Privacy policy
Last updated 23 September 2026
Who we are
RG-IT B.V. · Vlotstraat 20, 6417 CB Heerlen, the Netherlands · KvK 51460602 · VAT NL850028954B01 · hello@leanbrew.app
We are the controller for your account and billing data and for our logs. For the content of meetings (topics, votes, notes, actions and the names people enter) the customer who hosts the meeting is the controller and we are the processor, under our data processing agreement. If you joined someone else's meeting as a guest, please contact that organisation about the meeting content.
What we process, why, and for how long
| Data | Purpose & legal basis | Kept for |
|---|---|---|
| Name, email, securely hashed password (or your Google identity) | Providing your account — contract | While your account exists, plus 30 days (backups overwritten within 30 days after that). Accounts without a subscription and without sign-ins for 24 months may be deleted, after a warning email at least 30 days in advance. |
| Record of accepting the terms (version, date, business-use confirmation) | Proving what was agreed — legitimate interest | While your account exists, plus 5 years |
| Email verification and password-reset messages | Securing your account — contract | Links expire within 1 hour to 3 days |
| A few onboarding emails during your trial (welcome, tips, trial-ending reminders) and which of them we sent | Helping you get started and telling you before your trial ends — legitimate interest. Unsubscribe with the link in every such email | While your account exists |
| Stripe customer and subscription references, plan status, invoices | Billing — contract and legal obligation | 7 years (Dutch tax law) |
| Billing name, address, VAT ID and payment method (card details are handled by Stripe; we never see full card numbers) | Billing and tax — contract and legal obligation | 7 years (Dutch tax law) |
| Emails you send to hello@leanbrew.app | Support — legitimate interest. Recipients: Namecheap (email forwarding and DNS) and Google (our mailbox) | Up to 2 years after last contact |
| Technical logs (e.g. IP address, time, request) | Security and keeping the service running — legitimate interest | Up to 30 days |
| Anonymous visit statistics: we count page views per page and the website that referred you, clicks on a few buttons per page (such as “Start free trial” and starting the free timer), plus your country (derived from your browser's time zone, not your IP address) and device type (mobile/tablet/desktop), without cookies, without storing your IP address or any identifier; kept as daily totals. When you sign up we store the page and website that first brought you to us, to understand which pages work. | Understanding how people find and use the site — legitimate interest | Daily totals only, no personal data. The first page and website stored with your account: while your account exists |
| IP address for rate limiting | Preventing abuse — legitimate interest | In memory only, for minutes |
| Meeting content | Providing the service on the host's instructions | Until the host deletes it or ends their account |
| Guests: display name and a random guest ID cookie | Processed for the host, as processor (see the DPA) | As decided by the host; cookie 1 year |
We don't sell data, don't use it for advertising, and don't make automated decisions about you. Stripe screens payments for fraud automatically (Stripe Radar) as an independent controller; see Stripe's privacy policy.
Who helps us (sub-processors)
- Google Cloud — hosting (Cloud Run, region europe-west4, the Netherlands)
- MongoDB Atlas — database (Google Cloud europe-west1, Belgium)
- Resend — sending account emails (eu-west-1, Ireland)
- Stripe — payments. Stripe also acts as an independent controller for payment processing and fraud prevention; see Stripe's privacy policy.
Slack is not our sub-processor: if a host connects their own Slack webhook, we send meeting details to it on the host's instruction; Slack then acts for the host under the host's agreement with Slack.
Google (Google LLC), MongoDB (MongoDB, Inc.), Stripe (Stripe, Inc.) and Resend (Resend, Inc.) have parent companies in the United States. Access from the US is covered by the EU-US Data Privacy Framework and/or the European Commission's standard contractual clauses in their data processing terms.
Cookies
We only use cookies that are needed for the app to work, so we don't ask for consent. We don't use analytics, advertising or tracking cookies.
| Name | Purpose | Lifetime |
|---|---|---|
| __Secure-next-auth.session-token | Keeps you signed in | 30 days |
| __Host-next-auth.csrf-token, __Secure-next-auth.callback-url | Protects sign-in against forged requests | Session |
| lc_guest | Recognises you as the same guest in a meeting | 1 year |
| lc-theme, lc-guest (local storage) | Remembers light/dark mode and your guest name | Until you clear it |
| lc-first-touch (session storage) | The page and website that first brought you here in this tab (no identifier); only sent to us if you sign up | Until you close the tab |
When you pay, Stripe's checkout page may set its own cookies needed for the payment and fraud prevention.
Security
Data is encrypted in transit, passwords are stored as salted scrypt hashes, access is limited to what's needed to run the service, and our providers are established cloud companies.
Your rights
You can ask us to access, correct, delete, restrict or export your personal data, or object to how we use it, by emailing hello@leanbrew.app. We respond within one month. You can also file a complaint with the Dutch data protection authority, the Autoriteit Persoonsgegevens.
Version 2026-09-23.2.