LeanSuite Privacy Policy

Your privacy is critically important to us at LeanSuite.com Corp. ("LeanSuite," "we," "us," or "our"). This Privacy Policy explains how we collect, use, share, and protect information when you use our web application, websites, and related services (collectively, the "Platform").

This policy applies to any user of the Platform, whether you are a company, an individual employee, or any other authorized user ("you" or "your").

By accessing or using our Platform, you agree to the terms of this Privacy Policy and our Terms of Service. If you do not agree with these terms, please do not access or use the Platform.

1. Our Role: Controller and Processor

LeanSuite handles personal information in two distinct roles, and your rights depend on which applies.

As a processor (service provider). When your employer or another organization subscribes to the Platform and you use it as an authorized User, that organization decides what information is entered into the Platform and how it is used. We process that information on their instructions under our customer agreement. If you are an employee User and want to access, correct, or delete information held in your employer's LeanSuite workspace, please contact your employer directly. If you contact us instead, we will refer your request to them and support them in responding.

As a controller. We act as a controller for information we collect for our own purposes — website visitors, prospective customers, marketing and sales contacts, account administrators and billing contacts, support enquiries, and our SMS messaging program. Sections 5 and 6 below apply to this information.

2. Information We Collect

2.1. Information You Provide Directly to Us

Account and Profile Information: When you register for an account, we collect your name, email address, password, phone number, job title, and, where applicable, physical address. If you are a company, we may also collect information about your business and payment details.

Mobile Phone Number: We collect your mobile phone number when you provide it on a web form, during account setup, or in the course of a scheduled call. How we use it, and the strict limits on sharing it, are set out in Section 4.

User Content: We collect the information you post to the Platform, such as suggestions, Kaizen event details, comments, reviews, photos, and other interactive content.

Images and Video (Vision AI): Where your organization has enabled Vision AI or similar image-based features, the Platform processes images or video captured from equipment and work areas that your organization supplies or configures. Your organization determines what is captured, for what purpose, and for how long it is retained, and is responsible for providing any notice to, or obtaining any consent from, affected workers required by applicable workplace, privacy, or biometric information laws. LeanSuite does not use this content to identify individuals and does not generate biometric identifiers from it.

Communications: If you contact us directly, we may receive additional information about you. We also store communications between you and other users that occur on the Platform.

2.2. Information We Collect Automatically (Usage Data)

Log and Usage Data: Our servers automatically collect information when you access or use our Platform and record it in log files. This data may include your IP address, browser type, operating system, referring URLs, pages viewed, and timestamps.

Cookies and Similar Technologies: We use cookies to operate and administer our Platform and to improve your experience. A "cookie" is a piece of information sent to your browser that allows our Platform to remember information about your preferences. We use:

• Strictly necessary cookies, required for authentication, security, and core Platform functionality. These cannot be switched off.
• Analytics and performance cookies, which help us understand how the Platform and Website are used.
• Marketing cookies, which help us measure the effectiveness of our campaigns and present relevant content.

You can control non-essential cookies through our cookie consent banner and at the individual browser level. Where required by law, we obtain consent before setting non-essential cookies. We honour Global Privacy Control (GPC) signals where applicable law requires us to.

Device Information: We may collect information about the device you are using to access the Platform, including the type of device, operating system, and unique device identifiers.

Analytics: We use Google Analytics to understand how our Website is used and to improve it. Google Analytics runs only after you accept analytics cookies in our cookie consent banner; until then, no Google Analytics script is loaded and no analytics cookie is set. If you later withdraw consent, it stops.

Website journey: Your browser keeps a record of your visit to our Website in its own local storage: the page you landed on, the website that referred you (address only, without query parameters), any campaign tags in the URL, and the pages you viewed with their titles and times, limited to the last 50 page views within 30 days. Nothing else from the address bar, and no device or IP information, is kept. When you submit a form on our Website, this record (your "Website journey") is sent with your submission and stored with your contact details in our CRM so that our sales team can see which pages you read before getting in touch, together with your cookie banner choice (accepted, declined or not answered). The record never leaves your browser unless you submit a form. You can delete it at any time with "Delete All Data" in your privacy settings.

Returning visitors: If you have accepted analytics cookies and you send us a form (for example to download a template or request a demo), we set a first-party cookie so we can recognise your browser when you come back. The cookie holds an encrypted, signed code, not your email address in readable form, and it expires 180 days after your last form. On later visits we note a small number of actions on your contact record in our CRM, with the date: viewing our pricing, demo or pilot pages, product pages or buyer's guides, using a calculator, starting the demo form, or viewing three or more pages in one visit. Our sales team may be notified so they can follow up. We do not record every page you view this way, and we share this information with no one other than our CRM provider, Apollo (Section 5.1), which already holds your contact details. If you decline analytics cookies, withdraw your consent later, or use "Delete All Data" in your privacy settings, the cookie is removed and nothing more is recorded.

2.3. Information from Third-Party Services

Google APIs: If you choose to connect your Google account to our Platform, we will receive certain information from Google APIs. Our use of this information is strictly governed by the Google API Services User Data Policy, as detailed in Section 8.

