Privacy Policy

This Privacy Policy explains how LesterTechLabs LTD (“LesterTechLabs”, “we”, “us”, or “our”) collects, uses, discloses, stores, and protects personal information when you visit our websites, use our products and platforms, interact with our APIs, or engage our professional services.

We are committed to protecting your privacy and handling personal data responsibly. This policy applies to personal information processed through our websites, SaaS products (including Lester PaaS, PassTIA, MediSawa, and AI Document Analyzer), developer platform, API marketplace, documentation portals, support channels, and sales or marketing activities.

By using our Services, you acknowledge that you have read and understood this Privacy Policy. Where required by law, we will obtain your consent before processing personal information for specific purposes. This policy should be read together with our Terms of Service and Cookie Policy.

Table of Contents

1. Scope and Roles
2. Definitions
3. Information We Collect
4. How We Collect Information
5. How We Use Information
6. Legal Bases for Processing
7. AI and Automated Processing
8. Cookies and Similar Technologies
9. How We Share Information
10. International Data Transfers
11. Data Retention
12. Security Measures
13. Your Privacy Rights
14. Data protection
15. Children’s Privacy
16. Customer Data and Business Users
17. Third-Party Links and Services
18. Marketing Communications
19. Changes to This Policy
20. Contact Us and Data Protection Officer

1. Scope and Roles

LesterTechLabs acts in different roles depending on how you interact with us:

• Data Controller — when we determine the purposes and means of processing personal information, such as for website visitors, account holders, newsletter subscribers, sales prospects, job applicants (if applicable), and direct customers of our products.
• Data Processor — when we process personal information on behalf of business customers who use our platforms to store, analyze, or transmit data belonging to their users, patients, students, or employees. In those cases, our customer’s privacy policy and data processing agreement govern the relationship with end users.

This Privacy Policy primarily describes our practices as a data controller. If you interact with LesterTechLabs through a customer’s deployment (for example, a hospital using MediSawa or a school using PassTIA), please refer to that organization’s privacy notice for how your data is handled. We process such data only according to our customer’s instructions and applicable agreements.

2. Definitions

• “Personal information” (or “personal data”) means information that identifies, relates to, describes, or could reasonably be linked with an individual, directly or indirectly.
• “Processing” means any operation performed on personal information, including collection, storage, use, disclosure, deletion, or analysis.
• “Services” means our websites, applications, APIs, cloud platforms, documentation, and related offerings described in our Terms of Service.
• “Customer Data” means personal information and other data submitted to our Services by or on behalf of a business customer.
• “Sensitive personal data” includes health information, biometric data, financial account details where specially protected, and other categories defined under applicable law.

3. Information We Collect

3.1 Information You Provide Directly

We may collect personal information that you voluntarily provide, including:

• Account and profile information — name, email address, phone number, company name, job title, username, password (stored in hashed form), profile photo, and preferences.
• Contact and inquiry information — details submitted through contact forms, support tickets, demo requests, sales inquiries, and live chat.
• Billing and transaction information — billing address, tax identifiers, payment method details (processed by payment providers; we do not store full card numbers), M-Pesa or mobile money reference numbers, and invoice history.
• Developer and API information — organization details, API key metadata, application descriptions, and integration configurations.
• Content and uploads — documents, files, prompts, messages, and other content you submit to AI or document analysis features, subject to your plan and product settings.
• Communications — records of email correspondence, support conversations, feedback, survey responses, and event registrations.
• Professional services information — project requirements, technical specifications, and materials shared during consulting or implementation engagements.

3.2 Information Collected Automatically

When you use our Services, we may automatically collect:

• Device and browser information — browser type and version, operating system, device identifiers, language settings, screen resolution, and (for first-party analytics) a hashed or truncated IP address rather than a full IP in staff dashboards.
• Usage and log data — pages viewed, features used, clickstream data, session duration, referral URLs, search queries within documentation, API call logs, error reports, and performance metrics. On our marketing site, consented first-party analytics may also record CTA/link clicks and scroll depth milestones.
• Location information — approximate country/city derived from IP address for analytics. We do not collect precise GPS location unless you explicitly grant permission through a mobile application.
• Security and fraud data — authentication events, failed login attempts, anomaly indicators, and device fingerprints used to protect Accounts.

