How LEVEL 4 BUSINESSES LLC collects, uses and protects information.
Operated by LEVEL 4 BUSINESSES LLC · Last updated: November 5, 2026
Level 4 Businesses™ is an AI-powered customer acquisition platform operated by LEVEL 4 BUSINESSES LLC, located for business correspondence at 30 N Gould St Ste R, Sheridan, WY 82801, United States. For privacy inquiries, contact app@level4businesses.com.
LEVEL 4 BUSINESSES LLC ("Level 4 Businesses™," "we," "us," or "our") operates the Level 4 Businesses platform and the public showcase, content and advertising pages published through it. This Privacy Policy explains what information we collect, why we collect it, who we share it with, how long we keep it, and the choices available to you.
We act as the controller of information about our own subscribers and visitors: the person who creates an account, the business profile attached to that account, billing and subscription records, account security logs, and the technical data generated when someone visits our website or a page we publish.
When a business using the platform stores and works with information about its own prospects and customers, such as discovered businesses, contact details, outreach messages, replies and opt-outs, that business decides what is collected and why. In that arrangement the business is the controller and LEVEL 4 BUSINESSES LLC processes the information on its instructions. If you are a prospect or customer of one of our business users, that business is the party responsible for the information, and you should contact it first. We support those businesses in handling your requests.
We do not control, and are not responsible for, the privacy practices of third-party platforms that our business users connect to their accounts.
Subscriptions, one-time purchases, invoices and payment status are processed by Stripe. We receive confirmation that a payment succeeded or failed, the plan and amount, and a customer identifier. We do not receive or store full payment card numbers, bank credentials, or your card security code.
To help a business find potential customers, the platform queries public data sources, most significantly the Google Places API for business listings and the publicly accessible pages of a business's own website for publicly posted contact details. This can include business names, categories, addresses, phone numbers, websites, and email addresses that a business has itself published on its own site. We store this information in the requesting business's workspace.
If you connect a Google account, we receive an authorization token and the basic account identifier and email address needed to identify the connected account, together with the permissions described in Section 5. Tokens are stored on our platform infrastructure under access controls and are deleted or invalidated when you disconnect.
Where data protection law requires us to identify a legal basis, we rely on: performance of our contract with you (operating the platform and delivering what you subscribed to); our legitimate interests (securing the service, preventing abuse, improving features, and providing discovery results for the business that requested them), balanced against your rights; your consent (for optional permissions and any marketing communication that requires it, which you may withdraw at any time); and compliance with legal obligations (tax, accounting, and lawful requests).
We do not use your information, or the information in your workspace, for automated decisions that produce legal or similarly significant effects about you.
Depending on the features you enable, we use the following service providers. Each receives only what is necessary for the purpose described, and each is bound to use it for that purpose.
The public website at level4businesses.com is currently served by Base44. The new Level 4 application runs on Railway, with Cloudflare providing DNS, security, delivery and domain certificates, and will replace the current site when the domain moves.
Meta, TikTok, Reddit, Twilio and LiveKit are used only when you connect or enable the related feature.
A business using the platform may connect its own accounts to third-party services, and may export its own data, including hashed audience files, to those services. Those transfers are the business's decision and are governed by that provider's terms.
If you connect Google, we request: basic profile and email (sign-in); permission to send email from your Gmail; permission to read message metadata; and access to Search Console performance data and sitemap submission. With the metadata permission, Google does not allow us to read message bodies or attachments. We use this data only to provide these features to you. We do not use it for advertising or AI training, do not sell it, and do not let people read it except with your consent, for security, or as the law requires. Tokens are stored on our platform infrastructure under access controls and are deleted or invalidated when you disconnect.
We use the Gmail send permission to transmit messages you have reviewed and approved in the platform, from your own mailbox, to recipients you select. The message content we hold is the content generated and approved inside the platform, together with the delivery status returned for that send. The metadata permission lets us read headers and labels only, so a reply or a bounce can be matched to the message we sent. We do not read, scan, index or store the contents of your mailbox or your attachments.
