Data processing agreement

Parties and roles

Customer: the organisation that holds a LeanOS company account, acting through the people who accept the terms on its behalf. It is the controller of the Customer Data.

LeanOS: Centre Educatiu del CAD CAM, SL, tax ID (CIF) B62582945, registered address Avinguda Antoni Gaudí 15, Local 2, 08840 Viladecans (Barcelona), Spain. It is the processor of the Customer Data.

Customer Data: the personal data in what the Customer and its users put in their LeanOS workspace (projects, charters, KPIs, milestones, actions, ideas, files, comments and AI conversations inside a project) and the membership and roles of the people in that workspace.

LeanOS is the controller, not the processor, of the data it processes for its own purposes: user accounts and sign-in, billing and invoicing, support tickets, security logs and rate limits, the website and its forms, and marketing. That processing is described in the privacy policy, https://leanos-app.com/en/privacy, and is outside this DPA.

Subject matter, duration, nature and purpose

Subject matter: hosting and processing the Customer Data so that the Customer can use LeanOS.

Duration: for as long as LeanOS processes Customer Data under the terms, and until that data is deleted as set out under 'Deletion or return at the end'.

Nature: storage, organisation, display, retrieval, sending by email (for example project invitations), processing by the AI features when a user asks for it, backup and deletion.

Purpose: to provide LeanOS to the Customer as the terms describe, and for no other purpose.

Types of personal data

Identification and contact details of the people in the workspace: name, work email, job title or role.

Professional information entered in projects: responsibilities, assigned actions and deadlines, KPI owners and results, comments, process descriptions, and records of who created or changed an item.

Files uploaded by users, and the personal data they contain.

Text that users send to the AI features, and the answers.

LeanOS is not designed for special categories of personal data (Article 9 GDPR) or for data about criminal convictions (Article 10). The Customer should not enter them.

Categories of data subjects

The Customer's users: employees, managers and contractors with a LeanOS account in the Customer's company.

External collaborators the Customer invites to a project.

People named in the content: team members, stakeholders, process owners, and contacts at suppliers and customers.

Processing on documented instructions

LeanOS processes Customer Data only on the Customer's documented instructions. The terms, this DPA and the way the Customer uses and configures LeanOS are those instructions, including for transfers outside the EEA, which take place only as described under 'Sub-processors'. If EU or Member State law requires LeanOS to process Customer Data in any other way, LeanOS will tell the Customer first, unless that law forbids it. LeanOS will tell the Customer at once if, in its opinion, an instruction infringes the GDPR or other data protection law.

LeanOS does not sell Customer Data and does not use it to train AI models.

Confidentiality

Only the people at LeanOS who need access to operate, support or secure the service can reach Customer Data, and only for that purpose. Each of them is bound by a duty of confidentiality, by contract or by law.

Security

LeanOS applies the technical and organisational measures listed in the annex 'Security measures' at the end of this DPA, appropriate to the risk as Article 32 GDPR requires. LeanOS may change them, provided the overall level of security does not go down.

Sub-processors

The Customer gives LeanOS general written authorisation to engage sub-processors. These are the current ones, each processing Customer Data only for the task shown:

Supabase — database, sign-in and file storage. Data is hosted in the EU (Frankfurt). Supabase Inc. is a US company: SCCs.

Railway — runs the application, in its EU region (Amsterdam). Railway Corp. is a US company: SCCs.

Arsys Internet S.L.U. (Spain) — sends the emails LeanOS sends to users, such as project invitations, and hosts the support mailbox.

Resend — backup email sending, used only when it is active. US company: SCCs.

OpenAI — AI features, only when a user uses them. US company: SCCs. Data sent through its API is not used to train models; OpenAI may keep it for up to 30 days to detect abuse.

Cloudflare — storage of the database backups. US company: SCCs / EU–US Data Privacy Framework.

GitHub — runs the hourly backup job; the backup passes through GitHub's servers in the US: SCCs / EU–US Data Privacy Framework.

SCCs are the EU Standard Contractual Clauses. Stripe and Holded, also named in the privacy policy, receive only billing data, for which LeanOS is the controller; they are not sub-processors under this DPA.

LeanOS binds each sub-processor to data protection obligations that give at least the protection of this DPA, and remains liable to the Customer for how its sub-processors perform them.

Changes: LeanOS will tell the Customer about any intended addition or replacement of a sub-processor in reasonable advance of it applying, by email to the Customer's administrators and by updating this page. Before the change applies the Customer may object on reasonable data protection grounds by writing to support@leanos-app.com. If the parties find no solution, the Customer may close its account before the change applies.

