Privacy Policy

This policy explains how LeanLift OÜ ("LeanLift", "we", "us") handles personal data when you visit leanlift.ai, contact us, work with us, or use our LeanLift CMS product. We follow the EU General Data Protection Regulation (GDPR) and Estonian data protection law.

1. Who is responsible for your data

LeanLift OÜ is the data controller for the processing described in this policy.

• Registry code: 17272033
• VAT number: EE103024488
• Address: E. Vilde tee 91-63, 12911 Tallinn, Estonia
• Email: hello@leanlift.ai
• LeanLift CMS support: support@leanlift.ai

2. What this policy does not cover

This policy does not cover the websites and apps we build for clients. Each client is responsible for the personal data of its own users. Section 10 explains our role when we handle that data on a client's behalf.

3. The data we collect

When you visit this website

Our hosting and network providers automatically process technical data needed to deliver the site and keep it secure. This can include your IP address, browser and device type, the page requested, the referring page, and the date and time of the request. We also collect visit and page speed statistics, as described in section 5.

When you contact us

We receive your name and email address, along with your company, your message, and anything else you choose to tell us about your project. If we speak on a call, we also keep our notes from it.

When you become a client

We process business contact details, billing and tax details, contracts, project communications, and the access details needed to work on your accounts and systems.

4. Why we use your data, and our legal basis

• To run and secure this website: our legitimate interest in keeping the site available and safe.
• To understand and improve this website: our legitimate interest in measuring visits and page speed.
• To answer enquiries and prepare quotes: the steps you ask us to take before a contract, or our legitimate interest in responding to business enquiries.
• To deliver projects, provide support and invoice you: performance of our contract with you or your company, or our legitimate interest in working with the people at our client companies.
• To meet accounting, tax and other legal duties: compliance with a legal obligation.
• To establish or defend legal claims: our legitimate interest in protecting our rights.
• To send marketing emails, if we ever do: your consent where the law requires it. You can opt out at any time.

We do not make decisions about you using solely automated processing that have legal or similarly significant effects.

5. Cookies and analytics

This website uses analytics providers and a performance monitoring provider to show us how the site is used and how fast it loads. They work without cookies and record pages visited, referring page, link parameters, approximate location, browser, operating system, device type, network speed, page speed measurements, clicks on our quote and contact buttons, clicks on links to other websites and the time of the event. We see this as statistics and as the steps within a visit, not tied to your name or email address. To recognize a visit, the analytics providers create a temporary identifier from the incoming request and a secret value that changes every day. It is not used to follow you across other companies' websites, but it can connect your visits to this website and LeanLift CMS during the same day.

This website does not use advertising cookies or tracking pixels, and it does not set cookies of its own. Its fonts are served from our own site. If this changes, we will update this policy first and ask for your consent where the law requires it.

Links to other websites, such as LinkedIn, take you to services with their own privacy practices, which we do not control.

6. Who we share data with

We do not sell your personal data. We share it only with:

• service providers that work for us, such as hosting, email, video call, accounting and payment providers;
• subcontractors and professional advisers, such as accountants and lawyers, who are bound by confidentiality duties;
• authorities, courts and others when the law requires it, or when needed to protect our rights, investigate wrongdoing, or protect people's safety; and
• a buyer or successor if our business is reorganised or sold, under appropriate confidentiality protections. We will tell you before your data becomes subject to a different privacy policy.

Service providers may use the data only to perform work for us, not for their own purposes. You can ask us for a current list of our main service providers.

7. Transfers outside the EEA

Some providers may process data outside the European Economic Area. When they do, we rely on a safeguard recognised by the GDPR, such as a European Commission adequacy decision or the Commission's standard contractual clauses. Contact us for more information about these safeguards.

8. How long we keep data

• Enquiries that do not become projects: up to 24 months after our last contact.
• Client and project records: for the length of our relationship, then for as long as they may be needed for legal claims.
• Accounting records: for 7 years, as required by Estonian accounting law.
• Technical logs: only for the limited period needed for security and troubleshooting.
• System access details: removed or revoked when we no longer need them for the work.

9. How we protect data

We use technical and organisational measures appropriate to the risk, including encrypted connections and restricting access to people who need it. No system is completely secure, so we cannot guarantee absolute security. If a breach is likely to put your rights at risk, we will notify you and the authorities as the law requires.

10. When we handle data for our clients

While building, fixing or hosting a product, we may have access to personal data belonging to a client's users. In that case the client is the controller and we act as its processor. We handle that data only on the client's instructions and under a data processing agreement. If you are a user of one of our clients' products, please contact that client first.

11. LeanLift CMS

This section applies when you use LeanLift CMS, including its product website and dashboard. The rest of this policy also applies.

