Privacy policy

01Who we are

LeoTrace Ltd is incorporated in England and Wales under company number 16743564, with its registered office at 124 City Road, London EC1V 2NX. We build software that secures code as it is written by AI coding agents.

Our products are LeoPrevent, LeoLearn, LeoIndex and LeoBench. This notice covers LeoPrevent and LeoLearn. LeoIndex and LeoBench are not covered, and where either processes personal data in future this notice is updated before it does. A free account gives access to LeoPrevent only, and LeoLearn is available under a separate arrangement.

For the purposes of UK data protection law, LeoTrace Ltd is the controller of the personal data described in this notice. Section 05 sets out the part where we act as a processor instead, and the part where we do not. You can reach us at [email protected].

02What this notice covers

It covers personal data relating to visitors to leotrace.io and its subdomains, people who contact us or request a pilot, named contacts at our customers, prospects, partners, suppliers and investors, users of our products, and candidates who apply to work with us.

It covers two kinds of product account, and the difference matters in places. On a company account, an organisation holds the licence, a named contact agrees our terms on its behalf, and the organisation decides which of its developers use the product. The organisation is the controller of its developers’ personal data and we are its processor. On a self serve account, an individual signs up directly and agrees our terms in their own name. There is no employer contract behind the account. Where this changes the answer, the section says so.

• Company account: the organisation is controller.
• Self serve account: the individual is controller.
• Free account: LeoPrevent only.

Section 05 covers the content LeoPrevent processes inside a development environment, including source code.

We never sell personal data, we do not collect special category data, and users under 18 are not permitted.

03Where we get personal data

From you, from your employer where you are a named contact, from your use of our products and website, and from public business sources when we research prospects.

04What we hold, and why

Site data. IP address, device and browser information, pages viewed, referring source and cookie identifiers, to operate and secure the site and understand how it is used.

Enquiry and pilot request data. Name, work email, telephone number, employer, job title and the content of your enquiry, to reply to you and assess whether our products suit your organisation.

Relationship data. Contact details of named individuals, correspondence, meeting notes, contract records and billing details for customers, suppliers and investors, to perform contracts, provide support and manage the relationship.

Product account data. Name, email, organisation where you give one, role, authentication identifiers and a record of actions taken in the product. What LeoPrevent records about a developer on a reviewed turn is set out in section 05.

Marketing data. Email address, subscription preferences and engagement with our emails and events. You can opt out at any time.

Candidate data. CV, application and interview records, right to work information and references.

Security data. Logs, alerts and records relating to suspected unauthorised access, attack or misuse of our systems.

04.1 Lawful basis. Where you sign up directly rather than under an employer’s contract, the lawful basis for running your account is the contract between you and us, formed when you accept our terms at signup. Product telemetry rests on our legitimate interest in understanding and improving the product, and you can object to it.

• Site data: legitimate interest, consent.
• Enquiries: legitimate interest, precontract.
• Relationships: contract, legal obligation.
• Accounts, company: contract with employer.
• Accounts, self serve: contract with you.
• Marketing: consent, legitimate interest.
• Candidates: precontract, legal obligation.
• Security: legitimate interest.

Where we rely on a legitimate interest, we have assessed that it does not override your rights, and you can object at any time. We do not sell personal data, we do not collect special category data, and our products are not directed at anyone under 18.

05Customer code and product data

05.1 Our role: processor for the review, controller for the telemetry. LeoPrevent runs inside a development workflow and reviews code as a coding agent writes it. For the content it takes from that environment, and the review it performs on it, we act as a processor and the account holder is the controller. On a company account that is the organisation. On a self serve account that is the individual who signed up.

We are the controller, not a processor, for the product telemetry described in section 06, even though some of it concerns a customer’s own people. We decide what is collected there and why, which is what makes us the controller of it.

Our customer data processing terms are being finalised with our lawyers. Until a customer has accepted them, this section states our position on customer code and product data, and it is the position we operate.

