily sweep once they are two days old. Counters keyed to your email address are deleted when your account is erased. |
7. Your rights
You can see, take, correct, or delete your data at any time. You can do most of it yourself, without asking us.
- Export: download a machine-readable export of your workspace data in Settings → Privacy. It has one JSON record per line, and a manifest listing exactly what it contains.
- Delete: schedule account deletion in Settings → Privacy. You have a 30-day grace period to change your mind.
- Rectification: edit your profile (country, birth year, and how you heard about us) at any time in Settings → Profile.
- Marketing communications: withdraw consent to product-update emails at any time in Settings → Profile. You don’t need to email us.
- Object: email privacy@lepanel.app to opt out of analytics.
- Two-step sign-in: turn on an authenticator app (TOTP) in Settings → Sign-in and security.
How to complain
If you’re unhappy with how we’ve handled your information, tell us first at privacy@lepanel.app. You can also complain to a regulator:
- New Zealand: the Office of the Privacy Commissioner (privacy.org.nz)
- Australia: the Office of the Australian Information Commissioner (oaic.gov.au)
- United Kingdom: the Information Commissioner’s Office (ico.org.uk)
- European Union: the data protection authority where you live
8. Cookies & analytics
Essential cookies
By default, we set only strictly necessary cookies. These are the cookies the service needs to run.
They hold your sign-in session, a CSRF security token, and your theme preference.
We also set a session cookie (panel_code) that keeps a discount code you entered while you sign up.
We set one more cookie (panel_ref, about 30 days) only if you followed a referral link while our referral program is running. It lets us credit whoever referred you once you sign up and pay.
These cookies need no consent. We never use them to track you across sites.
Optional analytics
With your consent, we turn on two optional, privacy-light extras.
- Client-side error reporting (Sentry), which helps us fix bugs faster.
- A first-party attribution cookie (
panel_attr, about 90 days) that remembers how you found us (see section 2).
Both are off until you opt in. We ask with a cookie banner, and we turn them on only if you choose “Accept all.”
We store your choice in a single first-party preference cookie (panel_cookie_consent, about 1 year), so we don’t ask again.
If your browser sends a Global Privacy Control signal, we default to essential cookies only.
You can change your mind at any time with on any legal page.
Server-side error monitoring
We monitor errors raised by our own servers. This runs on a legitimate-interest basis, for security and reliability.
It sets no cookies and uses no client-side tracker.
We strip personal data before any report leaves our systems. Reports carry no request bodies. Cookies, authentication headers, and sensitive URL parameters are redacted.
9. Children
The service is for users aged 16 and over.
We do not knowingly collect data from anyone under 16.
When you accept these policies, you confirm you are at least 16.
10. Changes to this policy
We announce material changes to this policy on our What’s new page, with at least 14 days’ notice.
For material changes, we may ask you to accept the updated policy again.