Privacy & Cookie Policy
Last updated: May 2026 · Version 2.0
Applies to all users of l8entspace.com and the L8EntSpace platform.
1. Who We Are
L8EntSpace (“we”, “us”, “our”) is a Generative Engine Optimization (GEO) platform. We are the data controller responsible for your personal data collected through this website and platform.
Contact: For all privacy matters, write to us at sales@l8entspace.com with the subject line “Privacy Request”. We aim to respond within 72 hours and will always respond within the statutory 30-day period.
Note: If you are a UK business using L8EntSpace to process personal data about third parties on your behalf, please contact us to discuss a Data Processing Agreement (DPA).
2. What Data We Collect
We collect the following categories of personal and business data:
Account & Identity Data
Email address, name, account password (hashed), and profile information you provide at sign-up or in Settings.
Brand & Business Data
Brand name, website domain, target keywords, competitor names, brand “facts” you add to your Fact-Vault, and any content generated through our platform. This is business information you choose to enter.
Usage & Technical Data
IP address, browser type and version, operating system, pages visited, features used, timestamps, and error logs. Collected automatically when you use the platform.
Voice & Audio Data
When you use the Citacious voice assistant, your microphone audio is streamed in real time to Google Gemini Live API for processing. We do not store your voice recordings. Audio is processed transiently and discarded at session end. Transcripts of queries may be retained for up to 30 days for service quality purposes.
Payment & Billing Data
We use a third-party payment processor. We do not store your full card number, CVV, or bank details. We retain billing records (amounts, dates, subscription tier) as required by HMRC for 7 years.
Audit & Security Logs
Records of actions taken within the platform (e.g., data exports, settings changes, content published) for security and compliance purposes.
3. Why We Use Your Data — and Our Lawful Basis
Under UK GDPR, we must have a lawful basis for each use of your personal data:
| Purpose | Lawful Basis |
|---|---|
| Creating and managing your account | Contract (Art. 6(1)(b)) |
| Delivering GEO platform services | Contract (Art. 6(1)(b)) |
| Processing your subscription payments | Contract (Art. 6(1)(b)) |
| Sending transactional emails (billing, security alerts) | Contract / Legal Obligation |
| Maintaining security, preventing fraud and abuse | Legitimate Interests (Art. 6(1)(f)) |
| Improving platform features and performance | Legitimate Interests (Art. 6(1)(f)) |
| Sending marketing emails about new features | Consent (Art. 6(1)(a)) — opt out anytime |
| Retaining financial records for HMRC | Legal Obligation (Art. 6(1)(c)) |
| Processing voice queries via Citacious | Consent (Art. 6(1)(a)) — granted by initiating a call |
4. AI Processing — How Your Data Is Used with Third-Party AI Services
Our platform is built on artificial intelligence. To deliver our core services, your brand data (keywords, competitor names, brand facts) is sent to the following AI providers as data processors acting on our instructions:
Google (Gemini API, Firebase, Firestore, Cloud)
AI query processing, embeddings, data storage, voice processing (Citacious). Data may be processed in the US and EU.
OpenAI
AI citation and Share of Voice queries. Data may be processed in the US.
Anthropic
AI citation queries. Data may be processed in the US.
Perplexity AI
AI citation queries. Data may be processed in the US.
Netlify
Website hosting and content delivery. Data may be processed in the US.
We only share the minimum data required to fulfil your query. We do not sell your data to any third party. We do not use your brand data to train third-party AI models (where we have the contractual ability to restrict this).
5. International Data Transfers
Some of our third-party processors operate outside the UK. Where we transfer personal data internationally, we ensure appropriate safeguards are in place, including International Data Transfer Agreements (IDTAs), Standard Contractual Clauses (SCCs), or transfers to countries with UK adequacy decisions.
By using our platform and submitting data, you acknowledge that your data may be transferred to and processed in the United States and other countries where our processors operate.
6. Cookies
We use the following categories of cookies:
Essential for authentication, security, and core platform functionality. These cannot be disabled. Examples: session tokens, CSRF protection.
Remember your preferences (e.g., dashboard layout, notification settings). Enabled by default but you can disable them.
Help us understand how the site is used so we can improve it. We may use privacy-respecting analytics tools. No tracking across other websites.
You can manage cookies through your browser settings. Disabling functional cookies may affect your platform experience. Disabling analytics cookies will not affect platform functionality.
7. How Long We Keep Your Data
You can request deletion of your account data at any time (see Your Rights below). Some data must be retained for legal compliance even after account deletion.
8. Your Rights Under UK GDPR
You have the following rights regarding your personal data. To exercise any of them, email sales@l8entspace.com with the subject “Privacy Request”. We will respond within 30 days and will not charge a fee for reasonable requests.
Right of Access
Request a copy of all personal data we hold about you.
Right to Rectification
Ask us to correct inaccurate or incomplete data.
Right to Erasure
Request deletion of your data where we have no legal reason to retain it.
Right to Restrict Processing
Ask us to pause processing your data in certain circumstances.
Right to Data Portability
Receive your data in a machine-readable format to transfer to another service.
Right to Object
Object to processing based on legitimate interests or direct marketing.
Right to Withdraw Consent
Withdraw consent for consent-based processing (e.g., marketing, voice) at any time.
Right to Complain
Lodge a complaint with the Information Commissioner's Office at ico.org.uk or 0303 123 1113.
9. Children's Privacy
Our platform is intended for business use by individuals aged 18 and over. We do not knowingly collect personal data from anyone under 18. If you believe a minor has provided us with personal data, please contact us immediately and we will delete it.
10. Security
We implement appropriate technical and organisational measures to protect your data, including:
- Encryption at rest (AES-256) and in transit (TLS 1.3)
- Role-based access control — staff access is need-to-know only
- Firestore security rules restricting data access to the owning user UID
- Automated audit trails for all data mutations
- Multi-tenant data isolation — your data is never shared with or visible to other L8EntSpace customers
No system is 100% secure. In the event of a data breach that poses a risk to your rights and freedoms, we will notify the ICO within 72 hours and notify affected individuals without undue delay.
11. Changes to This Policy
We may update this policy to reflect changes in law or our practices. Material changes will be communicated by email and by updating the “Last updated” date above. Continued use of the platform after changes take effect constitutes acceptance of the updated policy.
Contact & Complaints
For any privacy questions or to exercise your rights: sales@l8entspace.com
To complain to the UK supervisory authority: ico.org.uk/make-a-complaint or call 0303 123 1113.
You have the right to complain to the ICO at any time. However, we would appreciate the opportunity to address your concerns first.