Data subjects' rights

LeanOS helps the Customer, through appropriate technical and organisational measures and as far as possible, to answer requests from data subjects (Articles 12 to 23 GDPR). In LeanOS each user can download their own data ('Download my data' in the profile) and delete their account. A request about Customer Data that reaches LeanOS directly is passed to the Customer without undue delay; LeanOS does not answer it on the Customer's behalf unless instructed to.

Impact assessments and other assistance

Taking into account the nature of the processing and the information available to it, LeanOS helps the Customer meet its obligations under Articles 32 to 36 GDPR: security, breach notification, data protection impact assessments and prior consultation with the supervisory authority. It does so with the information in this DPA and any further information about the processing that the Customer reasonably asks for.

Personal data breaches

LeanOS notifies the Customer without undue delay after becoming aware of a personal data breach affecting Customer Data, by email to the Customer's administrators. The notice describes, as far as is then known, the nature of the breach, the categories and approximate number of data subjects and records concerned, the likely consequences, and the measures taken or proposed; what is not yet known follows as soon as it is. LeanOS takes reasonable steps to contain the breach and limit its effects. Notifying the supervisory authority and the data subjects remains the Customer's decision, as controller.

Deletion or return at the end

Return: until the end, the Customer's users can export their projects, and each user their own data, from LeanOS.

Cancelling a subscription deletes nothing: the company moves to the free plan, as the terms explain. When the Customer asks for its company and its content to be deleted (support@leanos-app.com), or when the last member of a company deletes their account, LeanOS deletes the company and the Customer Data from the live database within 30 days. EU or Member State law may require some data to be kept longer.

Backups: database backups expire on their own (the database provider's daily backup after 7 days, LeanOS's own hourly copies after 7 days and daily copies after 30 days), so deleted data is gone from them within 30 days of its deletion. Copies of uploaded files in LeanOS's off-platform file backup follow the same rule: a file deleted from LeanOS is set aside in that backup and removed within 30 days; when LeanOS deletes the company, it also removes the Customer's files from that backup.

Any copy that remains until then stays covered by this DPA.

Audits and information

LeanOS makes available to the Customer the information needed to demonstrate compliance with Article 28 GDPR. Where that information is not enough, the Customer, or an independent auditor it appoints who is bound by confidentiality, may audit the processing: on at least 30 days' written notice, during business hours, without disrupting the service or seeing other customers' data, and at the Customer's cost. Audits are limited to one a year, unless a supervisory authority requires otherwise or a personal data breach has occurred.

Liability

Each party's liability under this DPA is subject to the limitation of liability in the terms of service, as far as the GDPR and other applicable law allow. Nothing in this DPA limits either party's liability to data subjects under Article 82 GDPR.

Governing law

This DPA is governed by Spanish law. Disputes will be resolved in the courts of Spain, as under the terms of service.

Changes to this DPA

LeanOS may update this DPA to reflect changes in the law or in the service. A material change is announced in the same way as a change to the terms, and the 'Last updated' date above changes with it.

Annex — Security measures

Hosting in the EU: the database, sign-in and file storage run at Supabase in Frankfurt; the application runs at Railway in its EU region (Amsterdam).

Encryption in transit: every connection to LeanOS uses HTTPS, and browsers are told to use HTTPS only (HSTS).

Access control in the database: row-level security is on for every table, so each user reaches only the data of the companies and projects they belong to. Within a company, the Customer's administrators decide who has access and with which role.

Sign-in: passwords are stored only as hashes. A session ends after 30 days without use and after 90 days at most, and the reuse of a stolen refresh token is detected and the session revoked.

Application protections: a Content Security Policy is enforced, other sites cannot embed LeanOS in a frame, and requests that change data are rate-limited.

Keys: the database administration key is used only on the server, never in the browser.

Backups: the database provider keeps a daily backup for 7 days. LeanOS also keeps its own copies at a separate provider (Cloudflare R2), in a private bucket reached with separate credentials: one scheduled every hour and kept 7 days, and one a day kept 30 days. Older copies are deleted automatically.

Automatic deletion: retention rules run every night and delete the data whose period has ended.

AI: text goes to the AI provider only when a user uses an AI feature, through its API, which does not use it to train models.

Separate environments: development and testing run on their own databases, apart from production.

Contact

Questions, requests or to exercise your rights — write to support@leanos-app.com.