Ledgerlight Privacy Policy
Controller: Gindi Innovation (Aviad Gindi), 8 Arik Einstein St., Holon, Israel. Contact for privacy matters: aviad@gindiinnovation.com, +972-50-333-4482. No data protection officer is required or appointed.
This policy covers the website getledgerlight.com (the "Site") and the Ledgerlight console at getledgerlight.com/console (the "Hosted Console"). It also explains our role when Ledgerlight is deployed in a customer's own cloud account (the "Customer Deployment").
1. Our role
- Site visitors and Hosted Console users: we are the controller of your account data, activity log and site telemetry (sections 2 to 4).
- Financial statements and the figures extracted from them: these belong to our customer (a family office, wealth manager or nonprofit). The customer is the controller; where our hosted service touches that content we act as processor under a Data Processing Agreement. In a Customer Deployment, the software runs inside the customer's own AWS account and we have no access to the data unless the customer grants temporary support access.
- The Hosted Console is a demonstration environment only (decision of 19 October 2026). It is operated by Gindi Innovation to show Ledgerlight to prospective customers with sample data. No paying customer uses it and no real client statements are to be uploaded to it. Real customers run Ledgerlight in their own AWS account with Amazon Bedrock (Customer Deployment), where Gindi Innovation has no access to their data.
2. What we collect
| Category | Data | Source | Where it is stored |
|---|---|---|---|
| Account data | Email address, password (hashed by the authentication service), authenticator-app secret if you enable two-step verification, role (viewer, preparer, approver, admin) | Created by an administrator; no public sign-up | Authentication service and application database (Lovable Cloud, managed Supabase), hosted in the United States, AWS US East (N. Virginia) (confirmed by Lovable support, 19 October 2026) |
| Uploaded statements and extracted figures | Content of bank, custodian and fund statements: holdings, balances, transactions, account numbers, names of account holders | Uploaded by you | Not stored on our servers. Known formats are parsed in your browser. Documents and portfolio figures stay in your browser's memory and local storage until you clear them or sign out of the browser session. |
| AI extraction content | When you click "Read with AI": the document's text lines, spreadsheet rows or page images, the file name, and a layout hint from a saved template (account numbers masked to their last four characters) | Sent by your browser | Processed transiently by our extraction function and the AI model provider (section 5). We do not store the content. |
| Saved layout templates | Institution, document type, your client's name as printed on the statement, statement date and currency, layout phrases, column headers, row labels, and account numbers only as a salted SHA-256 hash with the last four characters | Saved by an approver | Application database, one row per template, visible only to the user who saved it |
| Activity log | Who did what and when: sign-in, sign-out, import, approve, undo, export, delete, template saved, role change, two-step verification change, AI extraction (file name, outcome, model). Your email address is recorded with each event. Never document content or figures. | Generated by the console and the server | Application database, append-only, kept 7 years |
| AI usage log | User id, time and kind of each AI extraction (no content) | Generated by the server | Application database |
| Support correspondence | Your name, email and the content of your messages to aviad@gindiinnovation.com | You | Google Workspace mailbox of Gindi Innovation; kept 3 years after the last message |
| Site telemetry | Lovable's "Visitor analytics" feature (currently on) loads a first-party script (/~flock.js, Tinybird's web-analytics snippet as bundled by Lovable) that records page views: page URL, referrer, user agent and a random session id, sent to Tinybird (api.tinybird.co). The IP address is seen by Tinybird's servers on receipt. No names or account data. A separate Lovable runtime-events script reports script errors. Server logs of the console hold status and error codes only. | Automatic | Lovable, Tinybird |
| Cookies | See section 9 |
We do not collect special-category data, and we do not knowingly process data of children (section 11). Financial information about identifiable individuals is treated as sensitive information under Israeli law.
3. Why we process it and on what basis
| Purpose | Data | Legal basis (GDPR Art. 6) |
|---|---|---|
| Providing the console: sign-in, two-step verification, roles | Account data | Contract (6(1)(b)) with our customer; for users who are the customer's staff, our legitimate interest in providing the service the customer ordered (6(1)(f)) |
| Reading and reconciling statements, including AI extraction when you choose it | Statement content, AI extraction content | We act on the customer's instructions as processor. The customer's basis is typically contract or legitimate interest towards its clients. |
| Remembering layouts you approved so the next statement is read the same way | Saved layout templates | Contract / legitimate interest (6(1)(b), (f)) |
| Security, accountability and fraud prevention; evidence of who approved which figure | Activity log, AI usage log | Legitimate interest (6(1)(f)); Israeli Data Security Regulations 2017, reg. 10 (access log) |
| Enforcing fair-use limits on AI extraction | AI usage log | Legitimate interest (6(1)(f)) |
| Answering your questions and support requests | Support correspondence | Contract or legitimate interest |
| Understanding how the Site is used | Site telemetry | Legitimate interest (6(1)(f)) for essential, non-identifying measurement; consent (6(1)(a)) if the telemetry sets non-essential cookies or similar identifiers |
| Marketing emails | We send none. If we start a newsletter, it will be opt-in only. | Consent |
We do not use your data for automated decisions with legal or similar effect. AI extraction produces a proposal; every figure is checked by rules and approved by a person with the approver role before it is added.
