LeanSuite Privacy Policy

Your privacy is critically important to us at LeanSuite.com Corp. ("LeanSuite," "we," "us," or "our"). This Privacy Policy explains how we collect, use, share, and protect information when you use our web application, websites, and related services (collectively, the "Platform").

This policy applies to any user of the Platform, whether you are a company, an individual employee, or any other authorized user ("you" or "your").

By accessing or using our Platform, you agree to the terms of this Privacy Policy and our Terms of Service. If you do not agree with these terms, please do not access or use the Platform.

1. Our Role: Controller and Processor

LeanSuite handles personal information in two distinct roles, and your rights depend on which applies.

As a processor (service provider). When your employer or another organization subscribes to the Platform and you use it as an authorized User, that organization decides what information is entered into the Platform and how it is used. We process that information on their instructions under our customer agreement. If you are an employee User and want to access, correct, or delete information held in your employer's LeanSuite workspace, please contact your employer directly. If you contact us instead, we will refer your request to them and support them in responding.

As a controller. We act as a controller for information we collect for our own purposes: website visitors, prospective customers, marketing and sales contacts, account administrators and billing contacts, support enquiries, and our SMS messaging program. Sections 5 and 6 below apply to this information.

2. Information We Collect

2.1. Information You Provide Directly to Us

Account and Profile Information: When you register for an account, we collect your name, email address, password, phone number, job title, and, where applicable, physical address. If you are a company, we may also collect information about your business and payment details.

Mobile Phone Number: We collect your mobile phone number when you provide it on a web form, during account setup, or in the course of a scheduled call. How we use it, and the strict limits on sharing it, are set out in Section 4.

User Content: We collect the information you post to the Platform, such as suggestions, Kaizen event details, comments, reviews, photos, and other interactive content.

Images and Video (Vision AI): Where your organization has enabled Vision AI or similar image-based features, the Platform processes images or video captured from equipment and work areas that your organization supplies or configures. Your organization determines what is captured, for what purpose, and for how long it is retained, and is responsible for providing any notice to, or obtaining any consent from, affected workers required by applicable workplace, privacy, or biometric information laws. LeanSuite does not use this content to identify individuals and does not generate biometric identifiers from it.

Communications: If you contact us directly, we may receive additional information about you. We also store communications between you and other users that occur on the Platform.

2.2. Information We Collect Automatically (Usage Data)

Log and Usage Data: Our servers automatically collect information when you access or use our Platform and record it in log files. This data may include your IP address, browser type, operating system, referring URLs, pages viewed, and timestamps.

Cookies and Similar Technologies: We use cookies to operate and administer our Platform and to improve your experience. A "cookie" is a piece of information sent to your browser that allows our Platform to remember information about your preferences. We use:

• Strictly necessary cookies, required for authentication, security, and core Platform functionality. These cannot be switched off.
• Analytics and performance cookies, which help us understand how the Platform and Website are used.
• Marketing cookies, which help us measure the effectiveness of our campaigns and present relevant content.

You can control non-essential cookies through our cookie consent banner and at the individual browser level. Where required by law, we obtain consent before setting non-essential cookies. We honour Global Privacy Control (GPC) signals where applicable law requires us to.

Device Information: We may collect information about the device you are using to access the Platform, including the type of device, operating system, and unique device identifiers.

Analytics: We use Google Analytics to understand how our Website is used and to improve it. Google Analytics runs only after you accept analytics cookies in our cookie consent banner; until then, no Google Analytics script is loaded and no analytics cookie is set. If you later withdraw consent, it stops.

Website journey: Your browser keeps a record of your visit to our Website in its own local storage: the page you landed on, the website that referred you (address only, without query parameters), any campaign tags in the URL, and the pages you viewed with their titles and times, limited to the last 50 page views within 30 days. Nothing else from the address bar, and no device or IP information, is kept. When you submit a form on our Website, this record (your "Website journey") is sent with your submission and stored with your contact details in our CRM so that our sales team can see which pages you read before getting in touch, together with your cookie banner choice (accepted, declined or not answered). The record never leaves your browser unless you submit a form. You can delete it at any time with "Delete All Data" in your privacy settings. When you submit a form, our server also notes the country your IP address belongs to (the country only, not the address) with your record, so that we know which email rules apply to you (Section 3), and the internal alert our team receives shows your approximate city and country, worked out from your IP address.