Messages are sent only after our send-time checks pass, including recipient suppression, unsubscribe status and the presence of a valid physical mailing address in the footer. Recipients can opt out using the unsubscribe link in every message, and an opt-out is recorded so the address is not contacted again from that workspace.
You can disconnect a Google account at any time from the platform or from your Google Account permissions page. Disconnecting revokes our ability to act, and we delete or invalidate the stored token. Records of messages already sent, and suppression records required to honor opt-outs, are retained as described in Section 13. You may request deletion of Google-derived data at any time using the process in Section 14 or on our data deletion page.
Level 4 Businesses' use and transfer of information received from Google APIs will adhere to the Google API Services User Data Policy, including the Limited Use requirements.
Connections are established through the provider's own consent screen, and the permissions granted are shown to you there before you approve them. Google connections cover sign-in, Gmail (send and message metadata) and Google Search Console (read and sitemap submission).
Where social publishing is enabled for your account, the following describes what it does. If you connect Facebook or Instagram, we may list your Pages, publish posts you approve, read engagement, and read business assets. If you connect TikTok, we read basic profile information and upload and publish videos you approve. We read public Reddit posts through Reddit's API to find questions buyers ask, and we do not post to Reddit. You can disconnect at any time.
Advertising platforms, social networks, messaging providers and voice providers receive nothing unless you connect or enable the related feature. Campaign plans and ad copy produced by the platform are strategic and creative output; they do not by themselves grant us access to, or permission to act within, any advertising or social account.
Where an additional integration is enabled in the future, this Policy will be updated to describe the information involved before that feature is made available. Any such integration is optional, requests only the permissions the feature needs, and can be revoked by you at any time, in the platform or in the provider's own settings. Revoking access stops future processing but does not remove records already created, which are handled under Section 13.
We do not control third-party platforms. Their own terms and privacy policies govern your relationship with them and the information they hold independently of us.
We separate our own account communications from outreach sent on behalf of a business.
Account emails (verification, resets, alerts and reports) are sent by us, to the address on your account. They are not marketing messages from third parties.
Outreach emails are sent from your own connected Gmail. Each must show accurate sender details, a mailing address and a working opt-out. We honor opt-outs promptly and within the time the law requires.
L4 does not operate its own consumer SMS marketing program. If you connect your own Twilio account, texts to your leads are sent by you from your account. You are the sender and are responsible for carrier registration (A2P 10DLC) with the correct campaign type, for obtaining and recording each recipient's consent before marketing texts, for honoring STOP, and for including your business name and opt-out instructions. L4 shows a Send text option only after consent is on record for that lead. Acceptance of our Terms is not consent to marketing texts or calls.
Where AI calling is enabled for your account, the AI agent places calls through Twilio and LiveKit on your behalf, within the script, hours and daily limit you approve. Every call begins by saying it is an AI and naming your business. Before each call, L4 checks consent or eligibility, number type, our own suppression list and allowed hours. L4 does not currently check the National Do Not Call Registry, so you are responsible for do-not-call compliance, and L4 does not place cold calls to consumer numbers. A listed business number does not by itself authorize an AI marketing call. If the person says no, the call ends and the number is suppressed. Call audio is not recorded. If the person agrees on an AI call, a written transcript is kept while your account is active, and deleted on request or when your account is closed.
You set outreach rules, daily limits, calling hours and your ad spend limit. You authorize every ad launch, spend increase and scaling decision. L4 does not spend your ad budget without your authorization. You can pause the agent at any time. Automatic compliance checks support responsible use but do not guarantee compliance or replace your own.
AI is used to produce the platform's deliverables: offers, positioning, buyer discovery scoring, demand terms, content pages, advertising copy, outreach drafts, sales guidance, forecasts and reports. To produce them, the business context you provide, the public-source information relevant to the request, and your instructions are transmitted to AI model providers through our platform's model gateway, and the generated output is returned and stored in your workspace.
We keep technical records of model invocations, meaning which feature ran, when, and how often, for reliability, rate limiting and cost control.
AI output can be incomplete or wrong. It is a drafting and planning aid, not professional advice and not a verified statement of fact. Outputs should be reviewed before publication, spending, or contact with a person.