05.2 What LeoPrevent receives on every reviewed turn. The developer’s prompt, the changed lines, a stored full file, an imported or context file, the code before a fix and the version an attempted fix produced.

It also records the git name and email of the contributor, or a synthetic identity where the repository uses one, together with the seat email. This happens on every reviewed turn, not only where a flaw is found.

On a company account, the organisation is the controller of that contributor data and is responsible for telling its own developers that the product is in use. On a self serve account, the person who installs the plugin is the one who has that relationship with anyone else whose commits are reviewed.

05.3 The classes we store: code, generated text, metadata. Code is kept for 60 days by default. Any period from 0 to 90 days can be set for an account on request, and an account set to 0 never has code written at all. Deletion runs on a scheduled sweep against our live production systems.

Generated text is kept for 180 days. This covers both the finding text LeoPrevent itself produces, meaning why a finding was raised and the fix it suggests, and the reply your own coding agent gives in response. Either can quote or closely describe the code it refers to, which is why both carry a stated period rather than being kept open ended. Any period from 0 to 180 days can be set for an account on request, including switching the storage off entirely, at the cost of LeoPrevent’s detection improving less for that account over time.

Metadata carries no code and no generated text: identifiers and timestamps, the review outcome, the verdict, rule, severity, finding class and file location, repository, developer, agent and model identifiers, and cost figures. It is kept indefinitely because historical counts and audit records depend on it. The contributor identity described in section 05.2 sits in this class.

Retention at a glance:

• Code, default: 60 days.
• Code, configurable: 0 to 90 days.
• Finding text: 180 days.
• Agent reply: 180 days.
• Metadata: indefinite.
• Backups, on top: 12 months.

Account settings:

• Code retention: 0 to 90 days.
• Generated text: 0 to 180 days.
• Changes and wipes: on request.

05.4 Secrets and credentials: stripped, and redacted. Files expected to hold secrets, such as environment files, are stripped before the request leaves the machine.

Where a credential appears in a real source file and is quoted into a finding, it is redacted before the finding text is stored, so it does not survive in the generated text class for the 180 days that class otherwise runs to.

05.5 Limits we hold ourselves to. No code, and no derivative of code including embeddings, enters a training or fine tuning set. We do not use a customer’s content for any purpose beyond running and improving the service for that customer. Benchmarking across customers would be a separate purpose, and we would agree it with a customer first.

• Code in training: never.
• Embeddings of code: never.
• Sold or licensed on: never.
• Cross customer benchmarking: by agreement only.

Our retention settings act on our live production systems. They do not on their own expire copies held in backup snapshots, point in time recovery history, platform log drains, exports, or a report a customer has already downloaded. The longest is our backup schedule, so the outside figure is the account’s retention period plus a further 12 months. We say it that way rather than claim a deletion we cannot evidence.

• Backup snapshots: 12 months.
• Outside figure: retention plus 12 months.

05.6 LeoLearn: same infrastructure, separate arrangement. LeoLearn runs on the same infrastructure as LeoPrevent and uses the same service providers, covered by section 07. What LeoLearn records about a learner, and how long it is kept, is set out in the arrangement under which LeoLearn is provided.

06Cookies and analytics

On leotrace.io, strictly necessary cookies are set without consent because the site cannot work without them. Analytics cookies are the only cookies there that are not strictly necessary, and they are set only where you consent through our cookie banner. Our Cookie Policy lists each cookie and what it is for.

Inside the LeoPrevent dashboard we use product analytics to understand how the product is used. We are the controller for this, as section 05.1 explains, because we decide what is collected and why. For a signed in user it records the pages and actions used, together with your display name, role and organisation, and location data derived from your IP address.

The dashboard also records sessions, so that we can see how it is used in practice and diagnose problems. Source code, diffs, finding detail, repository names and personal details are masked and do not appear in a recording.

