Privacy policy

Who we are

LeanOS Coaching (coaching.leanos-app.com) is a service of Centre Educatiu del CAD CAM, SL, the Spanish limited company that also runs LeanOS. It is the data controller for the data described below. Tax ID (CIF): B62582945. Registered address: Avinguda Antoni Gaudí 15, Local 2, 08840 Viladecans (Barcelona), Spain. Contact: support@leanos-app.com.

Your account

To open your coaching space, or to work as a coach, you create an account with your email and a password. We keep your email, your name if you give it, your language, a hash of your password (never the password itself) and sign-in timestamps. Legal basis: the contract (Art. 6(1)(b) GDPR).

This account belongs to LeanOS Coaching only. It is kept in a database of its own, separate from LeanOS: an account in one gives no access to the other.

Coaching requests and sessions

If you take the coaching test, nothing is stored while you answer it — the answers live in your browser and disappear with the tab.

When you ask for a session, and only then, we store what you type in the form (name, email, company if you give one, availability, your message) together with the answers you ticked and the track they produced. We use them to prepare your first session and to arrange it with you. Legal basis: steps taken at your request before a contract (Art. 6(1)(b) GDPR).

The test asks only about your work situation. Do not send us health information through it — we do not ask for it, we do not need it, and coaching is not a health service.

During the coaching we keep what is needed to run it: the goals and plan agreed with you, the dates of the sessions, your coach's notes, the actions you agree on, your check-ins, your answers to follow-up questions, the worksheets you fill in, the ratings you give and the messages you exchange with your coach. Legal basis: the contract (Art. 6(1)(b) GDPR).

Who sees it: your coach. The coaching lead supervises the coaches' work and can read your case, except your messages with your coach and the notes your coach marks as private. Nobody else does, including an employer paying for your sessions.

When you write in your coaching space, your coach gets an email notice with a link and without the text of your message.

AI drafting for your coach

Your coach can use AI to draft the preparation of a session, a worksheet or a review of your plan. What is sent leaves out your surname and your company's name. The AI drafts; your coach decides what to use. The provider is OpenAI (see 'Service providers').

DISC behavioural assessment

The DISC assessment is a questionnaire about your behavioural style at work. You fill it in only when we send you an invitation link.

What we store: your name, email, company if you give one, your answers, your scores and a report written by AI. While you answer, your answers are also kept in your browser, on that device only, so that a reload does not lose them.

Why, and legal basis: to produce your report. The legal basis is your consent (Art. 6(1)(a) GDPR), which you give before you start and can withdraw at any time by writing to support@leanos-app.com.

Who sees it: the coaching lead, who manages the assessments. The report is also emailed to our support mailbox.

AI processing: your answers are sent to OpenAI to write the report.

How long we keep it: 2 years after you complete it; an invitation you never complete, 12 months after its link expires (or after the invitation, if it was revoked). Your DISC results are not tied to an account in this app, so deleting an account does not remove them: they are deleted on that schedule, or earlier if you ask us at support@leanos-app.com.

Proposals for companies

When you ask for a coaching proposal for your company, we keep what you write: name, email, company, headcount band, timing, your message and the language. We use it only to answer you and to prepare the proposal. Legal basis: steps you ask us to take before a contract (Art. 6(1)(b) GDPR).

The coaching lead reads it, and it is forwarded to our support mailbox. We answer by email from support@leanos-app.com.

Legal basis, in short

Contract (Art. 6(1)(b) GDPR): your account and the coaching itself. Steps before a contract (Art. 6(1)(b)): a coaching request or a company proposal. Consent (Art. 6(1)(a)): the DISC assessment, and analytics if we ever add it. Legitimate interest (Art. 6(1)(f)): security logs and the limits that protect the service from abuse.

Service providers

We use the following service providers (processors). Each processes personal data only on our instructions and only for the task listed:

Supabase — database and sign-in. The database is hosted in the EU. Supabase Inc. is a US company: EU Standard Contractual Clauses (SCCs).

Railway — runs the application, in its EU region. Railway Corp. is a US company: SCCs.

Arsys Internet S.L.U. (Spain) — sends our emails and hosts our support mailbox.

Resend — backup email sending, used only when it is active. US company: SCCs.

OpenAI — AI drafting for coaches and the DISC report. US company: SCCs. Data sent through its API is not used to train models.

We do not sell personal data.

International transfers

Several of the providers listed above are US companies, and some process personal data in the US. Each transfer outside the EEA relies on the safeguard shown next to that provider, with supplementary measures as required by Schrems II. We may change infrastructure providers; this policy is updated when we do.

Retention

We keep each type of data only for as long as we need it:

Account data: while your account exists. What happens when it is deleted is set out under 'Deleting your account'.

Coaching: while the coaching relationship lasts and for up to 2 years after the last session. A request that never led to a session: 1 year.

DISC assessments that are never completed: deleted 12 months after the link expires, or 12 months after the invitation if it was revoked. Completed results: deleted 2 years after completion.

Company proposals: deleted 24 months after we receive them, unless they lead to a contract (then, as that contract says).

Security logs and rate limits: short rolling windows, from a few minutes to an hour, deleted within two days, plus our hosting provider's request logs.

Backups: our database provider keeps daily backups for 7 days.

Scheduled deletions run automatically every night.

Deleting your account

When your account is deleted, your profile and sign-in details go at once, and every coaching case filed under your email address is anonymised: your messages, the notes about you, your answers, worksheets, ratings and check-ins are deleted; only the dates and the number of sessions remain, with no name attached.

You delete your account yourself, in the app: My account → Delete my account. If you can no longer sign in, write to support@leanos-app.com from the address of the account.

DISC results are not tied to an account: they are deleted on their own schedule (see 'DISC behavioural assessment').

Copies in backups expire as set out under 'Retention'.

Your rights

Access, rectification, erasure, restriction, portability and objection, and the right to withdraw your consent to the DISC assessment at any time. You also have the right to lodge a complaint with a supervisory authority (e.g. AEPD in Spain, CNIL in France).

How to exercise your rights

You can download your data and delete your account yourself, under My account in the app. For anything else, write to support@leanos-app.com with the subject 'GDPR request'. We may ask you to confirm that the address is yours before we act on the request.

Changes to this policy

We publish changes on this page and update the 'Last updated' date. If a change affects how we use data you have already given us, we tell you by email first.

Contact

Questions, requests or to exercise your rights — write to support@leanos-app.com.