We do not use the content of your workspace to train models for other customers. We do not make a promise about model-provider training beyond what our provider terms and account settings support.
The platform is built for business contact and marketing information. Please do not submit government identifiers, financial account numbers, health information, biometric data, or information about children. If a regulated industry requires special handling, contact us before uploading such information.
Eligible customer contact details with documented permission for audience use may be converted into one-way hashed identifiers (SHA-256) for ad platform matching. Hashed identifiers can still be personal information and are not automatically anonymous.
The export is created at your request and downloaded by you. We do not upload it to any advertising platform on your behalf, and we do not transmit your contact data to advertising platforms automatically. Our export excludes suppressed addresses, but you remain responsible for the lawful basis on which you upload a list, for including only contacts your business is permitted to advertise to, and for the accuracy and legality of your own list.
We use a small set of first-party technologies:
While Base44 serves pages, it adds a small first-party script to them. It records only the fact that a page was viewed, together with the page route, and it sends that signal to our own platform log using a request from your browser. It is used for aggregate traffic counts for our business. It sets no advertising cookie, it is not shared with advertising networks, and it is not used to build a profile of you across other websites. It is not Google Analytics, and we run no advertising pixel, tag manager or third-party analytics tag on this website.
You can block or clear these technologies in your browser. Blocking the strictly necessary ones will stop you from staying signed in or submitting a form. Where a consent choice is presented to you, it is honored for the analytics signal described above.
We do not sell personal information, and we do not permit third parties to collect personal information about your online activities across other websites through this site.
We apply technical and organizational measures designed to protect information, including access controls between workspaces, server-side authorization on every workspace read and write, encrypted transport, scoped credentials for connected accounts, and audit logging of administrative access to a subscriber workspace.
No system is perfectly secure. If we become aware of a breach affecting your information, we will notify you and the relevant authorities where the law requires it, and we will describe what happened and what we are doing about it.
You are responsible for keeping your own credentials secure, for the access you grant to people on your team, and for the security of any account you connect to the platform.
We keep information for as long as your account is active and for as long as needed for the purposes described in this Policy. The following describes what the platform does today.
A weekly lifecycle runs for each workspace after that week's report has been delivered. It removes cold prospect leads that meet all of these conditions: the lead came from cold discovery rather than a form on your public pages, has never advanced beyond a new stage, has no recorded revenue, has no follow-up date and no notes, has no related revenue event or sales activity, and had no activity in the week just reported. Leads that fail any condition are kept, including warm inbound leads, leads you annotated or scheduled, leads that progressed, and leads tied to revenue. The lifecycle can be paused operationally, in which case no lead is removed.
When an account closes, we delete or de-identify the information that belongs to it, except for the categories above. We provide an export of workspace data on request before deletion. Some records survive in rolling backups until those backups expire.
Depending on where you live, you may have the right to access the personal information we hold about you, to correct it, to delete it, to receive a portable copy, to object to or restrict certain processing, and to withdraw consent where processing is based on consent. You may also have the right not to be discriminated against for exercising those rights.
To make a request, email app@level4businesses.com with the subject line Delete My Data, or use our data deletion page. We verify that a request comes from someone entitled to make it before acting on it, and we respond within the period the law requires, ordinarily within 30 days.
If you are a prospect or customer of one of our business users and the information belongs to that business's workspace, we will action the request as that business's processor and inform the business. You can also contact that business directly.
You can disconnect a connected Google account at any time from the platform or from your Google Account permissions page. You can clear cookies and browser storage in your browser settings.
If you are not satisfied with our response, you may complain to the data protection authority in your place of residence. We ask that you raise the issue with us first so we can try to resolve it.
LEVEL 4 BUSINESSES LLC, 30 N Gould St Ste R, Sheridan, WY 82801, United States. Privacy contact: app@level4businesses.com.
Questions about this policy?
Contact us and we will respond within the period described above.
app@level4businesses.comLEVEL 4 BUSINESSES LLC · 30 N Gould St Ste R, Sheridan, WY 82801, United States
Last updated November 5, 2026