3.3 Information from Third Parties

We may receive personal information from:

• authentication providers (such as Google or GitHub) when you sign in using single sign-on;
• payment processors and financial institutions confirming transaction status;
• cloud infrastructure and analytics providers;
• marketing partners, event organizers, or referral sources where permitted by law;
• publicly available professional profiles and business databases for B2B sales and verification; and
• your employer or organization administrator when they provision your Account.

3.4 Sensitive and Special Category Data

Some products may process sensitive data depending on how customers configure and use them. For example, MediSawa may process health-related information submitted by healthcare providers, and PassTIA may process educational records. We process sensitive data only where:

• you or our business customer has a lawful basis and appropriate safeguards in place;
• processing is necessary to provide the requested Service; and
• additional contractual or regulatory requirements are met, including data processing agreements where required.

We do not intentionally collect sensitive personal data through general marketing websites unless you voluntarily provide it (for example, in a support message).

4. How We Collect Information

We collect personal information through:

• website forms, account registration, and checkout flows;
• product dashboards, APIs, mobile apps, and CLI tools;
• cookies, pixels, and similar technologies (see our Cookie Policy);
• server logs and monitoring systems;
• email, chat, phone, and video communications;
• in-person or virtual meetings, conferences, and training sessions; and
• integrations you authorize between our Services and third-party platforms.

5. How We Use Information

We use personal information for the following purposes:

• Providing Services — creating and managing Accounts, authenticating users, delivering product functionality, processing API requests, hosting applications on Lester PaaS, and fulfilling contractual obligations.
• Customer support — responding to inquiries, troubleshooting issues, providing technical assistance, and improving support quality.
• Billing and administration — processing payments, sending invoices, managing subscriptions, detecting billing fraud, and maintaining financial records.
• Security and integrity — detecting, preventing, and responding to abuse, unauthorized access, malware, DDoS attacks, and other security threats.
• Product improvement — analyzing usage trends, conducting research, developing new features, fixing bugs, and optimizing performance.
• AI model operations — processing prompts and documents to generate outputs, subject to the controls described in Section 7.
• Personalization — tailoring dashboards, documentation recommendations, and in-product experiences based on your role, plan, or usage patterns.
• Marketing and communications — sending product updates, newsletters, event invitations, and promotional content where permitted (you may opt out at any time).
• Legal and compliance — complying with laws, responding to lawful requests from authorities, enforcing our Terms, and protecting our legal rights.
• Business operations — internal auditing, reporting, accounting, mergers, acquisitions, or corporate restructuring, subject to appropriate confidentiality safeguards.

We do not sell personal information to third parties. We do not use Customer Data from enterprise deployments to train general-purpose AI models for unrelated third-party products unless explicitly agreed in writing or enabled through opt-in product settings.

6. Legal Bases for Processing

Depending on your location and the context of processing, we rely on one or more of the following legal bases:

• Contractual necessity — processing required to provide Services you request or to perform our agreement with you.
• Legitimate interests — processing for security, fraud prevention, product improvement, B2B marketing, and internal analytics, balanced against your rights and expectations.
• Consent — where required for marketing emails, non-essential cookies, certain AI features, or other processing for which we request explicit consent.
• Legal obligation — processing necessary to comply with applicable laws, regulations, court orders, or tax requirements.
• Vital interests or public interest — in rare cases involving safety or public health, where permitted by law.

You may withdraw consent at any time where processing is consent-based, without affecting the lawfulness of processing before withdrawal.

7. AI and Automated Processing

Our AI-powered Services (including document analysis, chat assistants, and RAG-based tools) process inputs you provide to generate outputs. Important points:

• Input and output — prompts, documents, and generated responses may be temporarily stored to deliver the feature, maintain conversation context, and improve reliability.
• Human review — support staff may review flagged content or conversations when necessary to resolve errors, abuse reports, or support tickets.
• Training use — unless you opt in or your plan/contract specifies otherwise, we do not use your confidential Customer Data to train shared foundation models. Aggregated, anonymized telemetry may be used to improve system performance.
• Automated decisions — we do not make solely automated decisions producing legal or similarly significant effects about individuals without appropriate safeguards, human oversight where required, and transparency about the logic involved.
• Accuracy — AI outputs may be inaccurate or incomplete. You are responsible for reviewing outputs before relying on them, especially in regulated contexts such as healthcare, finance, or legal workflows.