Returning visitors: If you have accepted analytics cookies and you send us a form (for example to download a template or request a demo), we set a first-party cookie so we can recognise your browser when you come back. The cookie holds an encrypted, signed code, not your email address in readable form, and it expires 180 days after your last form. On later visits we note a small number of actions on your contact record in our CRM, with the date: viewing our pricing, demo or pilot pages, product pages or buyer's guides, using a calculator, starting the demo form, or viewing three or more pages in one visit. Our sales team may be notified so they can follow up. We do not record every page you view this way, and we share this information with no one other than our CRM provider, Apollo (Section 5.1), which already holds your contact details. If you decline analytics cookies, withdraw your consent later, or use "Delete All Data" in your privacy settings, the cookie is removed and nothing more is recorded.

Course progress link: If you take our free Lean in 7 days course, your personal course page opens from a link that holds your first name and which lessons you have finished, and nothing else. We do not keep a copy of it on our servers, and the page does not use a password. Your browser may remember the link in its own local storage on that device. To stop, choose "Forget this device" on the course page, or delete the link and clear this site's data in your browser.

2.3. Information from Third-Party Services

Google APIs: If you choose to connect your Google account to our Platform, we will receive certain information from Google APIs. Our use of this information is strictly governed by the Google API Services User Data Policy, as detailed in Section 8.

Payment Processors: We use third-party payment processors (e.g., Stripe) to handle payment information. We do not store your full payment card details on our servers.

3. How We Use Your Information

We use the information we collect for the following business purposes:

• To provide and improve the Platform: to operate, maintain, personalize, and enhance our services, and to develop new features and functionality.
• To improve customer service: to respond effectively to your support requests and service needs.
• To communicate with you: to send service-related communications, updates, security alerts, and administrative messages, and to send marketing communications where you have consented or where permitted by law.
• For analytics and reporting: to create aggregated, non-identifying reports about the usage of our Platform.
• For safety and security: to detect and prevent fraud, abuse, and other harmful activity.
• To comply with legal obligations: to enforce our terms and comply with our legal obligations.

Where the General Data Protection Regulation (GDPR) or similar law applies, we rely on the following legal bases: performance of a contract with you; our legitimate interests in operating, securing, and marketing our business, balanced against your rights; your consent, where we ask for it; and compliance with legal obligations.

Follow-up emails after a form: When you send us a form on our Website (for example to download a template, e-book, poster or plan, email yourself calculator results, open the interactive demo, register for an event, or ask about pricing, a demo or a pilot), we send you a short series of follow-up emails about your request from our CRM, Apollo. Our legal basis for these emails is our legitimate interest in replying to your request.

Monthly resource emails: After that series ends, we may send you one email a month with a lean resource on the subject you showed interest in. If you are in the European Economic Area, the United Kingdom or Switzerland, we send these monthly emails only if you ticked the box reading "Send me one useful lean resource a month. Unsubscribe anytime." on the form, and your consent is our legal basis. The box is never ticked in advance, and leaving it unticked never stops you from sending the form. We record your answer, the date, and the country of your IP address with your contact details.

How to stop: reply "stop" to any of these emails, or use the opt-out line at the bottom of it. We honour your request within 2 business days, across all of our emails, and we do not add you to any further follow-up or monthly emails.

Company details for new enquiries: For new leads, we may look up publicly available business details, such as your company, role and industry, through Apollo, so that we can route your enquiry to the right person.

We do not use your personal information to make decisions producing legal or similarly significant effects about you without human involvement.

4. Mobile Information and SMS Consent

No mobile information will be shared with third parties or affiliates for marketing or promotional purposes. Information sharing with subcontractors that support our services, such as customer service platforms and messaging providers, is permitted solely so that we can deliver messages you have asked to receive. All other use case categories exclude text messaging originator opt-in data and consent; this information will not be shared with any third parties.

We collect your mobile phone number only when you provide it to us directly through a form on our website, during account registration, or in the course of a scheduled call. We use it to send the message types described in our Terms of Use and Terms of Service, which may include verification codes, security alerts, workflow notifications, meeting reminders, customer care replies, and, where you have separately consented, marketing messages.

You must be at least 18 years old to consent to receive text messages from us. You may withdraw consent at any time by replying STOP to any message or by emailing support@theleansuite.com. We retain a record of your opt-out so that we can honour it.

Text messages from our website forms: Texting is optional. Where a form on our Website asks for a phone number, it shows an unticked checkbox whose full text is: "Yes, LeanSuite (LeanSuite.com Corp.) may text me at this number about my request. Message types: appointment confirmations and reminders, scheduling and follow-up on your request, and account or support notices. No marketing texts. Up to 4 messages a month. Message and data rates may apply. Reply STOP to opt out at any time or HELP for help. Texting is optional and not a condition of any purchase. See our Privacy Policy and Terms of Service." The same form, with the full program terms, is at https://theleansuite.com/sms-updates. We send text messages about your request only to people who tick that box and then confirm the number is theirs: the form offers to send a one-time code to that number by text message or voice call, and we start texting only after the right code is entered. Leaving the box unticked, or skipping the code, never prevents you from submitting the form or receiving a reply by email or phone.

What the website texts, how often, and how to stop: Message types: appointment confirmations and reminders, scheduling and follow-up on your request, and account or support notices. We do not send marketing texts to a number collected this way unless you separately agree to them. Message frequency: up to 4 messages a month. Message and data rates may apply. Reply STOP to any message to opt out at any time, or HELP for help; you can also email support@theleansuite.com. Mobile numbers and consent records are never shared with or sold to third parties or affiliates for their marketing. For each submission we keep a consent record: your answer, the version of the consent text you saw, the time, and the page the form was on. It is kept with your lead record (Section 8), and an opt-out is kept indefinitely so that we continue to honour it.

5. How We Share and Disclose Your Information

We do not sell your personal information, and we do not share it for cross-context behavioural advertising, as those terms are defined under California and other U.S. state privacy laws. We have not sold or shared personal information in the preceding twelve months. Mobile phone numbers and SMS consent are never sold, rented, or disclosed to third parties for their own marketing purposes, as stated in Section 4.

We may share your information in the following circumstances:

• With other users: your profile information and content you post on the Platform (such as suggestions and comments) may be visible to other authorized users within your organization, as necessary for the Platform's functionality.
• With service providers: we share information with third-party vendors and service providers who perform services on our behalf. This includes cloud hosting providers, which we use to host the Platform and store your data (the providers for this website are listed in Section 5.1), as well as providers for payment processing, data analysis, messaging delivery, and customer support. These service providers are contractually obligated to protect your information and to use it only for the purposes for which it was disclosed.
• With your organization: if you use the Platform through an employer or other subscribing organization, that organization's administrators can access your account information and User Content.
• For legal reasons: we may disclose your information if required by law or in a good-faith belief that such action is necessary to comply with a legal obligation, protect our rights or property, or ensure the safety of our users or the public.
• In connection with a business transfer: in the event of a merger, acquisition, reorganization, or sale of assets, your information may be transferred as part of that transaction. We will notify you of any such transfer and of any material change to this policy that results.
• Aggregated or anonymized data: we may share aggregated or anonymized data that cannot reasonably be used to identify you.

A current list of the subprocessors we use to deliver the Platform is available on request by contacting support@theleansuite.com.

5.1. Service Providers Used on Our Website

The following service providers process information from visitors to our Website on our behalf, each for the reason given. Each is bound by its contract with us to use that information only to provide its service to us.

• Apollo is our customer relationship management (CRM) system and sends our follow-up emails (Section 3). When you submit a form, request a demo, register for an event, or download a document, the details you enter, your message, your SMS consent choice, your monthly email choice where we ask for it, and your Website journey (Section 2.2) are stored there, as are the return-visit actions described under "Returning visitors" in Section 2.2 if you accepted analytics cookies. For new leads we may also use Apollo to look up publicly available business details, such as your company, role and industry. Apollo's website visitor script also runs on our Website and uses the IP address of a visit to identify the company it comes from. Visitors in the EU/EEA, the UK or Switzerland get this script only after accepting analytics cookies.
• Vercel hosts and serves the Website. Like any web host, it processes your IP address and request details in order to deliver pages and protect the Website.
• Google provides three services we use. Google Workspace (Gmail) sends our transactional emails, such as e-book and calculator-result deliveries and confirmations, and carries the internal alerts that tell our team about your enquiry; it processes the email address and content of those emails. Google Analytics measures how the Website is used, and runs only after you accept analytics cookies in our consent banner, as described in Section 2.2. Google Cloud is one of the cloud providers that host and store our services (Section 11).
• Intercom provides the chat messenger on the Website. It processes the messages you send through the messenger and any contact details you choose to share in it, along with the page you are on so that we can answer in context.
• Calendly schedules demo and discovery calls. It processes the name, email address, and meeting time you provide when you book.
• Transistor hosts our podcast. When you play an episode on our Website, the audio is streamed from Transistor, which receives your IP address and browser details in order to deliver it.
• Sanity is the content management system that stores the Website's pages and articles. When you download an e-book, or a template from our template library, it also keeps a record of that download: the details you entered on that form (such as your name, email address, phone number, job title, company, industry, company size or country) and the date.
• Arcjet provides bot protection and rate limiting for our forms and web services. It processes your IP address and request details to tell automated abuse apart from real visitors.
• Vonage delivers text messages. It processes the mobile number and message content for people who have ticked the optional text-message box (Section 4), and no one else.
• Twilio sends the one-time code that confirms a phone number is yours, by text message or by voice call, when you choose to verify a number on one of our forms. It processes that phone number and the code. We use it for the same reason before sending you any text message or automated call, and it also carries those calls if you have asked for one.
• Anthropic provides the AI model behind the "Ask LeanSuite" search on our Website. It processes the questions you type there, together with the earlier questions in the same conversation, to write the answer.
• LinkedIn provides the LinkedIn Insight Tag, which measures visits from our LinkedIn campaigns. It runs only after you accept analytics cookies in our consent banner.
• YouTube and Vimeo serve the videos embedded on our Website. When a video player loads or plays, they receive your IP address and browser details.

6. Your Privacy Rights and Choices

Subject to applicable law, you may have the right to: access the personal information we hold about you; correct inaccurate information; request deletion; request a portable copy; object to or restrict certain processing, including objecting at any time to marketing emails; and withdraw consent you have previously given, such as consent to our monthly emails. You also have the right not to be discriminated against for exercising these rights.

To exercise any of these rights, email us at support@theleansuite.com or write to the address in Section 13. We will verify your identity before acting on a request and will respond within 30 days of receiving it. You may authorize an agent to make a request on your behalf, subject to verification.

Canada: Our practices are governed by the Personal Information Protection and Electronic Documents Act (PIPEDA) and applicable provincial privacy legislation, and our commercial electronic messages comply with Canada's Anti-Spam Legislation (CASL). If you are not satisfied with our response, you may file a complaint with the Office of the Privacy Commissioner of Canada.

European Economic Area, United Kingdom and Switzerland: You have the right to lodge a complaint with a data protection supervisory authority, in particular the one in the country where you live or work, or where you believe your rights were infringed.

Additional choices available to you:

• Access and update your information: you may review and update your account information in your account settings.
• Marketing emails: unsubscribe using the link in any marketing email, or reply "stop" to any follow-up email, as described in Section 3. You will continue to receive essential service-related and transactional emails.
• Text messages: reply STOP to any message, as described in Section 4.
• Cookies: most browsers let you remove or reject cookies; see Section 2.2.
• Deletion: you may request deletion of your account and personal information by contacting us. We will delete your information within a commercially reasonable timeframe, subject to our need to retain certain information for legal or legitimate business purposes as described in Section 10.