4. Who receives your data (sub-processors)
The Hosted Console and Site use these providers. Each is bound by its own terms and data processing agreement. Lists per deployment model are in our sub-processor list, available on request.
| Provider | Role | Data | Location |
|---|---|---|---|
| Lovable Labs Incorporated (Sweden), with its hosting and database infrastructure (Supabase) | Hosting of the Site and Hosted Console, authentication, application database, serverless functions, site analytics | Account data, saved templates, activity log, AI usage log, site telemetry; AI extraction content in transit | Backend (database, authentication, storage): United States, AWS US East (N. Virginia); region fixed for this project. Static site assets: Cloudflare global edge, nearest location to the visitor. Lovable's DPA (EU and UK GDPR) is at lovable.dev/data-processing-agreement; trust center trust.lovable.dev. Lovable confirmed that end-user application data (database rows, users, passwords) is not used for model training. The account preference "Use my Lovable content for model training" is off and the project setting "AI app context" is off, so neither development data nor application data is used to train Lovable's models. |
| Lovable AI Gateway, routing to third-party model providers (default model: Google Gemini) | AI extraction in the Hosted Console | The content you send with "Read with AI" | — |
| Cloudflare, Inc. (engaged by Lovable) | Global Anycast edge for the published site: TLS termination, caching, bot protection (__cf_bm cookie) | IP address, request metadata | Global network, nearest point of presence to the visitor (Israel, EU, US included) |
| Tinybird, Inc. (US), engaged by Lovable ("Visitor analytics") | Visitor statistics for the demo site: page URL, referrer, user agent, random session id; IP address seen on receipt and possibly used by the provider to derive an approximate location | Site telemetry only; no account or statement data | Tinybird operates EU and US regions |
| Google LLC (Google Workspace) | Email for support correspondence | Support emails | EU/US under Google's terms |
Customer Deployment (your own AWS account). The application, database, logs and AI extraction (Claude on Amazon Bedrock) run inside the customer's AWS account in the region the customer chooses (EU, Israel il-central-1 Tel Aviv, or any other AWS region). Ledgerlight has no access to your data. Gindi Innovation receives no data. AWS and Bedrock are the customer's providers under the customer's own AWS agreement. AWS documents that Bedrock does not store or log prompts and completions and does not use them to train models, and that model providers have no access to them.
We do not sell personal data.
5. AI and your data
- Ledgerlight contains no mechanism that trains or fine-tunes any model on customer data.
- Content is sent to a model only when a user clicks "Read with AI". Known statement formats are parsed in the browser without AI.
- The model receives no tools and no access to other data. Its answer must match a strict schema and pass arithmetic checks, and a person approves it.
- In a Customer Deployment on Amazon Bedrock, AWS states that prompts and completions are not stored, logged or used for training.
- In the Hosted Console, the AI gateway and model provider process the content under their own terms.
6. How long we keep data
| Data | Retention | Basis |
|---|---|---|
| Uploaded statements, extracted figures | Not stored on our servers. In your browser until you clear local storage or end the session. | Design of the current version |
| AI extraction content | Not stored by Ledgerlight. Transient in the extraction function. Provider retention: see section 4. | |
| Account data | Until the account is deleted by an administrator or at the customer's request, and in any case after 12 months of inactivity (decision of 19 October 2026; automated handling is being implemented, until then applied manually) | |
| Saved layout templates | Until you delete the template or your account is deleted (deleted together with the account) | |
| Activity log | 7 years from the event. Entries outlive the deletion of the account because they are evidence of who approved which figure. When an account is deleted, the email address in its entries is replaced by a pseudonym (decision of 19 October 2026; code change in progress, until then done manually on request). | Accountability; Israeli Data Security Regulations reg. 10 require at least 24 months |
| AI usage log | 24 months (decision of 19 October 2026; automated purge being implemented) | Fair-use limits, security |
| Support correspondence | 3 years after the last message (decision of 19 October 2026) | |
| Backups of the application database | Per the hosting provider's backup schedule. Deleted data disappears from backups when the backup window expires. | |
| Site telemetry | — |
7. Your rights
Under the GDPR (if it applies to you) and the Israeli Privacy Protection Law you may ask to: access the personal data we hold about you; correct it; delete it; restrict or object to processing based on legitimate interest; receive a copy in a machine-readable format (portability); and withdraw consent where processing is based on consent. You may also complain to a supervisory authority: in Israel the Privacy Protection Authority (gov.il/privacy), in the EU the authority of your country.
To exercise a right, email aviad@gindiinnovation.com from the address on your account, or ask your organisation's administrator. We verify identity, respond within 30 days (extendable by two months for complex requests, with notice), and do not charge unless requests are manifestly unfounded or excessive. If the data belongs to one of our customers (for example your statement held by a family office), we forward the request to that customer, who decides as controller.
