Legal
Privacy policy
What Galaxian Inc. collects through the ProLevelUp website, why, who else sees it and how to ask us to change or delete it.
Last updated: 14 October 2026
ProLevelUp is a product of Galaxian Inc. This policy applies to the ProLevelUp website at prolevelup.app and the ProLevelUp services. In this policy, "ProLevelUp", "we", "us" and "our" mean Galaxian Inc.
Please note: this is a draft prepared for review by the company's attorneys. It has not been approved for publication and it is not legal advice.
Who we are and who is responsible
Galaxian Inc. operates this website and the ProLevelUp platform, and is the company responsible for the personal information collected through prolevelup.app — the controller of that information under state privacy law. ProLevelUp is a technology platform that connects merchants and their customers with independent financing providers. It is not a lender, does not make credit decisions and does not collect payments. That matters for your privacy: when a customer applies through a merchant, the financing company reviews the application and decides, under its own privacy notice.
What this policy covers, and what it does not
This policy covers prolevelup.app: the pages you read and the forms you fill in here. It does not cover:
- The ProLevelUp platform and the merchant portal, which have their own notice. Owner identity verification happens there, in the platform's secure onboarding portal, not on this website.
- The customer portal. The link on our portal page opens the platform at [CONSUMER_PORTAL_URL], which has its own notice.
- Each financing company, an independent business with its own notice covering the information it collects and the decision it makes.
- Other websites we link to. We do not control them.
Whose information we handle
- Website visitors. Anyone reading the site. We log the request your browser makes and use the cookies you allow.
- Merchants and their staff. Owners, primary contacts and employees who apply to join, book a demo, join the waitlist or write to us. Most of this is business information, with the contact details of named people.
- Consumers who apply through a merchant. We take no financing applications here. A consumer comes to this site to read how financing works, open the customer portal, file a complaint or make a privacy request. That is the only consumer information this website collects.
What we collect on this website
This is the complete list. If something is not in this table, this website does not collect it.
| Where | What we collect | Why |
|---|---|---|
| Any page you visit | IP address, browser user agent, the pages requested | To serve the site and keep server logs |
| Merchant application | Legal business name, DBA, EIN, business type, year established, industry, website, business phone, business address, state, number of locations, average ticket, estimated applications per month, current provider, intended channels, owner names, titles, emails, phones and ownership percentages, primary contact name, email and mobile, terms and privacy consent, and optional consent to receive text messages | To assess and onboard a merchant |
| Demo request | Name, business name, email, phone, industry, state, number of locations, applications per month, your note, consent, and optional consent to receive text messages | To arrange a demo |
| Complaint form | Name, email, phone (optional), business name, approximate date, application reference, complaint category, what happened, the outcome you want, and your consent to share the complaint with the merchant and the financing company | To investigate and resolve a complaint |
| Lender inquiry | Company, name, title, email, phone (optional), product type, states licensed, message | Partnership discussions |
| Partner inquiry | Company, partner type, name, email, phone (optional), number of merchants or members, message | Partnership discussions |
| Waitlist | Email, state, business type | To tell a merchant when their state opens |
| Privacy request form | Name, email, state of residence, type of request, your relationship to ProLevelUp, details | To handle an access, correction, deletion or opt-out request |
| General contact form | Name, email, business name (optional), topic, message | To reply to your enquiry |
| Any form with a consent box | The exact wording you agreed to, the time, your IP address and the page address | Proof of consent, including for text-message consent |
| Cookie banner | Your consent choices, the policy version and a random consent ID, in the sx_consent cookie; and a consent log entry holding the consent ID, your choices, the policy version, a Global Privacy Control flag, the page address and a one-way hash of your IP address | To remember your choice and prove it was made |
| Accessibility preferences widget | Your display preferences, stored in your own browser as aw-preferences. This never leaves your browser and never reaches us. | To remember your accessibility settings |
| Google Analytics 4, only if a Measurement ID is set and you allow analytics cookies | Pages viewed, device and browser data, approximate location, and the _ga cookies | To measure how the site is used |
| Google reCAPTCHA v3, only if keys are set and you allow functional cookies | IP address, browser data, interaction signals | To stop spam on forms |
| Staff sign-in | Username, hashed password, session cookies | Backend access for our own staff only |
What we never collect on this website
This website does not ask for, and is not built to receive, any of the following:
- Social Security numbers
- Bank account or routing numbers
- Card numbers
- Credit reports or credit scores
- Dates of birth
- Income
Owner identity verification happens in the platform's secure onboarding portal, not here. If a form on this site ever appears to ask for one of these, do not enter it and tell us at info@prolevelup.app.
How we use it
- To serve the pages you ask for and keep the site working and secure.
- To reply to you, and to assess and onboard a merchant who applies to join.
- To arrange a demo, and to tell a waitlisted merchant when their state opens.
- To investigate and resolve a complaint, and record how it was handled.
- To discuss a partnership, and to handle a privacy request and keep the record of it the law requires.
- To prove a consent was given, with the wording shown at the time, and to stop spam on our forms.
- To measure use of the site in aggregate, where you allowed analytics cookies, and to meet our legal obligations as a business that arranges consumer financing.
No credit decision is made on this website, and we make no automated decision about you here.
Who we share it with
- Our hosting provider, which stores the site, its database and the server logs.