8. Cookies and Similar Technologies

We use cookies, local storage, pixels, and similar technologies to operate our websites, remember preferences, analyze traffic, and support marketing campaigns. Categories include:

• Strictly necessary cookies — required for authentication, security, load balancing, and core site functionality.
• Functional cookies — remember language, theme (light/dark mode), and dashboard preferences.
• Analytics cookies — help us understand how visitors use our sites and products. Our marketing site uses first-party analytics (page views, clicks/CTAs, scroll depth, referrer, device type, and approximate country/city from IP). We store a hashed or truncated IP for security and geo aggregation; staff dashboards do not display full IP addresses. Analytics collection starts only after you Accept via the cookie banner. You can choose Essential only to decline analytics.
• Marketing cookies — measure campaign effectiveness and deliver relevant content, where permitted.

For detailed information about specific cookies, retention periods, and how to manage preferences, see our Cookie Policy. You can also configure your browser to block or delete cookies, though some features may not function properly.

9. How We Share Information

We may share personal information with the following categories of recipients, subject to appropriate safeguards:

• Service providers and subprocessors — cloud hosting (e.g., AWS), payment processors, email delivery, analytics, customer support tools, identity providers, and security vendors who process data on our behalf under contractual data protection obligations.
• Business customers — where you use our Services through an organization, your administrator may access Account and usage information according to their policies.
• Professional advisors — lawyers, accountants, auditors, and insurers under confidentiality duties.
• Affiliates — LesterTechLabs group companies for internal operations, subject to this policy.
• Partners and integrations — third-party services you choose to connect, governed by their privacy policies.
• Legal and safety disclosures — when required by law, subpoena, or government request, or to protect rights, safety, and security of LesterTechLabs, our users, or the public.
• Business transfers — in connection with a merger, acquisition, financing, or sale of assets, with notice where required by law.

We require processors to handle personal information only for specified purposes and to implement appropriate security measures. A list of key subprocessors is available upon request for enterprise customers.

10. International Data Transfers

LesterTechLabs is fully remote. We and our service providers may process personal information in more than one country, including countries whose data protection laws differ from the laws where you live.

When we transfer personal information internationally, we implement appropriate safeguards such as:

• standard contractual clauses or equivalent agreements with recipients;
• transfer impact assessments where required;
• technical measures including encryption in transit and at rest; and
• the cross-border transfer rules that apply to you and to the work.

By using our Services, you acknowledge that your information may be transferred to and processed in countries other than your country of residence.

11. Data Retention

We retain personal information only for as long as necessary to fulfill the purposes described in this policy, unless a longer retention period is required or permitted by law. Retention periods depend on:

• the nature of the data and the Service used;
• your Account status and subscription term;
• legal, tax, and accounting obligations;
• security, fraud prevention, and dispute resolution needs; and
• backup and disaster recovery schedules.

Typical retention practices include:

• Account data — retained while your Account is active and for a reasonable period after closure to allow export and resolve disputes.
• Billing records — retained as required by tax and commercial law (often seven years or as mandated locally).
• Support tickets — retained for service quality and legal purposes, then deleted or anonymized.
• Server logs — generally retained for a limited rolling period unless needed for security investigations.
• Marketing contacts — retained until you unsubscribe or request deletion, subject to suppression list requirements.

When data is no longer needed, we delete, anonymize, or aggregate it in accordance with our data retention schedule.

12. Security Measures

We implement technical and organizational measures designed to protect personal information against unauthorized access, alteration, disclosure, loss, or destruction. These measures include, as appropriate:

• encryption of data in transit (TLS) and at rest for sensitive systems;
• role-based access controls and multi-factor authentication for internal systems;
• network segmentation, firewalls, and intrusion detection;
• regular security assessments, vulnerability management, and patching;
• secure software development practices and code review;
• employee security training and background checks where appropriate;
• incident response procedures and breach notification processes; and
• physical and environmental security at facilities hosting our infrastructure.

No method of transmission or storage is completely secure. While we strive to protect your information, we cannot guarantee absolute security. You are responsible for safeguarding your credentials and notifying us promptly of any suspected compromise.

If we become aware of a personal data breach likely to result in risk to your rights, we will notify affected individuals and relevant authorities as required by applicable law.

