Privacy policy for the portal

For businesses and their staff who use leanframe (app.leanframe.de). The website privacy policy applies to the website leanframe.de. Last updated: 1 November 2026.

1. Controller

Georg Flossmann, trading as “leanframe”, Ickelsamerstraße 35, 81825 Munich, Germany, email: kontakt@leanframe.de (further details in the legal notice).

2. What this covers and what it does not

This policy covers data of portal users: owners, admins and staff of a business who sign in, and data relating to the contract with the business.

We process the data of a business’s own customers (end customers who book through the chat, by email or on the booking page) on behalf of that business. The business is the controller for that data; the data processing agreement applies. End customers find the business’s privacy policy in the chat and on the booking page.

3. Account and sign-in

• Data: name, email address, role (e.g. owner, staff), language, notification settings, time of last sign-in.
• Sign-in without a password: you receive a code or link by email. It is valid for 15 minutes and can be used once; we delete the sign-in email from our sending queue after one day.
• Passkey (optional, or required by your business): with a passkey you sign in without email; your business can require one for admins or for all users, in which case you confirm with the passkey after the code. We store only the public key, its ID, the device name (e.g. “iPhone”), when it was set up and last used and which businesses it is valid for. Your fingerprint, face or PIN is checked only by your device and never reaches us. You receive an email when a new passkey is added and when your passkeys are reset; both are recorded with name and time in the business's audit log. Admins of your business can see whether you have a passkey and can reset it if you have lost all of them.
• Session: one strictly necessary cookie (lf_session, only for app.leanframe.de; when signing in with a passkey also lf_pk for at most 5 minutes). It ends after 14 days or after 3 days without use. We use no other cookies and no analytics or advertising services. Some display settings (e.g. light/dark mode, layout of the overview) are stored locally by your browser; they do not leave your device.
• Legal basis: the contract with the business and your use of the portal (Art. 6(1)(b) GDPR); for staff of a business, the legitimate interest of the business and of leanframe in providing access (Art. 6(1)(f) GDPR).

4. Using the portal

• Audit log: we log changes to settings, appointments and access with name and time, so the business can see who changed what (Art. 6(1)(f) GDPR).
• Server logs: for every request our server processes the IP address, time, requested address and browser identifier in order to deliver the portal and fend off attacks (Art. 6(1)(f) GDPR). We delete these logs after 14 days.
• Portal assistant: questions and requests to the assistant are answered using Anthropic’s AI language model (see 7). The history is visible only to you. Conversations you have not continued for a while are deleted automatically after 6 months (the business can set 1 to 36 months); you can also delete individual conversations yourself. The assistant only carries out its suggestions (e.g. an offer or an email to a customer) after you confirm them.
• Support: only if the business asks us to, we open a time-limited support session. It is logged with its reason, and the business is informed by email.

5. Connecting Google, Microsoft and Apple

If you choose, you connect your business’s calendar, mailbox or address book to leanframe. You sign in with the provider and grant access; for Apple iCloud you enter an app-specific password.

• What we process: events and free/busy times of the calendars you select (to find free times and add bookings); emails in the connected mailbox (to answer appointment requests, according to your settings); contacts in the group “leanframe” (if you copy your customers to your address book; in Outlook the category “leanframe”): we write the name, phone number, email address and, depending on your setting, a short note (with or without your business name) for your customers with an appointment, keep them up to date and delete them when you delete or merge a customer, switch the feature off with “Remove contacts” or your business is closed. We do not read or change contacts outside this group (with Google we only read the names of your contact groups to find the group “leanframe” again).
• Credentials: we only store the provider’s access key (refresh token) or the app password, encrypted (AES-256-GCM). When you disconnect in the portal, we delete it immediately. You can also revoke access with the provider at any time.
• Legal basis: the contract with the business (Art. 6(1)(b) GDPR); for data of the business’s customers, the data processing agreement.

Google user data (Limited Use): If you connect a Google account, leanframe only reads and writes the calendars you select and, if you choose, adds your customers to a contact group named “leanframe”. leanframe’s use and transfer to any other app of information received from Google APIs will adhere to the Google API Services User Data Policy, including the Limited Use requirements. We do not use this data for advertising, do not sell it, only share it with the service providers listed below where needed for the feature, and do not use it to train generalized AI models. People at leanframe only see this data with your explicit permission (support session), where needed for security, or where required by law.

6. Contract and payment

• Data: name and address of the business, contact person, plan, subscription status, monthly usage (e.g. number of customer chats), invoices.
• Payment: via Stripe (Stripe Payments Europe, Ltd., Ireland). The business enters payment details (card, account) directly with Stripe; we do not see them. Stripe is itself responsible for payment processing: Stripe privacy policy.
• Legal basis: contract (Art. 6(1)(b) GDPR); we keep invoices as required by tax and commercial law (Art. 6(1)(c) GDPR, usually 8 or 10 years).

7. Service providers

We have data processing agreements with Hetzner, Scaleway and Anthropic. Transfers to the USA are based on the EU-US Data Privacy Framework or EU Standard Contractual Clauses. Anthropic does not use API data for training and deletes it according to its retention periods (usually after 30 days). The current list is available under subprocessors.

8. Retention

• Account and settings: as long as the access exists. If an admin removes a user, access is blocked immediately; the name remains in the business’s audit log.
• Passkeys: as long as they are assigned to an access. If you remove a passkey, an admin resets it or the access is deleted, we delete the public key immediately.
• Business data: after the contract or trial ends, we permanently delete all data 30 days after closure (see terms section 7).
• Backups are overwritten or deleted no later than 35 days after they are created; this also applies to the copy at Scaleway.
• Conversations with the assistant: 6 months after the last message (adjustable, see 4).
• Server logs: 14 days. Invoices: statutory periods (see 6).

9. Your rights

You have the right of access, rectification, erasure, restriction of processing, data portability and to object to processing based on legitimate interests. Write to kontakt@leanframe.de. You can also lodge a complaint with a supervisory authority, e.g. the Bavarian Data Protection Authority (BayLDA), Promenade 18, 91522 Ansbach, Germany.

Providing data: signing in is not possible without an email address. We do not make automated decisions within the meaning of Art. 22 GDPR.