This policy explains what personal data Leaf processes, why, for how long, and how to exercise your rights. It covers getleaf.dev, the dashboard (app.getleaf.dev) and connecting your AI to Leaf.
Who is responsible
The controller is TIPIT SRL, Rue Médart, Forv. 3, boîte B, 5380 Fernelmont, Belgium, enterprise number 1007.088.147. For any question about your data: [email protected].
Our customers’ sites
Sites hosted by Leaf belong to our customers. For the data of their visitors and users (forms, accounts, databases, purchases), the customer who publishes the site is the controller and Leaf is its processor. If you visited such a site, contact its publisher first; we will help them answer you.
For these sites, Leaf counts visits without cookies: a visitor is represented by an anonymous fingerprint, computed from the IP address, the browser, the day and a secret value, which changes every day. The IP address is not kept in these statistics. They also record the page, the country, the type of device, the browser and where the visit came from, and are kept 90 days.
What we process, why, and on what basis
Your account
- Data: email address, name, profile picture if you sign in with Google, chosen language; for each session, the IP address and the browser.
- Why: to sign you in, keep your account secure, and write to you about the service (sign-in links, invitations, important notices).
- Legal basis: performance of the contract; our legitimate interest in protecting accounts.
- How long: as long as the account exists. A session expires after 7 days without use.
Your organisation
- Data: the organisation’s name, members and roles, invitations (the invited person’s email address), projects and what happens in them, with the name of the person who did it.
- Why: to run the organisation and show who changed what.
- Legal basis: performance of the contract.
- How long: as long as the organisation exists; an invitation expires if it is not accepted.
Billing
- Data: name or company name, address, VAT number, plan, payments, usage, invoices. Card numbers are typed at Stripe and never reach us.
- Why: to collect the subscription and credits, issue invoices, and keep our accounts.
- Legal basis: performance of the contract; our accounting and tax obligations.
- How long: invoices and accounting records, at least 7 years as Belgian accounting law requires, and up to 10 years where tax law asks for it. Usage stays recorded for the month’s bill, even after a project is deleted.
Usage and technical logs
- Data: requests our servers receive (IP address, date, address requested, browser), each project’s usage, updates, your projects’ errors.
- Why: to run and secure the service, prevent abuse, and measure the usage we bill.
- Legal basis: our legitimate interest in a secure service; performance of the contract for usage.
- How long: our servers’ logs, for a limited time, as long as security needs; a project’s errors, only the latest lines, deleted with the version that produced them.
Emails
- Data: for each email Leaf sends (to you or, for your sites, to your users), the recipient, the subject, the date, and what the sending service reports (delivered, bounced). The messages you write to us.
- Why: to send the service’s emails, to answer “I never got the link”, and to help you.
- Legal basis: performance of the contract; our legitimate interest in helping you.
- How long: the log of sent emails, 90 days; your messages to support, as long as the request takes, then at most 3 years.
Connecting your AI
- Data: which AI application is connected, for which person and organisation, since when; what it does on Leaf on your behalf.
- Why: to let your AI work on your behalf, with your role, and let you cut the connection at any time.
- Legal basis: performance of the contract.
- How long: as long as the connection exists; the history of changes stays in the project.
Your AI (Claude, ChatGPT, Mistral or another) is not a Leaf provider: your conversations with it are processed by its provider, under its own terms. Leaf only receives what your AI sends it to build your project.
AI and the web in your apps
When the code of one of your apps calls an AI or reads a web page, the content of the call goes through our provider (Vercel AI Gateway for AI, Firecrawl for the web) to the provider concerned. Leaf does not keep that content: only the model, the number of tokens processed, the cost and the date, for billing.
getleaf.dev
This site sets no cookies and loads no analytics or advertising tools. Our servers receive the technical information of each request, processed as described above. See the cookie policy.
Who receives your data
Your data is processed by the Leaf team and by our providers, only to provide the service. The list, with what each one processes and where, is on the Subprocessors page. We may also disclose it to an authority that lawfully asks us. We do not sell your data and do not use it for advertising.
Transfers outside the European Union
Our main platform is hosted in Germany. Some providers are based in the United States (Cloudflare, Stripe, Resend, Vercel, Firecrawl, Google). These transfers rely on the EU-US Data Privacy Framework when the provider is certified, and otherwise on the European Commission’s standard contractual clauses.
Security
Access is limited to the people who need it, your projects’ secrets are encrypted, and connections are encrypted (HTTPS). The Security page describes what we do.
Your rights
You may ask for access to your data, its rectification, its erasure, the restriction of its processing, its portability, and object to processing based on our legitimate interest. Write to [email protected]; we answer within one month and may ask you to confirm your identity.
You can also act yourself in the dashboard: export a project, delete a project, an organisation, or your account (the Account page, from your profile menu). Deleting your account also deletes the organisations you are the only member of; invoices stay kept as the law requires.
If you believe your rights are not respected, you may lodge a complaint with the Belgian Data Protection Authority (Autorité de protection des données), rue de la Presse 35, 1000 Brussels (dataprotectionauthority.be).
Children
Leaf is not intended for people under 16.
Changes
We may change this policy. The date at the top of the page shows the latest version; for a significant change, we tell you by email or in the dashboard.