Privacy

Privacy

This notice explains what we do with personal data. It is written to be read rather than survived. If something here is unclear, ask us and we will fix the wording.

Last updated: 10.18.2026 · Applies to libasys.com and the Liba platform

Two different roles

Most privacy questions we get come down to one question: whose data is it, and who decides what happens to it? We sit in two different roles, and the answer depends on which one.

On this website, we are the controller. If you fill in our contact form or email us, we decide what happens to that data and this notice governs it.

Inside your deployment, we are the processor. When your organisation runs agents on Liba, the personal data those agents touch remains yours. You decide what is collected, why, and for how long. We act on your documented instructions under a data processing agreement, not under this notice. Where Liba runs in your own data centre, or on a disconnected network, we have no access to that data at all.

What we collect on this website

When you use the contact form, we receive your first name, last name, email address, company, your message, your phone number if you choose to give it, and the page of this site from which you sent the form. Form submissions are delivered to us through Formspree, a third-party form service that processes them on our behalf.

Our servers record standard technical information as an ordinary part of serving and securing the site: IP address, browser type, pages requested and timestamps.

We count visits with GoatCounter, a privacy-friendly analytics service. It sets no cookies and does not follow you across other websites. It records which page was viewed, the site that linked to it, the browser, screen size and an approximate country, and it does not store your IP address. We also count, without any personal details, when the contact button is clicked and when the form is sent, so we know which pages are useful. We use these numbers only to improve this website.

We do not buy contact lists, and we do not enrich what you send us with data bought from third parties.

Why we process it, and on what basis

We use contact form submissions to answer you and, if it goes further, to scope and run an engagement. Where the GDPR applies to a visitor, our bases are your consent for the initial enquiry, performance of a contract once we are working together, and our legitimate interest in operating and securing the site. Where other data protection law applies, processing rests on your consent or on a statutory authorisation.

We do not use your enquiry to train any model, ours or a vendor's.

Customer data inside the platform

This is the part procurement always asks about, so here it is in full.

Nothing our customers process on Liba is used to train any model, ours or a vendor's. That term sits in the agreement itself, not on a policy page we could quietly revise.

Every agent run, input, output, model call, tool invocation and approval is logged, versioned and replayable, with retention configurable by the customer. Knowledge retrieval respects the document permissions each user already holds, so an agent cannot surface a file its reader is not entitled to open.

Where a deployment routes work to a commercial model API, that vendor processes those calls on the customer's behalf. Customers who cannot accept that run open models on their own hardware instead, with no external inference.

Where data is processed

Our sovereign cloud is hosted in the region the customer selects. Customers may instead deploy into their own cloud tenancy, into their own data centre, or onto a disconnected network with no outside connectivity.

Where personal data moves out of the EEA, we rely on an adequacy decision covering the destination where one exists, and we sign standard contractual clauses where a customer requires them or no adequacy decision applies.

How we protect it

AES 256 encryption at rest and TLS 1.3 in transit. Credentials live in encrypted environment variables, never inside a workflow. Access is controlled through SAML single sign on, SCIM provisioning from your directory, enforced multi factor authentication, access by role, and permissions set per connection.

Our controls are designed with ISO 27001, SOC 2, the GDPR and the data protection rules of the jurisdictions our customers operate in in mind. This is a statement about control design, not a claim of certification or independent attestation. We provide a description of our controls to support your own assessment.

We classify each database we hold by sensitivity and apply the security tier that its classification and the applicable regulations require.

Security incidents

If a severe security incident affects a database held at medium or high security tier, we notify the competent supervisory authority on discovery, within the deadline the applicable law sets, and we tell affected customers without undue delay.

Your rights

You may ask us for a copy of the personal data we hold about you, ask us to correct it if it is wrong, and ask us to delete it, subject to the limits the law places on erasure. You can opt out of direct marketing at any time, absolutely and without giving a reason.

If your data reached us through a customer's Liba deployment rather than through this website, we will refer your request to that customer, who is the controller for it.

Write to Support@Libasys.com and we will respond within seven business days.

If you are not satisfied with our answer, you may complain to your local data protection supervisory authority, and to any other supervisory authority with jurisdiction if you are in the EEA.

Who we are

LIBA AI LTD, trading as Liba Systems

Support@Libasys.com

Changes

When we change this notice we will update the date at the top and, for changes that affect you materially, we will tell customers directly rather than rely on you to read the page again.