Privacy Policy

What this policy covers

It applies to the Leanlift web application, related APIs, and emails we send about the product. It does not apply to third-party sites or apps that we link to, including your bank’s website or an accounting system you export to.

Defined terms in our Terms of Service have the same meaning here unless this policy says otherwise.

Information we collect

Bank connections and payment-account data

Leanlift can retrieve payment-account information after you explicitly authorise a connection with your bank. We use licensed account-information services to do this, including Enable Banking. You authenticate with your bank (or another account-servicing payment service provider). We do not receive your online-banking password.

Depending on what you approve and what your bank makes available, we may receive account holder name, account identifiers, balances, transaction history, and related metadata. We use that information only to provide Leanlift to you: to display accounts, categorise activity, match documents, produce insights, and keep your books current.

We do not sell payment-account data. We do not use it to advertise third-party products. We do not share it with unrelated parties. Enable Banking and similar aggregators process the connection as technical providers so we can request the data you authorised. Their notices are presented during the bank-connection flow.

You can disconnect a bank in Leanlift at any time. After disconnection we stop fetching new data. Records already imported may remain in your workspace until you delete them or close the account, unless a legal obligation requires us to keep them longer.

Google account data

If you connect Gmail or another Google account, we access Google user data only to operate Leanlift for that connection. Our use of information received from Google APIs follows the Google API Services User Data Policy, including Limited Use.

We do not use Google Workspace data, including Gmail content, to develop, improve, or train generalized artificial-intelligence or machine-learning models. Gmail access is limited to finding invoices, receipts, and similar financial documents so we can help you capture them in Leanlift. That data is not sold and is not used for advertising.

How we use information

We process personal data to:

• create and administer your account and workspace
• deliver the product features you request
• connect banks, inbox providers, and accounting tools you enable
• bill subscriptions and send related notices
• provide support and respond to data-protection requests
• secure the service, prevent abuse, and repair faults
• improve reliability and understand how the product is used
• send product updates or optional marketing, which you can stop using the unsubscribe link in those emails

Legal bases (GDPR)

If the GDPR or the Estonian Personal Data Protection Act applies, we rely on one or more of the following bases, depending on the processing:

• performance of our contract with you, including providing Leanlift
• your consent, for example when you authorise a bank or Google connection
• our legitimate interests in operating, securing, and improving the product, where those interests are not overridden by your rights
• processing needed to take payment and keep accounting records
• compliance with a legal obligation

You may withdraw consent where processing is based on consent. That does not affect processing already carried out.

Cookies

We store cookies and similar identifiers on your device so you can stay signed in, remember preferences such as theme, and protect against misuse. You can block cookies in your browser. Some parts of Leanlift will not work without session or security cookies.

Who we share data with

We share personal data with service providers who help us run Leanlift. They may process data only for that work and must keep it confidential. Categories include hosting and database providers, email delivery, error monitoring, analytics, customer support tools, and the bank-connection and payment providers described below.

We may also disclose information if:

• the law or a competent authority requires it
• we need to protect Leanlift OÜ, our users, or the public from harm or fraud
• we transfer the business in a merger, acquisition, or asset sale, in which case we will notify you before your data becomes subject to a different policy

How long we keep data

We keep personal data for as long as your account is active and as long as we need it for the purposes in this policy. After you close your account we delete or anonymise data unless we must retain it to meet accounting, tax, dispute, or other legal requirements.

Technical logs are usually kept for a shorter period, unless we need them longer to investigate security incidents or to keep the product working.

Where data is processed

We operate from Estonia. If you access Leanlift from another country, your information will be transferred to and processed in Estonia, and may be processed in other countries where our providers host infrastructure.

We only transfer personal data outside the EEA where appropriate safeguards exist, such as an adequacy decision or standard contractual clauses, together with the security measures described below.

Security

We use commercially reasonable technical and organisational measures to protect personal data, including encryption in transit, access controls, and least-privilege practices for staff and systems. No internet transmission or hosted storage is completely secure, so we cannot promise absolute security.

Your rights

If you are in the EEA, you can ask us to access, correct, delete, or restrict personal data we hold about you, object to certain processing, and receive a copy of data you provided in a commonly used machine-readable format. You can often update or delete information yourself in account settings. Otherwise email leasing@barrister-suites.com. We may need to verify your identity first.

You may lodge a complaint with a supervisory authority. In Estonia that is the Data Protection Inspectorate (Andmekaitse Inspektsioon).

Children

Leanlift is built for businesses and adults. We do not knowingly collect personal data from anyone under 18. If you believe a child has given us data, contact us and we will delete it.

Do Not Track

Some browsers send a Do Not Track signal. Leanlift does not currently change its behaviour in response to that signal. You can still control cookies through your browser settings.

Third-party sites

Leanlift may contain links to other websites. Their privacy practices are their own. Read their policies before you provide information there.

Changes

We may update this policy. The “Last updated” date at the top will change when we do. For material changes we will also notify you by email or an in-product notice before the new version takes effect, unless a shorter period is required by law. Continued use of Leanlift after the effective date means the updated policy applies.

Contact

Controller and data-protection contact:

• Leanlift OÜ, registry code 17272033
• E. Vilde tee 91-63, Mustamäe linnaosa, Tallinn, 12911, Estonia
• leasing@barrister-suites.com