1 Who We Are & How to Contact Us

leanDeals is a CRM platform operated by Apiwave s.r.o., a company incorporated under the laws of the Czech Republic.

For all privacy-related enquiries, requests, or complaints, please contact us at info@lean-deals.com. We will respond within 30 days.

2 Scope of This Policy

This Privacy Policy explains how leanDeals collects, uses, stores, and shares personal data when you:

• Visit our website at app.lean-deals.com;
• Register for or use the leanDeals Service;
• Communicate with us by email or other means;
• Connect third-party services (such as email accounts) to the Service.

This Policy does not cover data that Clients process within the Service about their own customers or contacts — that is addressed in our Data Processing Agreement (DPA), which governs our role as a data processor acting on your instructions.

3 Our Role: Controller vs. Processor

3.1 leanDeals as Data Controller

When we collect and process data about you directly — such as your account registration data, billing information, and usage data — we act as the data controller. This Privacy Policy describes our practices in that capacity.

3.2 leanDeals as Data Processor

When you use the Service to store, manage, and process data about your own contacts, customers, or employees (i.e., "Client Data"), we act as a data processor on your behalf. As a processor, we process Client Data solely according to your instructions as set out in our Data Processing Agreement (DPA).

3.3 Data Processing Agreement

If you are subject to the GDPR as a data controller and use leanDeals to process Personal Data on your behalf, a Data Processing Agreement (DPA) is available upon request. Please contact info@lean-deals.com to obtain the DPA.

4 Personal Data We Collect

4.1 Account & Registration Data

4.2 Billing & Payment Data

Payment processing is handled by Paddle as Merchant of Record. We do not store full credit card numbers or bank account details. We receive from Paddle: subscription status, invoice history, billing contact name, and the last four digits of your payment card for display purposes only.

4.3 Usage & Technical Data

4.4 Email Integration Data

If you enable the email integration feature, we process email metadata as described in Section 6.

4.5 Communications Data

If you contact us via email, chat, or other means, we retain records of those communications to handle your enquiry and improve our support.

4.6 Special Categories of Data

We do not intentionally collect special categories of personal data (such as health data, racial or ethnic origin, political opinions, religious beliefs, or biometric data). Please do not store such data in the Service.

5 How We Use Your Data & Legal Basis

Where we rely on legitimate interests (Art. 6(1)(f)), we have assessed that our interests are not overridden by your rights and freedoms. You may object to such processing at any time — see Section 10.

6 Email Integration & Data Processing

6.1 How It Works

The optional email integration feature enables you to connect your Gmail (via Google OAuth 2.0), Microsoft Outlook (via Microsoft OAuth 2.0), or other email accounts (via IMAP/SMTP) to leanDeals to synchronise email activity with your CRM records.

6.2 What We Process

We process the following email metadata when the integration is active:

• Sender and recipient names and email addresses;
• Email subject line;
• Date and time of email;
• A short text snippet (up to ~300 characters);
• Attachment name and size (content is not stored);
• Unique message identifiers (for deduplication and threading).

We do not store full email body content.

6.3 Legal Basis

The email integration operates under Art. 6(1)(b) (contract performance) for the account holder, and you, as data controller, are responsible for having a valid legal basis to process the email data of third parties (e.g., your contacts) whose email addresses appear in the synced emails.

6.4 OAuth Tokens

OAuth access tokens and refresh tokens for Gmail and Outlook are stored in encrypted form in our database. We use these tokens solely to fetch email metadata on your behalf. You can revoke access at any time through your Google or Microsoft account settings, or by disconnecting the integration in leanDeals.

6.5 IMAP Credentials

IMAP usernames and passwords are stored in encrypted form. You are responsible for using appropriate app-specific passwords and for reviewing your email provider's policies regarding IMAP access.

6.6 Google API Disclosure

leanDeals's use of information received from Google APIs will adhere to the Google API Services User Data Policy, including the Limited Use requirements.

