Privacy notice

This site is operated by Lean IA Ltd (company number 11867398), a private company limited by shares registered in England and Wales, trading as Leania.

Registered office: [PENDING — owner to paste current registered office from Companies House]

[PENDING ICO self-assessment]

The enquiry form collects your name, work email, firm, role and the operational details you choose to share about a workflow. It exists to prepare a substantive first conversation; we do not run automated marketing sequences on it.

Session attribution (UTM parameters and the first page you landed on) is stored in your browser for the session and attached to your enquiry so we know which channel worked.

Site analytics run on Plausible, which is cookieless and records no personal data — no advertising or cross-site tracking scripts are present, which is why this site shows no cookie banner.

Marketing contact happens only if you tick the optional consent box, and the consent source and time are recorded.

Processors used to run this site and the enquiry process: Supabase (site database and form processing, hosted in the London region), Lovable (site build and hosting), Plausible (privacy-preserving analytics — cookieless, no personal data), Attio (client relationship records), Calendly (scheduling), Fireflies (call transcription, engaged only after a booked call — never on this website).

Form submissions are stored with row-level security that denies all public access; credentials for third-party systems exist only server-side.

How long we keep information, by category:

Unconverted enquiries and CRM records: up to 24 months after the last meaningful interaction, then deleted or anonymised unless an unresolved legal, contractual or security reason applies.

Booking and meeting-administration records: up to 24 months after the meeting or last meaningful interaction, unless converted into an engagement.

Active marketing records: retained while subscribed; inactive records reviewed after 24 months.

Marketing opt-outs: the minimum suppression record needed to prevent further marketing is retained.

Raw client datasets, uploads and source evidence: returned or securely deleted within 90 days of final acceptance or termination, unless the statement of work, a legal obligation or an active dispute requires otherwise.

Intermediate analysis and working files: up to 12 months after engagement completion, unless part of the agreed deliverable, acceptance record or contractual evidence.

Contracts, statements of work, invoices, acceptance records, final deliverables and records necessary to establish contractual performance: normally six years.

Deleted information may remain in encrypted provider backups until the relevant backup cycle expires.

You can ask for a copy, correction or deletion of your data at any time: [PENDING mailbox].