Payment Processors: We use third-party payment processors (e.g., Stripe) to handle payment information. We do not store your full payment card details on our servers.

3. How We Use Your Information

We use the information we collect for the following business purposes:

• To provide and improve the Platform: to operate, maintain, personalize, and enhance our services, and to develop new features and functionality.
• To improve customer service: to respond effectively to your support requests and service needs.
• To communicate with you: to send service-related communications, updates, security alerts, and administrative messages, and to send marketing communications where you have consented or where permitted by law.
• For analytics and reporting: to create aggregated, non-identifying reports about the usage of our Platform.
• For safety and security: to detect and prevent fraud, abuse, and other harmful activity.
• To comply with legal obligations: to enforce our terms and comply with our legal obligations.

Where the General Data Protection Regulation (GDPR) or similar law applies, we rely on the following legal bases: performance of a contract with you; our legitimate interests in operating, securing, and marketing our business, balanced against your rights; your consent, where we ask for it; and compliance with legal obligations.

We do not use your personal information to make decisions producing legal or similarly significant effects about you without human involvement.

4. Mobile Information and SMS Consent

No mobile information will be shared with third parties or affiliates for marketing or promotional purposes. Information sharing with subcontractors that support our services, such as customer service platforms and messaging providers, is permitted solely so that we can deliver messages you have asked to receive. All other use case categories exclude text messaging originator opt-in data and consent; this information will not be shared with any third parties.

We collect your mobile phone number only when you provide it to us directly through a form on our website, during account registration, or in the course of a scheduled call. We use it to send the message types described in our Terms of Use and Terms of Service, which may include verification codes, security alerts, workflow notifications, meeting reminders, customer care replies, and — where you have separately consented — marketing messages.

You must be at least 18 years old to consent to receive text messages from us. You may withdraw consent at any time by replying STOP to any message or by emailing support@theleansuite.com. We retain a record of your opt-out so that we can honour it.

Text messages from our website forms: Texting is optional. Where a form on our Website asks for a phone number, it shows an unticked checkbox reading "Text me about my request (msg & data rates may apply, reply STOP to opt out)." We send text messages about your request only to people who tick that box; leaving it unticked never prevents you from submitting the form or receiving a reply by email or phone. Message and data rates may apply. Reply STOP to any message to opt out at any time.

5. How We Share and Disclose Your Information

We do not sell your personal information, and we do not share it for cross-context behavioural advertising, as those terms are defined under California and other U.S. state privacy laws. We have not sold or shared personal information in the preceding twelve months. Mobile phone numbers and SMS consent are never sold, rented, or disclosed to third parties for their own marketing purposes, as stated in Section 4.

We may share your information in the following circumstances:

• With other users: your profile information and content you post on the Platform (such as suggestions and comments) may be visible to other authorized users within your organization, as necessary for the Platform's functionality.
• With service providers: we share information with third-party vendors and service providers who perform services on our behalf. This includes cloud hosting providers such as Microsoft Azure and Google Cloud Platform, which we use to host the Platform and store your data, as well as providers for payment processing, data analysis, messaging delivery, and customer support. These service providers are contractually obligated to protect your information and to use it only for the purposes for which it was disclosed.
• With your organization: if you use the Platform through an employer or other subscribing organization, that organization's administrators can access your account information and User Content.
• For legal reasons: we may disclose your information if required by law or in a good-faith belief that such action is necessary to comply with a legal obligation, protect our rights or property, or ensure the safety of our users or the public.
• In connection with a business transfer: in the event of a merger, acquisition, reorganization, or sale of assets, your information may be transferred as part of that transaction. We will notify you of any such transfer and of any material change to this policy that results.
• Aggregated or anonymized data: we may share aggregated or anonymized data that cannot reasonably be used to identify you.

A current list of the subprocessors we use to deliver the Platform is available on request by contacting support@theleansuite.com.

5.1. Service Providers Used on Our Website

The following service providers process information from visitors to our Website on our behalf. Each is bound by its contract with us to use that information only to provide its service to us.

• Vercel hosts and serves the Website. Like any web host, it processes your IP address and request details in order to deliver pages and protect the Website.
• Sanity is the content management system that stores the Website's pages and articles. It does not receive your personal information.
• Apollo is our customer relationship management (CRM) system. When you submit a form, request a demo, register for an event, or download a document, the details you enter, your message, your SMS consent choice, and your Website journey (Section 2.2) are stored there, as are the return-visit actions described under "Returning visitors" in Section 2.2 if you accepted analytics cookies.
• Calendly schedules demo and discovery calls. It processes the name, email address, and meeting time you provide when you book.
• Intercom provides the chat messenger on the Website. It processes the messages you send through the messenger and any contact details you choose to share in it, along with the page you are on so that we can answer in context.
• Arcjet provides bot protection and rate limiting for our forms and web services. It processes your IP address and request details to tell automated abuse apart from real visitors.
• Google Analytics measures how the Website is used. It runs only after you accept analytics cookies in our consent banner, as described in Section 2.2.
• Vonage delivers text messages. It processes the mobile number and message content for people who have ticked the optional text-message box (Section 4), and no one else.
• Gmail (Google) sends our transactional emails, such as e-book and calculator-result deliveries and confirmations, and the internal alerts that tell our team about your enquiry. It processes the email address and message content of those emails.