7 Who We Share Your Data With

We do not sell your personal data. We share your data only with trusted third-party service providers ("sub-processors") who assist us in delivering the Service, subject to contractual data protection obligations. Our sub-processors fall into the following categories:

We may also disclose your data: (i) when required by law, court order, or regulatory authority; (ii) to protect the rights, property, or safety of leanDeals, its users, or the public; (iii) in connection with a business transfer, merger, or acquisition (with notice provided to affected users).

8 International Data Transfers

Our primary infrastructure is hosted in the European Union. Where any data transfer occurs outside the EU/EEA (for example, in connection with our CI/CD pipeline provider), we ensure appropriate safeguards are in place in accordance with GDPR Chapter V, including:

• Standard Contractual Clauses (SCCs) approved by the European Commission; and/or
• Transfers to countries with an EU adequacy decision.

If you consent to marketing cookies (see 11.3), a limited set of data about your website visit is additionally shared with three recipients in Ireland — Google Ireland Limited, Microsoft Ireland Operations Limited and Meta Platforms Ireland Limited — and may be onward transferred to their parent companies in the United States (Google LLC, Microsoft Corporation, Meta Platforms, Inc.). Those transfers rely on the European Commission's adequacy decision for the EU-US Data Privacy Framework, in which all three are certified participants, supplemented by Standard Contractual Clauses. Without your consent none of these transfers takes place.

You may request more information about the specific safeguards applicable to any international transfer by contacting us at info@lean-deals.com.

9 Data Retention

After the applicable retention period, data is permanently and securely deleted from our systems, including backups.

10 Your Rights under GDPR

If you are located in the European Union or European Economic Area, you have the following rights with respect to your personal data that we process as a data controller:

How to Exercise Your Rights

To exercise any of these rights, please contact us at info@lean-deals.com. We will respond within 30 days (extendable by two additional months for complex requests, with prior notice). We may request identity verification before processing your request.

11 Cookies & Tracking

11.1 Essential cookies

We need the following cookies to operate the Service and this website. They do not require your consent, because the Service would not work without them, and they cannot be switched off:

11.2 First-party analytics — only with your consent

We measure how visitors move through our website and signup so we can improve them. We collect this data ourselves, on our own infrastructure, and share it with no third party. We store the event name, timestamp, page address, traffic source (UTM parameters) and a random identifier held in your browser (ld_anon_id).

We do not store your IP address. It is immediately replaced with an irreversible salted SHA-256 hash used solely for abuse protection.

Legal basis. This measurement runs solely on the basis of your consent under Art. 6(1)(a) GDPR and Section 89(3) of Czech Act No. 127/2005 Coll., on Electronic Communications. Until you give consent, the measurement script does not load at all. Data is retained for 24 months. If you withdraw consent, we delete the stored identifiers from your browser.

11.3 Google Tag Manager, advertising measurement and session recording

Our website uses Google Tag Manager. It is a single script, but it runs tools belonging to three different companies:

Without your consent not one of them loads. The Google Tag Manager code on the page stays blocked until you choose "Accept all" in the cookie bar or enable the "Marketing and behaviour analytics" category. Until then we send Google, Microsoft and Meta no data whatsoever, including your IP address.

Nothing loads from a foreign domain before you decide. The font and the CSS framework this site uses are hosted on our own server, precisely so that merely rendering the page does not announce you to anyone. The only request that leaves before you decide goes to our own domain, and it is the record of your choice described in 11.5.

On session recording specifically. Clarity records how you move around the page and makes that recording available to us for replay. Consenting to "Marketing and behaviour analytics" includes this — if you would rather not be recorded, leave that category off, or switch it off at any time. The rest of the site works exactly the same.

