Privacy policy

Who we are

The data controller for the data described below is Centre Educatiu del CAD CAM, SL, the Spanish limited company that runs LeanOS. Tax ID (CIF): B62582945. Registered address: Avinguda Antoni Gaudí 15, Local 2, 08840 Viladecans (Barcelona), Spain. Contact: support@leanos-app.com.

Data we collect

Account: name, email, role, language preference, password hash, sign-in timestamps.

Project data: information you enter (charter text, KPIs, projects, milestones, actions, files).

Usage: anonymous events to understand product usage — only if you opt in to analytics cookies.

Billing: billing name, tax ID, address, email and the amounts charged, kept in Holded to issue invoices. Card payments are processed by Stripe; we never receive or store your card details.

Coaching sessions

If you take the coaching test, nothing is stored while you answer it — the answers live in your browser and disappear with the tab.

When you ask for a session, and only then, we store what you type in the form (name, email, company if you give one, availability, your message) together with the answers you ticked and the track they produced. We use them for one thing: to prepare your first session and to arrange it with you. Legal basis is the steps taken at your request before a contract (art. 6.1.b GDPR).

The test asks only about your work situation. Do not send us health information through it — we do not ask for it, we do not need it, and coaching is not a health service.

We keep a request for as long as the coaching relationship lasts and for up to two years after the last session, in case you come back; you can ask us to delete it sooner at support@leanos-app.com. If you never book, we delete it within one year.

These answers are not shared with anyone, including an employer paying for your sessions.

Inside your coaching space, your coach gets an email notice when you write, with a link and without the text of your message. When AI tools help your coach prepare a session, they are sent without your surname or your company's name. If you delete your account, your coaching case is anonymised: your messages, notes and answers are deleted, and only the dates and the number of sessions remain.

DISC behavioural assessment

The DISC assessment is a questionnaire about your behavioural style at work. You fill it in only when LeanOS sends you an invitation link.

What we store: your name, email, company if you give one, your answers, your scores and a report written by AI.

Why, and legal basis: to produce your report. The legal basis is your consent (Art. 6(1)(a) GDPR), which you can withdraw at any time by writing to support@leanos-app.com.

Who sees it: the LeanOS team. The report is also emailed to our support mailbox.

AI processing: your answers are sent to OpenAI to write the report (see 'Sharing and sub-processors').

How long we keep it: as set out under 'Retention'.

Contact forms and proposals for companies

When you write to us through the website's contact form or ask for a coaching proposal for your company, we keep what you write: name, email, company if you give it, your message, the language and which form it came from. We use it only to answer you and, if you ask, to prepare the proposal.

Legal basis: steps you ask us to take before a contract (Art. 6(1)(b) GDPR) when you ask for a proposal; our legitimate interest in answering whoever writes to us (Art. 6(1)(f)) for other messages.

The LeanOS team reads it. We answer by email from support@leanos-app.com.

We keep the message for 24 months after we receive it, unless it leads to a contract (then, as that contract says). You can ask us to delete it sooner at support@leanos-app.com.

Why we process it

To provide and operate the service, secure your account, deliver AI assistance you request, comply with legal obligations (tax, accounting), and improve the product.

Legal basis

Contract (Art. 6(1)(b) GDPR) for service delivery. Legal obligation (Art. 6(1)(c)) for accounting. Consent (Art. 6(1)(a)) for analytics and marketing cookies. Legitimate interest (Art. 6(1)(f)) for security logs and anti-fraud.

Sharing and sub-processors

We use the following service providers (processors). Each processes personal data only on our instructions and only for the task listed:

Supabase — database, sign-in and file storage. Data is hosted in the EU (Frankfurt). Supabase Inc. is a US company: EU Standard Contractual Clauses (SCCs).

Railway — runs the application, in its EU region (Amsterdam). Railway Corp. is a US company: SCCs.

Arsys Internet S.L.U. (Spain) — sends our emails and hosts our support mailbox.

Resend — backup email sending, used only when it is active. US company: SCCs.

Stripe — payments. Stripe Payments Europe (Ireland); Stripe Inc. (US): SCCs / EU–US Data Privacy Framework.

Holded Technologies S.L. (Spain) — invoicing and accounting: billing name, tax ID, address, email and the amounts charged.

OpenAI — AI features, only when you use them. US company: SCCs. Data sent through its API is not used to train models.

Cloudflare — encrypted storage of database backups, and the job that schedules them. US company: SCCs / EU–US Data Privacy Framework.

GitHub — runs the hourly backup job; the backup passes through GitHub's servers in the US: SCCs / EU–US Data Privacy Framework.

We also share data with one recipient that is not our processor: Desarrollos Informaticos y de Mecanizados, SL (SAMEC), tax ID (CIF) B63107882, a separate company that provides the engineering services. When you request an engineering budget, we send SAMEC your name, email, company, the project and task details and your message, so that it can prepare a quote. Legal basis: steps taken at your request before entering into a contract (Art. 6(1)(b) GDPR).

We do not sell personal data.

International transfers

Several of the providers listed above are US companies, and some process personal data in the US. Each transfer outside the EEA relies on the safeguard shown next to that provider, with supplementary measures as required by Schrems II. We may change infrastructure providers; this policy is updated when we do.

Retention

We keep each type of data only for as long as we need it:

Account data: while your account exists. What happens when you delete it is set out under 'Deleting your account' below.

Project content, including AI chats in a project: while the project exists. It is deleted with the project.

Project invitations: deleted 90 days after they are sent if never accepted, or 30 days after they are sent if cancelled.

Contact form messages: deleted 24 months after we receive them.

Waitlist sign-ups: deleted 24 months after you sign up.

DISC behavioural assessments that are never completed: deleted 12 months after the link expires, or 12 months after the invitation if it was revoked. Completed results: deleted 2 years after completion.

Coaching: while the coaching relationship lasts and for up to 2 years after the last session. A request that never led to a session: 1 year.

Support tickets: while your account exists.

Engineering budget requests, expert requests and company invitations: kept as company records while the company exists.

Invoices: kept in Holded, our invoicing service. Spanish law requires them to be kept for 6 years.

Backups: daily backups are kept for 7 days, and daily copies kept off-platform for up to 30 days; after that they are overwritten.

Security logs and rate limits: short rolling windows, from a few minutes to an hour, plus our hosting provider's request logs.

Scheduled deletions run automatically every night.

Deleting your account

You delete your account yourself, from your profile. Your profile, sign-in details, AI chat messages and support tickets are deleted at once. Work you created inside your organisation stays with the organisation, with your name removed.

In two cases deletion is refused until you act: if you are the last admin of an organisation that has other people in it (name another admin first), or if your company's subscription is still running and you would leave it behind (cancel it first, from Manage billing).

If you were the only member of your organisation, the organisation is marked for deletion and our team removes it.

Copies in backups expire as set out under 'Retention'.

Your rights

Access, rectification, erasure, restriction, portability, and objection. You also have the right to lodge a complaint with your supervisory authority (e.g. AEPD in Spain, CNIL in France).

How to exercise your rights

Write to support@leanos-app.com with the subject 'GDPR request'. We respond within 30 days as required by Art. 12(3) GDPR.

Changes to this policy

We will publish material changes on this page and update the 'Last updated' date. Significant changes will be notified by email.

Contact

Questions, requests or to exercise your rights — write to support@leanos-app.com.