6. Your Privacy Rights and Choices

Subject to applicable law, you may have the right to: access the personal information we hold about you; correct inaccurate information; request deletion; request a portable copy; object to or restrict certain processing; and withdraw consent you have previously given. You also have the right not to be discriminated against for exercising these rights.

To exercise any of these rights, contact us at support@theleansuite.com or at the address in Section 13. We will verify your identity before acting on a request and will respond within the timeframe required by applicable law. You may authorize an agent to make a request on your behalf, subject to verification.

Canada: Our practices are governed by the Personal Information Protection and Electronic Documents Act (PIPEDA) and applicable provincial privacy legislation, and our commercial electronic messages comply with Canada's Anti-Spam Legislation (CASL). If you are not satisfied with our response, you may file a complaint with the Office of the Privacy Commissioner of Canada.

European Economic Area and United Kingdom: You may lodge a complaint with your local supervisory authority.

Additional choices available to you:

• Access and update your information: you may review and update your account information in your account settings.
• Marketing emails: unsubscribe using the link in any marketing email. You will continue to receive essential service-related and transactional emails.
• Text messages: reply STOP to any message, as described in Section 4.
• Cookies: most browsers let you remove or reject cookies; see Section 2.2.
• Deletion: you may request deletion of your account and personal information by contacting us. We will delete your information within a commercially reasonable timeframe, subject to our need to retain certain information for legal or legitimate business purposes as described in Section 10.

7. Children's Privacy

The Website and the Platform are intended for business users aged 18 and over. They are not directed to children, and you must be at least 18 years of age to submit a form, create an account, or consent to receive text messages from us. We do not knowingly collect personal information from anyone under 18. If we become aware that we have collected such information, we will take steps to delete it promptly.

8. Google API Services User Data Policy

This means:

• We only use Google User Data to provide or improve prominent user-facing features of the Platform.
• We do not use Google User Data for advertising purposes.
• We do not transfer Google User Data to third parties, except as necessary to provide or improve our services, comply with applicable law, or as part of a merger or acquisition (with notice to you).
• We do not allow humans to read Google User Data unless we have your affirmative consent, it is necessary for security purposes or to comply with applicable law, or the data has been aggregated and anonymized.

9. Data Security

We implement administrative, technical, and physical security measures designed to protect the confidentiality, integrity, and availability of your personal information. These measures include encryption of data in transit and at rest, role-based access controls, logging and monitoring, and secure hosting with our cloud infrastructure providers.

LeanSuite has completed a Service Organization Control (SOC) 2 Type 1 examination, conducted by an independent third-party firm, evaluating whether our security controls were suitably designed to meet the trust services criteria for security and confidentiality established by the American Institute of Certified Public Accountants (AICPA). A SOC 2 Type 1 report addresses the design of controls at a point in time and does not address their operating effectiveness over a period. The report is available to customers and prospective customers from our Trust Center once you accept our confidentiality terms, or by request to support@theleansuite.com.

If we become aware of a breach of security safeguards affecting your personal information, we will notify you and the relevant regulators where required by applicable law and without undue delay.

No security system is impenetrable, and we cannot guarantee the absolute security of our systems.

10. Data Retention

We retain personal information for as long as necessary to provide the Platform, to fulfill the purposes described in this policy, and to meet our legal, accounting, and reporting obligations.

• Customer Data in a subscribing organization's workspace is retained for the duration of the subscription. Following termination, we make it available for export for thirty (30) days, after which we delete it in the ordinary course, consistent with our Terms of Service.
• Account and contact information is retained while your account is active and for a reasonable period afterward.
• Marketing and prospect information is retained until you unsubscribe or object, or until it is no longer commercially relevant.
• SMS opt-out records are retained indefinitely so that we can continue to honour your opt-out.
• Log and security data is retained for a limited period consistent with our security and troubleshooting needs.
• Residual copies may persist in encrypted backups for a limited period before being overwritten in the ordinary backup rotation.

11. International Data Transfers

Your information is processed and stored on the servers of our cloud infrastructure providers, primarily Microsoft Azure and Google Cloud Platform, which may be located in various countries including Canada and the United States. Your information may therefore be transferred to, stored, and processed in a country with data protection laws different from those of your country of residence, and may be accessible to law enforcement and national security authorities of those countries under their applicable laws.

Where we transfer personal information out of the European Economic Area, the United Kingdom, or another jurisdiction that restricts such transfers, we rely on an appropriate transfer mechanism, such as the European Commission's Standard Contractual Clauses, together with supplementary measures where required.

12. Changes to This Privacy Policy

We may modify this Privacy Policy from time to time. If we make material changes, we will notify you by updating the date at the top of this policy and, where the change is significant, by more prominent notice such as an in-product notice or email. Material changes to how we handle mobile information or SMS consent will be communicated to affected recipients before they take effect. We encourage you to review this policy periodically.

13. Contact Us

If you have any questions or concerns about this Privacy Policy or our data practices, please contact us at: