Privacy Policy
In short: we use data to verify your email, prepare and send an estimate and specification, handle an order and payment, and protect the service. We do not send marketing or use advertising cookies. Questionnaire content is sent to an AI provider, so do not enter special-category data, passwords, or unnecessary data about other people.
1. Controller and contact
The controller of your personal data is R-SOFT, ul. Kępna 17A/11, 03-730 Warsaw, Poland, tax identification number (NIP) 5221929091, REGON 010852379 (“Controller”). Privacy contact: [email protected]. The Controller has not appointed a data protection officer.
2. Data we process and its sources
- your email address, selected language, and confirmation and session tokens;
- questionnaire answers, project name, and a project description of between 1,000 and 10,000 characters;
- the calculation result, AI-generated specification, offer code, and correspondence;
- ordering-party and billing details supplied when accepting an offer;
- payment amount, currency, status, Stripe identifiers, and payment stage; Lean Do IT does not receive your full card number;
- technical and security data, including IP address, request time, HTTP headers, and error information.
We obtain data directly from you, your browser, our correspondence, and Stripe in relation to payment status. If you provide another person’s data, you must have a lawful basis to do so and provide that person with this Policy.
3. Purposes and legal bases
| Purpose | Legal basis |
|---|---|
| Email verification, questionnaire access, preparation of the estimate, and response to your enquiry | GDPR Article 6(1)(b): steps requested before entering into a contract and performance of the requested service |
| Entering into and performing a contract, communication, payments, and software delivery | GDPR Article 6(1)(b) |
| Invoicing, accounting, and tax obligations | GDPR Article 6(1)(c) |
| Security, abuse prevention, and the establishment, exercise, or defence of legal claims | GDPR Article 6(1)(f): the Controller’s legitimate interest in protecting the service and its rights |
We do not use questionnaire data for direct marketing or to train our own AI models.
4. AI and automated estimates
Questionnaire answers, the project description, calculation elements, and project requirements are sent through OpenRouter to a selected language-model provider to create the detailed specification. The current configuration uses z-ai/glm-5.2. The routing service or model provider may change if a lawful level of data protection is maintained.
The amount is calculated automatically using factors including solution type, platforms, features, scale, availability, security, compliance, QA, deployment, and any selected revenue-share option, and is then converted using an exchange rate. AI drafts the scope but does not set the price. The result affects the content of the Offer but does not oblige you to enter into a contract. You may ask for an explanation, request human review, or challenge the result by contacting the Controller.
5. Recipients and transfers outside the EEA
Recipients may include hosting and email providers (currently dhosting.pl infrastructure), OpenRouter and the selected AI model provider, Stripe as payment operator, IT support, accounting and legal service providers, and authorised public authorities. The offer report is sent to you and blind-copied to the Controller’s internal mailbox.
OpenRouter, model providers, and Stripe may process data outside the European Economic Area, including in the United States or the model provider’s country. Depending on the recipient, the transfer relies on a European Commission adequacy decision, including the EU–US Data Privacy Framework for certified entities, or on Standard Contractual Clauses and supplementary safeguards. You may request a copy of the applicable mechanism from the Controller.
OpenRouter states that prompt content is not logged by default. A downstream model provider applies its own retention policy. The Controller uses settings intended to exclude model training and selects Zero Data Retention endpoints where they are available. You should nevertheless submit only the information necessary to prepare the estimate.
6. Retention periods
- verification link: 24 hours; questionnaire session: up to 48 hours and removed after the estimate; an expired record is removed during the next storage cleanup;
- abuse-prevention counters: for the applicable limit window—60 minutes for an email address and up to 60 seconds for a standard IP limit—subject to earlier memory eviction;
- technical and security logs: no longer than 90 days unless required to investigate an incident or handle a claim;
- an unaccepted offer, its email copy, and an unpaid payment record: up to 12 months after the last contact if no contract is entered into;
- contract, payment, and correspondence data: for contract performance and then until the applicable limitation period for claims expires; tax and accounting records are generally kept for five years after the relevant tax year;
- data relevant to a dispute or proceeding: until final resolution and enforcement.
7. Your rights
You may request access to, rectification or erasure of your data, restriction of processing, and data portability. You may object to processing based on legitimate interests. These rights may be subject to statutory limitations, for example where data is needed for accounting or legal claims. You may also lodge a complaint with the President of the Polish Personal Data Protection Office (uodo.gov.pl) or another competent EEA supervisory authority.
8. Whether data is required
Providing an email address and the required questionnaire answers is voluntary but necessary to obtain an estimate. Identity, billing, and payment data is necessary to enter into and perform a paid contract. Without this data, the relevant service cannot be provided.
9. Browser storage and cookies
The public Lean Do IT service does not use advertising or analytics cookies. localStorage stores the selected language. sessionStorage stores the one-time session token and email needed to complete the questionnaire. These items are strictly necessary for the requested service. The administrator panel uses a strictly necessary secure session cookie that lasts for no more than 12 hours.
10. Security and responsible input
Measures include encrypted connections, one-time tokens, request-rate and body-size limits, and access controls. No transmission is entirely risk-free. Do not enter passwords, API keys, card numbers, medical data, special-category data, or unnecessary data about third parties.
11. Changes to this Policy
A new version will be published on this page with its effective date. Material changes affecting an ongoing contract will be supplied on a durable medium where required by law.