7. Children's Privacy

The Website and the Platform are intended for business users aged 18 and over. They are not directed to children, and you must be at least 18 years of age to submit a form, create an account, or consent to receive text messages from us. We do not knowingly collect personal information from anyone under 18. If we become aware that we have collected such information, we will take steps to delete it promptly.

8. Google API Services User Data Policy

This means:

• We only use Google User Data to provide or improve prominent user-facing features of the Platform.
• We do not use Google User Data for advertising purposes.
• We do not transfer Google User Data to third parties, except as necessary to provide or improve our services, comply with applicable law, or as part of a merger or acquisition (with notice to you).
• We do not allow humans to read Google User Data unless we have your affirmative consent, it is necessary for security purposes or to comply with applicable law, or the data has been aggregated and anonymized.

9. Data Security

We implement administrative, technical, and physical security measures designed to protect the confidentiality, integrity, and availability of your personal information. These measures include encryption of data in transit and at rest, role-based access controls, logging and monitoring, and secure hosting with our cloud infrastructure providers.

LeanSuite has completed a Service Organization Control (SOC) 2 Type 1 examination, conducted by an independent third-party firm, evaluating whether our security controls were suitably designed to meet the trust services criteria for security and confidentiality established by the American Institute of Certified Public Accountants (AICPA). A SOC 2 Type 1 report addresses the design of controls at a point in time and does not address their operating effectiveness over a period. The report is available to customers and prospective customers from our Trust Center once you accept our confidentiality terms, or by request to support@theleansuite.com.

If we become aware of a breach of security safeguards affecting your personal information, we will notify you and the relevant regulators where required by applicable law and without undue delay.

No security system is impenetrable, and we cannot guarantee the absolute security of our systems.

10. Data Retention

We retain personal information for as long as necessary to provide the Platform, to fulfill the purposes described in this policy, and to meet our legal, accounting, and reporting obligations.

• Customer Data in a subscribing organization's workspace is retained for the duration of the subscription. Following termination, we make it available for export for thirty (30) days, after which we delete it in the ordinary course, consistent with our Terms of Service.
• Account and contact information is retained while your account is active and for a reasonable period afterward.
• Lead and prospect information, including what you send us through our Website forms, your Website journey and our emails with you, is kept for up to 24 months after your last interaction with us, and then deleted or anonymised. You can ask us to delete it sooner (Section 6).
• SMS consent records (your answer, the consent text version, the time and the page) are kept with your lead record for the same 24 months after your last interaction with us.
• SMS opt-out records are retained indefinitely so that we can continue to honour your opt-out.
• Log and security data is retained for a limited period consistent with our security and troubleshooting needs.
• Residual copies may persist in encrypted backups for a limited period before being overwritten in the ordinary backup rotation.

11. International Data Transfers

Your information is processed and stored on the servers of our cloud infrastructure providers, which may be located in various countries including Canada and the United States. Your information may therefore be transferred to, stored, and processed in a country with data protection laws different from those of your country of residence, and may be accessible to law enforcement and national security authorities of those countries under their applicable laws.

The service providers listed in Section 5.1 also process your information, mainly in the United States and Canada.

Where we transfer personal information out of the European Economic Area, the United Kingdom, Switzerland, or another jurisdiction that restricts such transfers, including to the United States and Canada, we rely on Standard Contractual Clauses or equivalent safeguards agreed with our providers, together with supplementary measures where required.

12. Changes to This Privacy Policy

We may modify this Privacy Policy from time to time. If we make material changes, we will notify you by updating the date at the top of this policy and, where the change is significant, by more prominent notice such as an in-product notice or email. Material changes to how we handle mobile information or SMS consent will be communicated to affected recipients before they take effect. We encourage you to review this policy periodically.

13. Contact Us

If you have any questions or concerns about this Privacy Policy or our data practices, please contact us at: