Privacy — Registered

Version 1.5 | As of: 23.09.2026

Applies to: leano.net – users with a free account (freemium) following email registration. No paid membership, no payment processing.

Change from v1.1: Datadog added as a recipient (infrastructure monitoring/log analysis) under “Tools and services used”. Change v1.3: Cloudflare (WAF/CDN, app level) added as a recipient. Change v1.4: Website host changed from webGo to Hetzner Online GmbH (move on 18.09.2026).

Controller within the meaning of the General Data Protection Regulation (GDPR/DSGVO):

daleap GmbH, Grützmacherweg 6, 13599 Berlin, Germany

Represented by: Karsten Leipnitz (Managing Director)

Email: mail@leano.net | Telephone: +49 30 555 27 30 2 | Website: www.leano.net

Contact for data protection matters: Robert Grolla | Email: privacy@leano.net

Note: daleap GmbH is not required to appoint a data protection officer pursuant to Art. 37 GDPR.

We take appropriate technical and organisational measures to protect your data:

• Encryption of data transmissions (TLS/SSL)
• Access controls and authentication mechanisms
• Regular review of security precautions
• Staff awareness training

By registering a free account, you create a personal user account. Your email address and the content created in the web app are permanently linked to your account and stored on our servers.

Data processed:

• Email address (mandatory for account creation)
• Self-created content within the web app
• Technical usage data (logs, access data)
• Device information (browser, operating system)

No payment data: In the freemium model, no payment or billing data is collected whatsoever.

Retention period:

• Active accounts: As long as the account is active
• Inactive accounts: 1 year after deactivation (option of recovery pursuant to Art. 6(1)(f) GDPR)
• Immediate erasure on request possible at any time

General

We use cookies to analyse the use of our services and to improve the user experience. The legal basis is § 25(1) TDDDG (consent) or § 25(2) TDDDG (technically necessary cookies).

Consequences of a refusal: All core functions of the web app remain available. Only analytics functions are deactivated.

Tools and services used

Third-country transfers: Google Analytics and Datadog transfer data to the USA on the basis of the EU-US Data Privacy Framework (Art. 45 GDPR) and EU Standard Contractual Clauses (Art. 46(2)(c) GDPR). Copy on request: privacy@leano.net.

Note on Datadog (infrastructure monitoring and log analysis): To monitor the availability and performance of our platform and for error analysis we use services of Datadog, Inc., 620 8th Ave., 45th Floor, New York, NY 10018, USA. Log data from our web server is transmitted to Datadog. This contains a truncated IP address (the last octet, or for IPv6 everything from /48 onwards, is removed when the log is written), the browser identifier (user agent), the referrer, the address called up including any query parameters, and a technical session identifier (session cookie ID). No evaluation beyond this for analysis or marketing purposes takes place. A data processing agreement in accordance with Art. 28 GDPR is in place with Datadog. This applies only to freemium and Pro/Branch accounts (platform/web app) – the website leano.net is hosted separately by Hetzner (since 18.09.2026; previously webGo) and does not run on the monitored app infrastructure.

Note on Cloudflare (web application firewall and CDN): To protect our platform against attacks (e.g. DDoS, SQL injection, bot traffic) and to deliver content we use services of Cloudflare, Inc., 101 Townsend St, San Francisco, CA 94107, USA. Technical connection data is processed in the course of this, in particular the full IP address. A data processing agreement in accordance with Art. 28 GDPR is in place with Cloudflare. This applies only to freemium and Pro/Branch accounts (platform/web app) – the website leano.net is hosted separately by Hetzner (since 18.09.2026; previously webGo) and does not run on the app infrastructure protected by Cloudflare.

Note on AWS (Cloud Act): The server location is Germany. As a US company, AWS is subject to the US CLOUD Act. A data processing agreement (DPA) with AWS is in place.

Use of Artificial Intelligence

Should AI functions be implemented in the web app, we will inform you separately before their use in accordance with the EU AI Regulation (EU) 2024/1689.

