L5 Solution← Back to signup

Privacy Policy

Last updated: 2026-05-30

DRAFT — not yet legally reviewed

This document is a working draft posted publicly for transparency. It has not been reviewed by counsel and may be revised before it becomes binding. If you signed up before this banner is removed, email [email protected] for the operative version of any clause.

1. Who we are

L5 Solution ("we", "us") operates the multi-tenant business-management Service at l5solution.com and its tenant subdomains. This Privacy Policy explains what information we collect, how we use it, where it is stored, and the rights you have over it.

2. What we collect

2.1 Account & signup data

  • The subdomain you chose
  • Your company name
  • The founder's email address and (optionally) name
  • The tier you selected
  • The IP address and user-agent that submitted the signup form (for fraud prevention)
  • Records of your consent to these terms (a timestamp, the IP that consented, and the version of the document accepted)

2.2 Authentication data

  • Bcrypt password hash (never the plaintext password)
  • TOTP MFA secret (AES-256-GCM-encrypted at rest)
  • Hashed backup MFA codes (bcrypt)
  • Session cookies (HTTP-only, secure, SameSite-strict)
  • Login timestamps + IP addresses (for audit log + rate-limit context)

2.3 Tenant data (data you enter)

Whatever you and your users record inside your tenant — customers, orders, products, employees, financial records, and so on — is your data. You own it. We process it solely to provide the Service to you. We do not sell it, do not share it, and do not use it to train AI models.

2.4 Operational data

  • Server logs (HTTP requests, errors, performance traces)
  • Application audit logs (login events, permission changes, sensitive CRUD operations) — these stay inside your tenant DB
  • Aggregate, non-identifying usage statistics (e.g. "X tenants are on the Business Basic tier")

2.5 What we do NOT collect

  • We do not place advertising or analytics cookies. The only cookies we set are session cookies (see §2.2)
  • We do not embed third-party advertising trackers (no Facebook Pixel, no Google Ads, no TikTok tag)
  • We do not request access to your contacts, location, camera, or microphone

3. How we use what we collect

We use the data above for the following purposes:

  • Service delivery — provisioning your tenant, signing you in, rendering pages, storing your business data
  • Security — detecting and preventing fraud, abuse, brute-force, and unauthorized access
  • Support — responding when you email [email protected]
  • Billing — recording payments, computing the paid-until window, sending receipts and renewal reminders
  • Service-related communication — welcome emails, password-reset links, account-changed confirmations, security alerts, planned-maintenance notices

We do not send marketing email to your founder address without a separate, opt-in consent.

4. Sub-processors & storage locations

We use the following sub-processors as of 2026-05-30. The list is updated whenever a new processor enters the chain.

  • Supabase (PostgreSQL hosting) — your tenant database and the Platform DB live in Supabase projects. Regional placement depends on the tier and the region chosen when your workspace is created (new workspaces default to eu-central-1, Frankfurt).
  • Railway — application hosting for the Next.js server that renders your tenant and the platform admin dashboard.
  • Cloudflare — CDN, DDoS protection, WAF, and DNS.
  • Resend — transactional email delivery (welcome, password reset, billing, signup confirmations, admin alerts).
  • Sentry — error monitoring (data center in Germany). Cookies and authorization headers are stripped before events are sent.

Each sub-processor is contractually bound to handle your data only as needed to provide its service to us. We do not transfer your data to processors outside of this list without notice.

5. Cookies

We use two session cookies:

  • l5_solution_session — your tenant session. HTTP-only, secure, SameSite=Strict, 24-hour TTL.
  • l5_platform_session — L5 Solution staff session for the platform admin dashboard. Same posture; not relevant to customers.

Neither cookie is used for tracking across sites or for advertising. They expire when their TTL elapses or when you sign out.

6. Retention

  • Tenant data: retained for the life of your subscription, plus a 30-day grace window after termination to allow recovery.
  • Audit logs: retained per your tenant's data retention setting (defaults to indefinite within your tenant DB). You can export and purge these from inside the Service.
  • Billing records: retained as required by applicable tax law (typically 7 years).
  • Server & access logs: retained for up to 90 days for security and debugging, then rotated.
  • Email delivery logs (Resend): retained per Resend's own retention policy.

7. Security

We take reasonable technical and organizational measures to protect your data, including:

  • TLS for all in-transit data
  • Per-tenant database isolation with row-level security policies
  • AES-256-GCM encryption for sensitive credentials at rest
  • Bcrypt for password hashes; never plaintext
  • Mandatory TOTP MFA for platform admin accounts
  • Account lockout after repeated failed login attempts (with self-service recovery via email + TOTP)
  • Rate limiting on every authentication endpoint
  • OWASP A07 session rotation on password reset and similar sensitive events
  • Defensive CSP headers, CSRF protections, and a managed WAF in front of the app

No system is perfectly secure. We commit to notify affected tenants without undue delay if we discover a breach that materially affects your data.

8. Your rights

You have the following rights with respect to data we hold about you, subject to applicable law:

  • Access — a copy of the personal data we hold
  • Correction — update inaccurate or incomplete data
  • Deletion — request deletion of your tenant and the personal data inside it (subject to the retention rules in §6)
  • Portability — export your tenant data in a standard format
  • Objection — object to specific uses of your data (e.g. send a takedown for an automated decision you didn't consent to)

To exercise any of these rights, email [email protected] from the founder address on file. We will respond within 30 days.

9. Children

L5 Solution is a business product not intended for use by anyone under 18. We do not knowingly collect personal data from children. If you believe a child has signed up, contact us at [email protected] and we will delete the account.

10. International data transfers

Your data may be processed in jurisdictions other than your own, including those of our sub-processors (see §4). Where required, we rely on standard contractual clauses or equivalent safeguards to legitimize the transfer.

11. Changes to this Policy

We may update this Privacy Policy from time to time. Material changes will be announced via email to the founder address on file and posted at this URL with an updated "Last updated" date.

12. Contact

Privacy questions: [email protected]
General support: [email protected]