Privacy Policy
Last updated: August 20, 2026
1. Our Core Privacy Commitment
At LeanSec, we believe data security starts by not collecting unnecessary customer information. LeanSec is built from the ground up as a **100% Client-Side (Local-First)** application.
2. What Data We DO NOT Collect
- No Client Spreadsheet Uploads: When you upload Excel (.xlsx) or CSV files into the Questionnaire Studio, the files are parsed purely in your browser's local memory using SheetJS. No data is sent to our servers.
- No Company Policy Storage: The custom names, technology stack choices, and policy text overrides configured in the Studio remain in your browser's local storage (`localStorage`).
- No Telemetry on Questionnaires: We do not log, index, or analyze questions or answers matched in the questionnaire tool.
3. What Data We Process
The only personal data processed is billing and payment information collected directly by our payment processor, **Stripe**, when you purchase a commercial license (name, email address, company billing address, VAT number). We do not store credit card numbers on our infrastructure.
4. Local Storage & Session State
Your configuration settings and risk register adjustments are stored exclusively in your browser's `localStorage` (`leansec-storage-v1`). You may wipe this data at any time by clearing your browser cache or clicking the "Reset" controls inside the application.
5. GDPR & Cross-Border Compliance
Because no client operational data is transmitted to or stored on external servers, using LeanSec inherently satisfies the data minimization principles under GDPR Article 5(1)(c) and eliminates cross-border data transfer risks.
6. Contacting Us
If you have any questions about this Privacy Policy or our local-first architecture, please reach out to our privacy officer at privacy@leansec.io.