07Who we share personal data with

We do not sell personal data. We share it with service providers who process it on our behalf under written contract, with our professional advisers in law, accounting, insurance and audit, with prospective or actual investors, acquirers and their advisers in connection with a financing, sale or reorganisation under confidentiality obligations, and with regulators, law enforcement, courts and other authorities where we are legally required to or where it is necessary to establish, exercise or defend legal claims.

A current list of the service providers that process data handled by LeoPrevent and LeoLearn, with what each one does, is available on request from [email protected]. We tell customers before we add one.

Separately, our public website uses Web3Forms for contact form delivery, Google Analytics for website telemetry and Cloudflare for DNS. Our internal business systems, covering email and productivity, customer relationship management, compliance automation, payroll, accounting and payments, process the relationship, candidate and marketing data described in section 04.

08International transfers

We are based in the United Kingdom. Some of our service providers and staff are located outside it, including in the European Economic Area and the United States.

Where personal data goes to a country without UK adequacy regulations, we put in place an approved transfer mechanism, being the UK International Data Transfer Agreement, or the EU Standard Contractual Clauses with the UK Addendum. You can ask which mechanism applies to a specific transfer.

09How long we keep personal data

We keep personal data only as long as we need it, then delete or anonymise it.

Customer code, generated text and product metadata are covered by section 05. The periods below apply to everything else. A free account is closed and its account data deleted 6 months after it goes inactive, an account being inactive once no review has run and nobody has signed in.

• Site analytics: 14 months.
• Enquiry, no relationship: 24 months.
• Customer records: contract plus 6 years.
• Supplier records: contract plus 6 years.
• Accounts, paid: subscription plus 6 months.
• Accounts, free: 6 months inactive.
• Marketing: until you unsubscribe.
• Unsuccessful candidates: 6 months after decision.
• Product analytics: 1 year.
• Session recordings: 1 month.

10Security

The measures we operate: encryption of data in transit and at rest, single sign on and multifactor authentication, centrally managed and encrypted company devices, logging and monitoring, supplier due diligence, and a documented incident response process.

Our information security management system is being certified to ISO/IEC 27001. Our current security documentation is available to customers and prospects on request. No system is completely secure. If a personal data breach meets the legal threshold, we will notify the Information Commissioner’s Office, and the individuals or customers affected, within the periods required by law and by contract.

11Your rights

Under UK data protection law you have the rights listed below.

• Be informed: always.
• Access: always.
• Rectification: always.
• Erasure: in some cases.
• Restriction: in some cases.
• Object: where we rely on legitimate interest.
• Object to marketing: always.
• Portability: where we rely on consent or contract.
• Withdraw consent: where we rely on it.

To exercise any of them, email [email protected]. We will respond within one month, and will tell you if we need longer because the request is complex. We may ask you to verify your identity first. There is no charge unless a request is manifestly unfounded or excessive.

If your request concerns data we process on behalf of a customer, we will refer you to that customer as the controller, or act on their instructions.

12Automated decisions

We do not make decisions about you based solely on automated processing that produce legal effects or otherwise significantly affect you. LeoPrevent produces findings about code. Where a dashboard reports activity by developer, that is a record of what happened, not a decision about the person.

13Age

Our products and our website are intended for business use. You must be 18 or over to create an account, and you confirm that at signup. We do not knowingly collect personal data from anyone under 18, and where we learn that we have, we delete it.

14Changes to this notice

We may update this notice. The current version is published at leotrace.io/privacy with the date it was issued. Where a change materially affects how we use your personal data, we will take reasonable steps to tell you directly.

15Contact and complaints

If you are unhappy with how we have handled your personal data, please contact us at [email protected] so we can try to resolve it. You also have the right to complain to the Information Commissioner’s Office, the UK supervisory authority, at ico.org.uk or on 0303 123 1113.

Security teams can ask us for the service provider list, our security documentation and our product terms at the same address. Available on request, by section:

• Service providers that process product data (section 07).
• Security documentation and certification status (section 10).
• Product terms and data processing terms (section 05).
• Transfer mechanism for a specific transfer (section 08).