13. Your Privacy Rights

Depending on your location and applicable law, you may have the following rights regarding your personal information:

• Right of access — request confirmation of whether we process your personal information and obtain a copy.
• Right to rectification — request correction of inaccurate or incomplete information.
• Right to erasure — request deletion of personal information, subject to legal exceptions.
• Right to restriction — request limitation of processing in certain circumstances.
• Right to data portability — receive personal information you provided in a structured, commonly used, machine-readable format where technically feasible.
• Right to object — object to processing based on legitimate interests or for direct marketing.
• Right to withdraw consent — where processing is based on consent.
• Right not to be subject to automated decision-making — where applicable law provides this right.

To exercise your rights, contact us at privacy@lestertechlabs.com. We may need to verify your identity before fulfilling a request. We will respond within the timeframe required by applicable law (typically within thirty days). You may also have the right to lodge a complaint with a supervisory authority as described in Section 14.

If your data is controlled by a business customer using our platform, please contact that organization first. We will assist our customers in responding to valid requests as required by our agreements and applicable law.

14. Data protection

LesterTechLabs follows the data protection law that applies to the person and to the work. That can include the law where you live and the law named in a statement of work.

Where that law gives you rights of access, correction, deletion, objection, or withdrawal of consent, use the contact details below. We act as a controller or a processor as the engagement requires, and we keep technical and organizational measures in place to protect personal data.

You may also complain to the data protection authority that covers you. Write to us first at privacy@lestertechlabs.com so we can address the concern directly.

15. Children’s Privacy

Our general websites and business Services are not directed to children under 18 years of age (or the age of majority in your jurisdiction). We do not knowingly collect personal information from children without appropriate parental or guardian consent.

Educational products such as PassTIA may be used by institutions that serve minors. In those cases, the school or educational institution is responsible for obtaining necessary consents and configuring the platform in compliance with applicable child privacy laws. If you believe we have collected personal information from a child without proper authorization, contact us and we will take appropriate steps to delete it.

16. Customer Data and Business Users

When organizations use LesterTechLabs as a processor:

• the customer determines what personal information is collected from end users and the purposes of processing;
• we process Customer Data only according to documented instructions, our Terms, and any applicable data processing agreement (DPA);
• we assist customers with security obligations, breach notifications, and data subject requests as specified in the DPA;
• customers may configure retention, export, and deletion settings within product admin consoles where available; and
• upon termination, Customer Data is deleted or returned according to the DPA and product documentation, subject to legal retention requirements.

Enterprise customers may request a DPA, subprocessor list, and security documentation by contacting privacy@lestertechlabs.com.

17. Third-Party Links and Services

Our websites and products may contain links to third-party websites, plugins, or services. We are not responsible for the privacy practices of third parties. We encourage you to review the privacy policies of any third-party services you access. Integrations you enable (such as cloud storage, identity providers, or payment gateways) may exchange data according to your authorization and their terms.

18. Marketing Communications

With your consent or where permitted by law, we may send you emails about products, events, research, and company news. You can unsubscribe at any time by:

• clicking the “unsubscribe” link in marketing emails;
• updating communication preferences in your Account settings; or
• emailing privacy@lestertechlabs.com.

Even if you opt out of marketing, we may still send transactional or service-related messages (such as billing notices, security alerts, and product-critical updates).

19. Changes to This Policy

We may update this Privacy Policy from time to time to reflect changes in our practices, Services, or legal requirements. When we make material changes, we will:

• post the updated policy on this page with a revised “Last updated” date;
• provide additional notice (such as email or in-product notification) where required by law; and
• obtain consent where required for material changes affecting how we process personal information.

We encourage you to review this policy periodically. Continued use of the Services after changes become effective constitutes acknowledgment of the updated policy, except where further consent is required.

20. Contact Us and Data Protection Officer

For privacy-related questions, requests, or complaints, contact us:

• Data Protection / Privacy: privacy@lestertechlabs.com
• Security incidents: security@lestertechlabs.com
• General inquiries: hello@lestertechlabs.com
• Contact form: lestertechlabs.com/contact
• Company: LesterTechLabs LTD, fully remote

We aim to respond to privacy inquiries within thirty (30) days. For urgent security matters, please use the security contact address above.

Thank you for trusting LesterTechLabs with your information. We are committed to transparency, accountability, and continuous improvement of our privacy practices.