Third-party cookies. If you consent to marketing, Microsoft sets cookies on its own domains (MUID, MR, SRM_B, ANONCHK and SM on clarity.ms and bing.com). Those are not ours and we cannot delete them for you — refusing stops them being set again, and you can clear them in your browser settings. The cookies created on our own domain (_ga, _ga_JT1PQL0BTN, _fbp, _clck, _clsk) we delete ourselves when you withdraw consent.

If you do consent, these companies may process your IP address, cookie identifiers, browser information and details of how you move around our website. Towards Google we use Google Consent Mode v2, which passes your current choice as four separate signals, so changing your settings immediately changes the scope of processing. Clarity and the Meta Pixel have no such continuous signal — with them, what matters is that they never start without consent.

The legal basis is your consent under Art. 6(1)(a) GDPR and Section 89(3) of the Electronic Communications Act. You may withdraw consent at any time (see 11.4); withdrawal does not affect the lawfulness of processing carried out before it.

Transfers outside the EU. Google Ireland Limited may transfer data to Google LLC in the United States. The transfer relies on the European Commission's adequacy decision for the EU-US Data Privacy Framework, in which Google LLC is a certified participant, supplemented by Standard Contractual Clauses. See the Google Privacy Policy for details.

11.4 Managing and withdrawing consent

You can change your choice at any time via the "Cookie settings" link in the footer of any page. This opens a dialog where you can switch individual categories on or off. Withdrawing consent is as easy as giving it.

You can also control cookies through your browser settings. Disabling essential cookies may affect the functionality of the Service.

11.5 Record of your decision

Whenever you make a choice in the cookie bar — consent, refusal, or a later change — we store a record of it on our own server. We have to be able to demonstrate that we asked and what you answered; this is required by Art. 7(1) GDPR and by Google's EU User Consent Policy. A cookie sitting in your own browser, which you can clear at any time, is not evidence of anything.

What the record contains: the random consent identifier that is also stored in your cc_cookie; the time of the decision; which categories you allowed and which you refused; the version of the banner wording you saw; the language; the address of the page you decided on; browser information; and an irreversible salted SHA-256 hash of your IP address. We do not store your IP address.

What it does not contain: any identifier from our traffic measurement. The proof of consent and the data about how you move around the site are kept apart and never joined — otherwise a legal obligation would turn into surveillance.

The legal basis is not consent but our legal obligation and legitimate interest in being able to demonstrate it, under Art. 6(1)(c) and (f) read with Art. 7(1) GDPR. That is why a record is created even when you refuse everything. We keep it for 3 years from the decision — longer than the consent itself (6 months), because the evidence has to outlive any dispute it might be needed for. After that it is deleted automatically.

12 Children's Privacy

The Service is not intended for, and must not be used by, individuals under the age of 18. We do not knowingly collect personal data from individuals under 18. If we become aware that we have inadvertently collected personal data from a minor, we will delete it promptly. If you believe a minor has provided us with personal data, please contact us at info@lean-deals.com.

13 Security

We implement industry-standard technical and organisational measures to protect your personal data, including:

• All data in transit is encrypted using TLS 1.2+;
• Data at rest is encrypted using AES-256 where supported;
• Database-level Row Level Security (RLS) ensures strict data isolation between Workspaces;
• OAuth tokens and IMAP credentials are stored in encrypted form;
• Access to production systems is strictly controlled and limited to authorised personnel;
• We conduct periodic security reviews of our infrastructure and dependencies.

Despite these measures, no system is completely secure. In the event of a personal data breach affecting your rights and freedoms, we will notify you and the relevant supervisory authority in accordance with GDPR Articles 33 and 34 (within 72 hours of becoming aware, where feasible).

14 Changes to This Policy

We may update this Privacy Policy from time to time to reflect changes in our practices, the Service, or applicable law. When we make material changes, we will notify you by email or by a prominent notice within the Service at least 30 days before the changes take effect.

The "Effective date" at the top of this document indicates when this version took effect. Your continued use of the Service after the effective date constitutes acceptance of the updated Policy.

For any privacy-related questions, please contact us at info@lean-deals.com.