- Our email delivery (SMTP) provider, which handles the recipient address and content of our notification and confirmation emails.
- [CRM] — the customer relationship system, not yet chosen. Once it is, merchant application, demo, lender, partner and waitlist submissions are exported to it and it becomes the system of record for those. This policy is updated at the same time.
- Google Analytics 4 and Google reCAPTCHA v3, each only if configured and only with the consent category it belongs to.
- Galaxian Inc.'s own complaint handling. If you consent on the complaint form, we share the complaint with the merchant and the financing company involved, because they usually hold the facts we need.
- Professional advisers and authorities, where the law, a regulator or the defence of a legal claim requires it.
Two things to be plain about. Applicant details are not passed to financing providers from this website — routing happens in the platform, not here. And we do not sell personal information and do not share it for targeted or cross-context behavioural advertising; no advertising or retargeting tag is configured on this site. All of this processing takes place in the United States.
Our notice as a financial services business
Because ProLevelUp arranges consumer financing, Galaxian Inc. is treated as a financial institution under the Gramm-Leach-Bliley Act (GLBA), and what it handles about consumers in the platform can be nonpublic personal financial information.
On this website we collect none of it: no Social Security numbers, no account or card numbers, no credit reports or scores, no dates of birth and no income. Where GLBA applies to information handled in the platform, the platform's notice is the GLBA notice for it. Galaxian Inc. does not sell consumer information and does not disclose it to nonaffiliated third parties for their own marketing. We maintain the written information security program the GLBA Safeguards Rule requires.
The three data zones
- Business data stays the merchant's. A merchant's records — their customers, their sales, their results — belong to the merchant. We do not sell them and do not use them to compete with the merchant.
- Customers own their identity data. A consumer's identity information belongs to that consumer, and moving it anywhere else is opt-in: it happens only if the customer chooses it.
- Only de-identified aggregate statistics are used for benchmarks. No individual merchant and no individual consumer can be picked out of them.
Cookies
No non-essential cookie is set before you choose. The banner offers four categories — Necessary, Functional, Analytics and Marketing — and nothing beyond Necessary runs until you allow it. The full list, with what each cookie does and how long it lasts, is in our cookie policy. Change your choice at any time with the "Cookie preferences" link in the footer of every page.
Your rights and choices
State privacy law gives you rights over your personal information: California residents under the California Consumer Privacy Act as amended, Florida residents under the Florida Digital Bill of Rights, and residents of other states with a comprehensive privacy law have similar rights. We apply the following to everyone who asks, wherever they live.
- Know and access what we hold about you, and get a copy.
- Correct information that is wrong.
- Delete information, unless we must keep it — for example the record of a privacy request or a complaint.
- Portability — your information in a portable form.
- Opt out of sale, sharing and targeted advertising. We do none of these, so there is nothing to opt out of; ask and we will confirm that in writing.
- Limit the use of sensitive information. We collect none on this website.
- No retaliation for exercising a right, and an appeal if we refuse a request.
To make a request, use the form at Your privacy choices or email info@prolevelup.app. You may use an authorised agent, and we will ask for proof you authorised them. We may verify who you are first, using information we already hold, so that we do not hand your information to someone else; we do not ask for new identity documents for this. We respond within 45 days, and we will tell you if we need the extension the law allows.
The Global Privacy Control signal
Some browsers and extensions send a Global Privacy Control (GPC) signal, which tells a website not to sell or share your personal information. We honour it. When your browser sends it, non-essential cookies stay off unless you later choose otherwise yourself, and we record that the signal was present in the consent log. You do not need to write to us to confirm it.
How long we keep things
- Form entries and the consent log: 24 months. This covers the merchant application, demo request, complaint, lender and partner inquiries, waitlist, privacy request and general contact form, with the consent record stored alongside each one.
- Your cookie choice: 180 days, after which sx_consent expires and the banner asks again.
- Server logs: 90 days.
- Google Analytics data: 14 months, if analytics is enabled.
- A privacy request record is also kept as long as the law requires us to show how it was handled. Accessibility widget preferences stay in your browser until you clear them.
When a period ends the entry is deleted from the site database. Where a submission has been exported to the system of record, that system's retention applies.
Security
We maintain a written information security program covering this website and the data it holds. What we do, and what is still outstanding, is set out on our security page rather than summarised here, so there is one honest version in one place. No website can promise that information will never be exposed; if a breach affects your personal information we will notify you and the authorities where the law requires it.
Children
This website is not intended for anyone under 13 and we do not knowingly collect personal information from anyone under 13. If you believe a child has sent us information, email info@prolevelup.app and we will delete it. Financing is for adults: a consumer applying through a merchant must be old enough to enter a credit or lease agreement in their state.
Changes to this policy
When we change this policy we change the date at the top. If a change materially affects how we use your information — for example when the [CRM] is chosen and added — we will say so clearly here, and ask for consent again where consent is the basis for it. Older versions are kept so a consent record can be matched to the version in force when it was given.
How to contact us
Questions about this policy? Email info@prolevelup.app. To exercise a privacy right, use the form at Your privacy choices.
A note on our postal address: this website publishes no postal address and no telephone number, by instruction of the company's owner. Where a law requires a postal address in a notice of this kind, Galaxian Inc. will supply one. This point is flagged for the company's attorneys to settle before publication.