← Back home

Privacy Notice

Last updated: May 20, 2026

This Privacy Notice explains how Lean Back Navigator LLC, doing business as Lean Back Navigator (the "Service") ("we", "us", "our"), collects and processes your personal data. We act as the data controller of personal data you provide to us.

1. Our Privacy Commitment

Lean Back Navigator is built privacy-first. Your mail and documents are yours. We do not sell your data, we do not share the contents of your documents with advertisers, and we do not use your documents to train AI models.

2. Personal Data We Collect

• Account data: email address, full name, password hash.
• Mail & document content: files you upload or scan, extracted text (OCR), sender, subject, summary, dates, amounts, tags.
• Usage data: scan counts, storage used, feature usage, and basic telemetry.
• Technical data: IP address, device type, browser, log timestamps (kept short-term for security).
• Support communications: messages you send us.

3. Why We Process It & Legal Basis

• Provide the Service (account, scanning, classification, summaries, search) — performance of our contract with you.
• Billing & subscription management — performance of contract and legal obligation.
• Security & fraud prevention — legitimate interest in keeping the Service safe.
• Product improvement (aggregated, non-content metrics only) — legitimate interest.
• Customer support — performance of contract.
• Legal compliance — legal obligation.

4. Who We Share Data With

• Service providers (subprocessors): Supabase (hosting, database, authentication, storage), and AI processing providers used to OCR and summarise your documents. They process data only on our instructions.
• Paddle.com — our Merchant of Record for payments, subscription management, tax compliance, and invoicing. Paddle collects and processes payment data directly.
• Professional advisers (legal, accounting) where strictly necessary.
• Authorities where required by law.

We do not sell your personal data and do not share document contents with advertisers.

5. Data Retention

We keep your account and documents for as long as your account is active. On deletion, your documents and personal data are permanently removed within 30 days, except where we are required by law to retain certain records (e.g. invoices) for longer.

6. International Transfers

Data may be processed in countries outside your own (including the EEA, UK, and US). Where this happens we rely on appropriate safeguards such as Standard Contractual Clauses or adequacy decisions.

7. Your Rights

Depending on your jurisdiction, you have the right to:

• Access the personal data we hold about you;
• Rectify inaccurate data;
• Erase your data ("right to be forgotten");
• Restrict or object to certain processing;
• Data portability (export);
• Withdraw consent where processing is based on consent;
• Lodge a complaint with your local data protection authority.

We aim to respond to requests within one month. Contact us through the support channel in your account.

8. Security

We use appropriate technical and organisational measures to protect your data, including encryption in transit (TLS), encryption at rest, strict access controls, and row-level security on our database so users can only access their own data.

9. Cookies

We use only essential cookies and local storage required to keep you signed in and to operate the Service. We do not use advertising or cross-site tracking cookies.

10. Changes

We may update this Privacy Notice. Material changes will be notified by email or in-app.

11. Contact

For any privacy question or to exercise your rights, contact Lean Back BBQ LLC through the support channel in your account.