Privacy policy
Staging draft. Updated September 30, 2026.
Lerlia is a product of Citodex Technology Ltd, which is responsible for evaluator account data. Contact lerlia@citodex.com about this policy or your information. This notice covers the staging evaluation service.
Citodex Technology Ltd. is incorporated and registered in Delaware, United States of America, file number 10085673. Its registered office is at 1 Sopwith Way, London SW11 8AZ.
What we collect and why
We use your name, email, password hash, and session information to create and protect your account and verify your inbox. We store site configuration, domain verification, scan evidence, consent events, and usage counts to provide the workflows you request. Security and delivery logs may include IP addresses and technical request information.
Assessment answers stay in your browser until you choose Save. A sign-in handoff uses tab storage for up to 15 minutes. Saved answers and results belong to your account. Share links reveal derived results, can be revoked, and expire within seven days. Anyone with an active link can view its result.
Staging requests contain your own verification email and fictional subject details. Do not submit actual privacy-rights requests, sensitive information, or another person's personal data. Verification confirms inbox access only.
Browser storage
Authentication uses necessary session cookies. The consent widget stores your choices locally so it can remember them; optional categories default to denied. Impression counts use event identifiers rather than persistent visitor identifiers. We do not use evaluator information for advertising.
Providers and sharing
Cloudflare hosts the application, database, browser scans, and transactional email. Your email provider processes verification messages. Stripe, when enabled, receives synthetic test-customer details, not evaluator inbox addresses. Providers may process data internationally and retain their own security, delivery, or billing logs. We do not sell your personal information. We may disclose information when legally required or necessary to address abuse.
Retention and your choices
The staging retention target is no more than seven days from creation for application records, including accounts and test requests. Automated deletion must pass its release check before evaluator intake opens. Provider logs have separate retention policies. Contact us to request access, correction, deletion, or other rights available under applicable law. You may object to processing based on legitimate interests and withdraw any consent you have given. You may also complain to your local data protection authority.
We need account information to provide authenticated features. You can use the anonymous assessment without saving answers. Scores and scans provide operational information; they do not make legally significant decisions about you.
Before public release
This draft requires review of applicable lawful bases, international-transfer arrangements, and provider log retention before public use. We will update the date above when the notice changes.