Privacy Policy

This Privacy Policy describes how 1001039001 Ontario Inc., doing business as Newsletter Builder AI and operating publicly as lightbreak ("we," "us," or "our"), collects, uses, discloses, and protects your personal information when you use our platform. It applies whether you reach us at lightbreak.ai, app.lightbreak.ai, or any of our subdomains and integrated services.

1. What we collect

1.1 Account information

When you create an account, we collect:

• Email address
• Name and organization details
• Password (hashed with bcrypt — we never store it in plain text)
• Account preferences and settings

1.2 Payment information

Payment processing is handled by Stripe. We do not store full credit card details. Stripe may share limited payment metadata with us (last four digits, billing country, charge status) for billing and reconciliation purposes.

1.3 Usage data

We automatically collect information about how you interact with the platform:

• Login timestamps and IP addresses
• Browser type and operating system
• Pages visited and features used
• Newsletter generation and editing history
• API usage metrics

1.4 Content data

Content you create, upload, or generate through the platform is stored to provide the services. This includes:

• Newsletter drafts and published issues
• RSS feed configurations
• Custom prompts and templates
• Sponsorship and advertiser information

1.5 Temporary processing data

When we process RSS feeds, articles, or external content on your behalf, that data is temporarily cached to generate summaries or AI outputs. The temporary data is not permanently stored and is deleted after processing.

2. How we use your information

We use the information we collect to:

• Provide the services: operate and maintain the platform, including AI content generation.
• Process payments: manage subscriptions and billing.
• Improve the platform: analyze usage patterns so we can fix what's broken and ship what matters.
• Support you: respond to questions and troubleshoot issues.
• Keep things secure: detect and prevent fraud, abuse, and security threats.
• Stay legal: meet regulatory and legal obligations.
• Communicate with you: send service updates, security alerts, and — with your consent — product news.

3. Third-party services

3.1 AI providers

We integrate with third-party AI services, including OpenAI, Anthropic (Claude), and Google Gemini. When you use AI features, limited content data may be transmitted to these providers solely to generate the output you requested. We anonymize inputs where possible and do not share personally identifiable information unless required for the service to function.

3.2 Payment processing

Stripe processes all payment transactions. Your payment card details are handled exclusively by Stripe and are subject to their privacy policy.

3.3 Analytics and monitoring

We may use analytics tools, including Google Analytics, to understand how the platform is used and where it falls short. These tools use cookies and similar tracking technologies.

3.4 Social and email platform integrations

When you connect a Facebook Page, Instagram account, or an email service provider (Beehiiv, Mailchimp, Substack, ConvertKit) to lightbreak:

• We only access the accounts and pages you explicitly authorize.
• We use access tokens solely to publish or schedule content you build inside lightbreak.
• We do not access your personal Facebook profile or private messages.
• We store access tokens encrypted at rest.
• You can revoke our access at any time from the source platform's settings or by disconnecting inside lightbreak.
• We comply with Meta's Platform Terms and Data Use Policy for all Meta integrations.

Facebook data deletion: to request deletion of data shared through Facebook, email [email protected] or use our automated deletion endpoint at https://app.lightbreak.ai/auth/facebook/deletion.

4. Data retention

We retain your personal information for as long as your account is active or as needed to provide the services. After account deletion:

• Most personal data is deleted within 30 days.
• Some data may be retained longer for legal, tax, or regulatory purposes.
• Aggregated, anonymized data may be retained indefinitely for analytics.

5. Your privacy rights

Depending on where you live, you may have any of the following rights:

• Access: request a copy of your personal data.
• Correction: update inaccurate or incomplete information.
• Deletion: request deletion of your account and associated data.
• Portability: receive your data in a machine-readable format.
• Objection: opt out of certain data processing activities.
• Restriction: ask us to limit how we process your data.
• Withdraw consent: revoke consent for marketing communications.

To exercise any of these rights, email [email protected]. We respond within 30 days or as required by applicable law.

6. Cookies and tracking

We use cookies and similar technologies for:

• Essential cookies: required for authentication and security.
• Analytics cookies: track usage patterns so we can improve the platform.
• Preference cookies: remember your settings and choices.

You can control cookies through your browser settings. Disabling essential cookies may break parts of the platform that depend on them.

7. Data security

We use industry-standard safeguards to protect your data:

• Encryption in transit (TLS) and at rest
• Bcrypt password hashing
• Routine security audits and monitoring
• Role-based access controls and authentication
• Hardened hosting infrastructure

No system is completely secure. You're responsible for keeping your account credentials confidential and reporting any suspected unauthorized use to us.

8. International data transfers

Your data may be processed and stored in countries outside your jurisdiction, including Canada and the United States. When we transfer data internationally, we put appropriate safeguards in place — such as standard contractual clauses or adequacy decisions — to keep your data protected.

9. Children's privacy

The platform is not intended for users under 18. We do not knowingly collect personal information from children. If we learn that a child has provided personal information, we will delete it.

10. Changes to this policy

We may update this Privacy Policy from time to time. The most current version will always live at this URL with a "Last updated" date at the top. Continued use of the platform after changes constitutes acceptance of the updated policy.

11. Regulatory compliance

We comply with applicable privacy laws, including:

• GDPR — EU General Data Protection Regulation
• PIPEDA — Canada's Personal Information Protection and Electronic Documents Act
• CPRA — California Privacy Rights Act

12. Contact

For privacy questions, concerns, or requests, write to us: