Privacy Policy
Effective July 10, 2026
Lekua turns an address into site analysis, CAD base plans, and permit paperwork for landscape designers. Doing that requires storing some of your data. This page says exactly what, where, and for how long — and the one promise that governs all of it: we never sell or share your data. No ad networks, no data brokers, no cross-site tracking. Your data exists to appear on your own screens and your own documents — the only exceptions are the narrow legal ones listed below, in plain sight.
What we store, and why
Your account
Your email address and sign-in method (email link or Google), managed by our authentication provider. Sign-in sessions last up to 90 days of inactivity before you’re asked to sign in again.
Saved projects
When you’re signed in, each address you analyze is saved as a project: the address, assessor parcel number, county, coordinates, parcel size and outline, and a log of project activity (analysis run, base plan exported, plan check run). This exists so you can leave, design, and pick up where you left off. Signed-out searches are not saved.
Exported files
When you download a base plan (DXF) or site report (PDF) while signed in, a copy is stored so you can re-download it from your projects list later.
Uploaded planting plans
Files you upload for a plan check are read to extract the plant schedule, then deleted from storage after processing. The plan-check results (flag counts, water-budget outcome) are saved to your project when one matches; the uploaded design itself is not kept.
Anonymous plant-demand statistics
To understand which plants designers actually use by region, we log plant recommendation and selection events at county/ZIP level with an anonymous session id. These records never contain an address or your identity.
On your device
We use local storage for your theme preference, your last-searched address (so the app can restore it), and your sign-in session. We use no advertising cookies and run no analytics trackers of our own. Because we don’t track anyone across other sites, browser signals like Do Not Track and Global Privacy Control change nothing — every visitor already gets that treatment.
Where your data lives
We don’t sell or share your data, and we use service providers only to run the product itself: Supabase (database and authentication), Vercel (hosting and file storage), Resend (transactional email), and Mapbox (mapping — the address you type is sent to Mapbox to locate the parcel, and your browser requests map tiles directly, which exposes your IP address to Mapbox and sends its standard map-usage telemetry, like any map website). Generating your site analysis also queries public data sources (county GIS servers, USDA, USGS and similar) with the coordinates of the parcel being analyzed. Part of the analysis runs on an AI provider (Anthropic): an aerial image of the parcel is sent to detect trees, lawn, and hardscape, and any plan you upload for a plan check is sent to read its plant schedule and title block. Each provider processes data solely to provide their service to us.
The narrow exceptions
Two situations could require disclosing data despite everything above. If we receive a subpoena, court order, or other valid legal process — or need to protect someone’s safety — we may be required to disclose information, and where it’s lawful and practicable we’ll notify you first. And if Lekuais ever acquired or merges, your data may transfer to the successor, who must honor this policy; we’ll tell you before any such change takes effect. That’s the complete list.
Today we email you only to sign you in. When project emails launch, they’ll be limited to things you asked for: a receipt with your exported file, at most one reminder per project to run a plan check, and follow-ups on flagged plants — each with an unsubscribe link, honored immediately. No newsletters unless you explicitly opt in to product updates.
Deleting your data
Every project has a delete option (the ⋯ menu on your projects list) that removes the address, its activity log, its stored files, and any scheduled reminders from our production systems immediately; residual copies in encrypted backups expire within 30 days. To delete your entire account and everything attached to it, email morgan@lovecrm.ai from your account email (that’s how we verify it’s really you) and we’ll complete it within 45 days — usually much sooner.
Security
Data is encrypted in transit and at rest, and database access rules ensure your projects are readable only by your account. No system is perfectly secure, but we keep the attack surface small: no ad-tech, no third-party scripts beyond the services named above.
Who this service is for
Lekua is operated by LoveCRM. It is a United States service built around California properties and California regulations, intended for professional use. It is not directed to children, and we don’t knowingly collect information from anyone under 16.
Your rights
You can ask us what data we hold about you, ask for a copy, correct it, or delete it — regardless of where you live. California residents: we do not “sell” or “share” personal information as defined by the CCPA/CPRA, and we don’t use it for cross-context behavioral advertising, so there is nothing to opt out of. We will never treat you differently for exercising any of these rights. Requests: morgan@lovecrm.ai.
Changes
If this policy changes in a way that matters — new data collected, a new category of provider — we’ll update the effective date above and, for significant changes, tell signed-in users in the product before the change applies.