Variant for private individuals

Cookies requiring consent are only set after your explicit approval. Withdrawal at any time via your browser settings (cookies) or the unsubscribe link in emails (newsletter). The withdrawal does not affect the lawfulness of processing carried out up to that point.

Variant for companies

Consent is given by the authorised representative of the company. Withdrawal informally by email to privacy@leano.net or via the account settings by an authorised person (e.g. administrator).

Registration and use of the web app

• Purpose: Provision of the web app, account management, authentication, personalisation
• Legal basis: Performance of a contract (Art. 6(1)(b) GDPR)
• Retention period: Active accounts permanently; inactive accounts 1 year; immediate erasure on request

Communication and support

• Purpose: Responding to support requests, onboarding emails, system notifications
• Legal basis: Performance of a contract (Art. 6(1)(b) GDPR), legitimate interest (Art. 6(1)(f) GDPR)
• Retention period: As long as necessary to process the request

Analysis and improvement of the services

• Purpose: Analysis of user behaviour, optimisation, error correction
• Legal basis: Consent (Art. 6(1)(a) GDPR) for Google Analytics; legitimate interest (Art. 6(1)(f) GDPR) for internal error analysis
• Retention period: Up to 14 months or until withdrawal

Marketing and newsletter

• Purpose: Sending newsletters and product information
• Legal basis: Consent (Art. 6(1)(a) GDPR)
• Retention period: Until withdrawal

Necessity of providing data

• Registration (6.1): The email address is required for the conclusion of the contract. Without this information, no account can be created.
• Analysis (6.3): Consent to cookies is voluntary – no effect on the use of the app.
• Marketing (6.4): Consent is voluntary – no negative consequences in the event of refusal.

As a data subject, you have the following rights:

• Right of access (Art. 15 GDPR): You may request information at any time as to whether and which personal data we process about you – including details of the processing purposes, recipients, retention period and your rights. On request, we will provide you with a copy of the processed data.
• Right to rectification (Art. 16 GDPR): You may request the rectification of inaccurate personal data or the completion of incomplete personal data.
• Right to erasure (Art. 17 GDPR): You may request the erasure of your personal data, provided that no statutory retention obligations preclude this. This also includes all content created in the app. If you request immediate erasure, all personal data and user content will be irrevocably deleted.
• Right to restriction (Art. 18 GDPR): You may request that the processing of your data be restricted – for example while the accuracy of your data is being verified or if you have objected to the processing. The data will then only be stored but no longer used.
• Notification obligation (Art. 19 GDPR): We will notify all recipients to whom your personal data has been disclosed of any rectification, erasure or restriction of processing, unless this proves impossible or involves disproportionate effort. On request, we will inform you about these recipients.
• Right to object (Art. 21 GDPR): You may object to the processing of your data where this is based on legitimate interests (Art. 6(1)(f) GDPR). We will then no longer process your data unless we can demonstrate compelling legitimate grounds for the processing which override your interests.
• Right to data portability (Art. 20 GDPR): You may request that the data concerning you be provided in a structured, commonly used and machine-readable format and have it transmitted to another controller.

Note on the right to object to direct marketing (Art. 21(2) and (4) GDPR): Where we process your personal data for direct marketing (e.g. newsletters via KlickTipp), you have the right to object to the processing at any time. After exercising the objection, your data will no longer be processed for direct marketing purposes. The objection may be made informally by email to privacy@leano.net or via the unsubscribe link in every email.

No automated decision-making or profiling within the meaning of Art. 22 GDPR takes place.

To exercise your rights, please contact us at: privacy@leano.net. We will respond to your request within one month of receipt. In complex cases, the period may be extended by a further two months, of which we will inform you.

Berlin Commissioner for Data Protection and Freedom of Information (Berliner Beauftragte für Datenschutz und Informationsfreiheit)

Friedrichstraße 219, 10969 Berlin | www.datenschutz-berlin.de

We reserve the right to amend this policy. We will inform you of material changes by email or a notice on the website. You will always find the current version on our website.