What deletion means in practice: your account, role, saved templates and AI usage entries are deleted; activity-log entries are kept for 7 years with your email address replaced by a pseudonym (section 6); copies in backups expire with the backup window.
8. International transfers
Gindi Innovation is in Israel. Israel holds an EU adequacy decision (Commission Decision 2011/61/EU, confirmed in the Commission's review of January 2024), so transfers from the EU to us need no further safeguard.
The Hosted Console and Site store data in the United States (Lovable Cloud, AWS US East). For users in the EU/EEA, the UK or Israel this is an international transfer. It is covered by Lovable's Data Processing Agreement, which incorporates the European Commission's Standard Contractual Clauses (and the UK Addendum) for transfers out of the EU/UK. Cloudflare serves the site from its global network under Lovable's agreements. Customers who need data to stay in the EU or in Israel should use the Customer Deployment in their own AWS region; the hosted version cannot be moved to another region without a new project. Transfers of data from Israel abroad follow the Privacy Protection (Transfer of Data to Databases Abroad) Regulations 5761-2001.
9. Cookies and local storage
What the Site and Hosted Console actually set (checked on 18 October 2026):
| Name | Set by | Purpose | Type | Lifetime |
|---|---|---|---|---|
__cf_bm | Cloudflare (network edge) | Bot protection for the Site | Strictly necessary | 30 minutes |
sb-*-auth-token (browser local storage, not a cookie) | Supabase client library | Keeps you signed in to the console | Strictly necessary | Until sign-out or token expiry |
fo-lang, currency and view preferences, "reminder sent" marks, saved templates fallback (browser local storage) | The console | Remembers your language and display settings; keeps templates locally if the server is unavailable | Functional, no identifier sent to us | Until you clear browser storage |
session-id | Lovable "Visitor analytics" (Tinybird snippet, /~flock.js) | Visitor statistics for the demo site: a random id groups the page views of one visit, with no link to your account or identity. Sent with each page view: page URL, referrer, user agent; the IP address is seen by Tinybird on receipt and may be used to derive an approximate location. Falls back to browser local/session storage if cookies are blocked. Legal basis: legitimate interest in aggregated, pseudonymous visitor statistics (decision of 19 October 2026: analytics kept on and disclosed). | Analytics, pseudonymous | 30 minutes |
Lovable runtime-events script (/__l5e/events.*.js) | Lovable hosting | Reports script errors on the page to Lovable | Functional / platform | No cookie identified |
We set no advertising cookies and use no third-party advertising or social-media trackers. Fonts are served from our own domain.
How to object to analytics: block cookies and site data for getledgerlight.com in your browser, use a content blocker that blocks /~flock.js or api.tinybird.co, or email aviad@gindiinnovation.com; the console itself works without the analytics script. We will honour objections under GDPR Art. 21 for processing based on legitimate interest.
10. Security
Measures in place and verified on the Hosted Console (code of 17 October 2026 and live response headers of 18 October 2026): TLS for all traffic with HSTS; a strict Content-Security-Policy, frame denial and related browser headers; accounts created only by an administrator; four roles enforced in the database with row-level security; two-step verification (authenticator app) mandatory for approvers and administrators and enforced server-side; an append-only activity log; account numbers in saved templates stored only as salted hashes; least-privilege database grants; the AI function accepts calls only from our own origin, verifies the user's token and enforces daily limits; no credentials in the code, with automated secret scanning and dependency audits on every change.
In a Customer Deployment the database, backups, secrets and logs are encrypted with a customer-managed KMS key, and the network is private by default. Encryption at rest on the Hosted Console is provided by the hosting provider's platform (AWS US East, under Lovable's and Supabase's documentation).
We hold no security certification (no ISO 27001, no SOC 2) and have not yet had an independent penetration test. Details are in our Security Overview.
11. Personal data breaches
If a breach affects personal data we hold, we notify affected customers without undue delay and within 24 hours of confirming it, with what we know, so that the customer as controller can meet its 72-hour deadline under GDPR Art. 33 and its reporting duties to the Israeli Privacy Protection Authority. Where we are the controller, we notify the competent authority within 72 hours where required, and affected individuals where the risk is high.
12. Children
Ledgerlight is a business tool for professionals. We do not knowingly collect data from anyone under 18. Statements processed by our customers may mention minors (for example beneficiaries); the customer is the controller of that data.
13. Israeli law
This policy also serves as the notice under section 11 of the Privacy Protection Law 5741-1981: providing your data is not legally required; it is needed to give you access to the console; the purposes and recipients are those listed above. Databases are managed in line with the Privacy Protection (Data Security) Regulations 5777-2017. Your rights of access and correction under sections 13 and 14 of the Law are exercised through the contact above.
14. Changes
We will post changes on this page with a new date. For material changes we will notify customers by email.
Version 0.2, 19 October 2026.