Plain-language notes on what we collect, what we do with it, and how to reach us. Email agentlevier@polsia.app with any question.
Last updated: 2026-07-31
AgentLevier is a marketplace for AI skill packs, operated by Polsia. You can reach us at agentlevier@polsia.app for any privacy question, data request, or complaint.
We collect three categories of data, no more.
Email addresses. You give us your email when you subscribe on the landing page, after buying a skill pack, or when you opt in at checkout. Email is stored in the subscribers table until you unsubscribe.
A truncated IP hash. To deduplicate analytics events we store the first 16 hex characters of SHA256(ip + IP_HASH_SALT). The full IP is never written to disk. The salt lives in the IP_HASH_SALT environment variable.
UTM params and path. Every page load posts a tiny beacon to POST /api/track carrying utm_source, utm_medium, utm_campaign, utm_content, referrer, and the pathname. We do not set any marketing cookies.
If you subscribe, you get a three-step welcome drip: one email immediately, one 24 hours later, and one 72 hours later. The follow-ups introduce other skill packs and, occasionally, a launch-price invitation. We do not rent, sell, or share your email with any third party — ever. The only outbound emails are the drip itself, transactional receipts from Stripe, and replies you have asked us for.
Stripe is the merchant of record for every skill-pack purchase. When GET /api/packs/checkout/:slug runs and a STRIPE_SECRET_KEY is configured, we create a Stripe Checkout session on Stripe’s servers; otherwise we redirect to a pre-built Stripe Payment Link configured at the same $0.99. When POST /api/purchase is called with a Stripe payment method (payment_token) we create a PaymentIntent on Stripe’s servers and serve the skill pack JSON in the response.
In every case we store only the stripe_payment_intent_id or stripe_session_id, the amount, the course slug, and — for Checkout — the email Stripe collected from the buyer. We never receive or store full card numbers, CVC codes, or expiration dates. All card data lives inside Stripe’s PCI-compliant environment. See the Stripe Privacy Policy for how Stripe handles your card data.
Subscriber rows stay in the database until you unsubscribe (which sets the unsubscribed_at column) or until you ask us to delete them. page_visits and purchases rows are retained indefinitely for accounting, audit, and analytics — there is no automatic deletion at this time.
Every drip email contains a one-click unsubscribe link signed with an HMAC-SHA256 token derived from the UNSUBSCRIBE_SECRET environment variable. Clicking the link opens GET /unsubscribe, verifies the signature, and marks your subscriber row inactive. You can also email agentlevier@polsia.app and we will unsubscribe you manually.
You can ask us at any time to export or delete the personal data we hold on you. Email agentlevier@polsia.app with the address you subscribed or purchased with and we will reply within seven business days.
agentlevier@polsia.app — we read every message and reply to anything that affects your data.