Data we collect

• Account details: your name, email address and, if you sign in with Google or GitHub, your provider ID. We use these to create your account, sign you in and give you access to your workspaces. We also use them to provide support and tell you about changes to the product. Our legal basis is our contract with you.
• Device and usage data: your IP address, device and browser type, operating system, and diagnostic and security logs. We use these to keep the product running and secure, and to find and fix technical problems, based on our legitimate interests.
• Workspace content: posts, tags, media and other content you create or upload, which we need to provide the CMS. If it includes other people's personal data, you are the controller of that data and we act as your processor.
• Billing: plan and payment status. Payments are handled by our payment provider, Polar, and we do not store your card details.
• Analytics: page views, timestamps, browser information, anonymous visitor and session IDs, clicks on links to other websites, sign-up actions and the account ID of a completed sign-up. We use these to monitor performance and understand which pages lead to registration, based on our legitimate interests or your consent where the law requires it. We do not send your email address or page content to analytics.

AI features

When you use an AI feature, the relevant workspace content is sent through our AI infrastructure providers to generate a response. We do not use your data to train external AI models without your consent.

Analytics and cookies

We use third-party analytics providers that process this data on our behalf. You can ask us which providers we currently use. The dashboard uses a cookie to keep you signed in. During sign-up we store an anonymous analytics ID in a first-party cookie for ten minutes, so we can connect a sign-up to the visit that led to it. We also store your timezone in a cookie during sign-up to set up your workspace. Other cookies remember preferences, such as your last visited workspace and whether the editor panel is open. None of these cookies contains your email address.

You can block or delete cookies in your browser settings, but parts of the product, including signing in, may stop working. We do not currently respond to browser Do Not Track signals.

How long we keep it

• Account data: for as long as your account is active.
• Workspace content: until you delete it or ask us to.
• Analytics data: only as long as needed to monitor performance.

You can update your details and delete your account in your account settings. To request deletion or ask about your data, email support@leanlift.ai.

12. Invoicing, CRM, payments and financial features

This section applies if you use invoicing, customer management, bank connection, transaction, payment, accounting or similar features in one of our software products. These features are for people aged 18 or over.

Data involved

• Invoices and customer records: customer names and contact details, company and tax details, invoice items, amounts, payment status, notes and communication history.
• Bank and transaction data: account names and identifiers, balances, transaction details and categories, from the banks or data providers you connect or from your own entries. We do not ask for your online banking password. Connections are made through the bank or a licensed provider.
• Payments: payment amounts, status and references. Licensed payment providers handle card details and any identity, fraud and anti-money-laundering checks they must carry out, as described in their own privacy notices.
• Documents: receipts, invoices and attachments you upload or import from accounts you connect.

Who is responsible

You are the controller of personal data about your customers, contacts and employees that you put into these features, and we are your processor. We are the controller of your account and billing data, and of data we must keep to meet our own legal obligations. Customers and contacts of our users should contact that user first.

Why we use it, and who receives it

We use this data to provide the features you ask for, based on our contract with you, and to detect fraud and secure the service, based on our legitimate interests or legal obligations. We share it with the banks, data providers, payment providers, accounting systems and other services you choose to connect, and with the service providers that support these features. We do not sell it or use it for advertising, and we do not use it to train external AI models without your consent.

Connected Google accounts

If you connect a Google account to import documents, our use of data from Google APIs follows the Google API Services User Data Policy, including its Limited Use requirements. We use Gmail data only to find and extract relevant documents, such as invoices and receipts, for you. We do not use it to develop, improve or train generalised AI or machine learning models, sell it, or use it for advertising.

How long we keep it

We keep this data while your account is active or until you delete it or disconnect the source. After that we delete it, unless the law requires us to keep it longer. You are responsible for keeping your own accounting records for as long as the law requires, so export them before you close your account.

13. Your rights

Under the GDPR, you have the right to:

• access your personal data and receive a copy;
• correct inaccurate data;
• have your data deleted in certain circumstances;
• restrict how we process your data in certain circumstances;
• object to processing based on our legitimate interests, and to direct marketing at any time;
• receive your data in a portable format, where this applies; and
• withdraw consent at any time, where we rely on it. This does not affect processing that took place before you withdrew.

To use any of these rights, email hello@leanlift.ai. We normally reply within one month and may need to confirm your identity first.

You can also complain to the Estonian Data Protection Inspectorate (Andmekaitse Inspektsioon) or to the data protection authority in the EU country where you live or work.

14. Children

Our website and services are intended for businesses and adults. LeanLift CMS is not for anyone under 16, and financial features are not for anyone under 18. If you believe a child has given us personal data, please contact us and we will delete it.

15. Changes to this policy

We may update this policy when our practices or the law change. We will change the date at the top of this page. For significant changes, we will tell our clients directly and notify product users by email or in the product before the changes take effect.

16. Contact

For questions about this policy or your data, email hello@leanlift.ai. See also our Terms of Service.