Privacy Policy

Last updated: November 7, 2026

This Privacy Policy explains how LessStrict ("LessStrict", "we", "us") collects, uses, shares and protects information when you use lessstrict.com, our chat application, our API and related services (together, the "Service").

1. Information we collect

Account information. When you register we collect your name, email address and a password hash. If you sign in with a third-party provider we receive the profile fields that provider shares with us.

Billing information. Payments are processed by Stripe. We receive the last four digits of your card, the card brand, the billing country and transaction identifiers. We never store full card numbers.

Content you submit. Messages you send to models, files or images you attach, system prompts, saved memories and profile context ("About you", "How should the AI respond") are stored so we can show you your history and personalise responses.

Usage data. For every request we log the model used, token counts, cost, latency, the API key used (if any), timestamps and request identifiers. We use this to bill you, enforce plan limits and detect abuse.

Technical data. IP address, browser type, device information, referring pages and error logs.

Support communications. Messages you send through the contact form or by email.

2. How we use information

• To provide the Service, including routing your requests to AI models, streaming responses and keeping your chat history.
• To bill subscriptions, wallet top-ups and pay-as-you-go usage, and to prevent fraud.
• To enforce plan limits, rate limits and our Acceptable Use Policy.
• To improve the Service, fix bugs and understand which features are used.
• To send transactional email: verification, password resets, receipts, low-balance alerts and important service notices.
• To respond to support requests.

We do not sell your personal information. We do not use your conversations to train our own models.

3. AI model providers

LessStrict routes requests to third-party model providers. The content of your request (messages, attachments and system prompt) is sent to the provider that serves the selected model so it can generate a response. We send the minimum data required and do not send your name, email or billing details to providers. Providers process this data under their own terms; many offer zero-retention policies, and we prefer those where available. Model pages indicate the hosting region when known.

4. Web search

When you enable web search, the search query derived from your message is sent to a third-party search provider. Search results are shown to you and included in the model's context. Search queries are not linked to your identity by the search provider beyond what is technically necessary.

5. Cookies

We use a strictly necessary session cookie to keep you signed in and, where you consent, analytics cookies to understand how the site is used. See our Cookie Policy for details.

6. Data sharing

We share data only with:

• Service providers that help us operate the Service: hosting, database, payment processing (Stripe), email delivery, model providers and search providers. They may use your data only to provide services to us.
• Legal authorities when required by law, to protect our rights, or to prevent harm.
• A successor in a merger, acquisition or asset sale, with notice to you.

7. Data retention

Account and billing records are kept for as long as your account exists and for the period required by tax and accounting law afterwards (typically 7 years for invoices). Chat history is kept until you delete it or close your account. Usage logs are retained for up to 24 months. You can delete individual conversations, memories and API keys at any time from your dashboard.

8. Security

Passwords are hashed with bcrypt. API keys are stored as salted hashes and shown only once. Provider credentials are encrypted at rest with AES-256-GCM. Data moves over TLS. Access to production systems is limited to staff who need it and is logged. No system is perfectly secure; if we learn of a breach affecting your data we will notify you without undue delay.

9. Your rights

Depending on where you live you may have the right to access, correct, export or delete your personal data, to restrict or object to processing, and to lodge a complaint with a supervisory authority. You can export your data or delete your account from Dashboard > Settings, or by emailing us. We will respond within 30 days.

If you are in the European Economic Area or the United Kingdom, our legal bases for processing are performance of a contract (providing the Service), legitimate interests (security, improvement, fraud prevention), consent (marketing, non-essential cookies) and legal obligation (tax records).

10. International transfers

Our servers and providers may be located outside your country. Where required we rely on standard contractual clauses or equivalent safeguards.

11. Children

The Service is not directed to anyone under 18. We do not knowingly collect data from children. If you believe a child has created an account, contact us and we will delete it.

12. Changes

We may update this policy. Material changes will be announced in the app or by email at least 14 days before they take effect.

13. Contact

Privacy questions: [email protected]