Privacy Policy — LeafProton

Version 1.3

1. In short

Plain-language summary. It does not replace the text: in case of divergence, the full text prevails.

• We use your data to make the product work, bill you when there is a paid plan, protect the platform and talk to you. We do not sell your data.
• There are two roles in this story. About your account, we decide and we are accountable. About what your forms collect from other people, you decide — we only process.
• Processing takes place in more than one country. Section 9 says exactly who, for what and where.
• We keep access records for 6 months because the law requires it and for security.
• On the website, measurement with cookies only happens if you accept. Without your acceptance, Google receives only signals with no cookie and no identifier, for estimates. The platform has no third-party measurement — section 12.
• You can access, correct, export and delete your data — section 14.
• If you responded to another organization's form on LeafProton, talk to whoever created the form: the data belongs to them, not to us.

2. Who is responsible and how to reach us

2.1. The processing described in this Policy is carried out by the operator of the LeafProton platform (leafproton.com and app.leafproton.com), which acts as controller of the data described in section 5.

2.2. Data protection channel. Questions, data subject requests and communications about privacy must be sent to privacy@leafproton.com. It is the official, monitored and sole channel for these matters.

2.3. We will reply identifying the person responsible for handling the matter whenever the law applicable to your case requires the appointment of a named responsible person.

3. Who this Policy applies to

4. The two roles: when we decide and when we only execute

4.1. Data protection legislation separates whoever decides on the processing (controller) from whoever executes the processing on behalf of another (operator or processor). At LeafProton, both cases exist — and that separation defines whom you should contact.

4.2. As processor, we do not decide which data will be collected, for what purpose, for how long it is stored or with whom the customer shares it outside the platform. We follow the configuration made by the customer and the documented instructions in Annex I of the Terms of Service.

4.3. Therefore, data subject requests about data collected through a customer's form must be addressed to the customer. If they reach us, we will forward them to the customer and inform the data subject about the forwarding (section 14.5).

5. What data we process

5.1. Sign-up and profile

Name, surname, email, phone (optional), password (stored only as a hash, never in clear text), profile photo when you upload one, language, time zone, visual theme and notification preferences.

5.2. Authentication, sessions and security

• Sign-in and session records: date, time, IP address, browser and device identification, and the end of the session.
• Verification codes sent by email (stored only as a hash, with an expiry time and for single use).
• Two-step verification key, when enabled, stored encrypted.
• When you sign in with Google: your account identifier at the provider and the email it confirms. We do not access your calendar, your contacts, your files or any other data of your Google account.
• Anti-bot challenge signals used to distinguish a person from automation.
• Record of acceptance of the Terms: accepted version, date, time and IP address.

5.3. Access records

Records of the date, time and IP address of use of the Service, kept for the period in section 11. They serve the security of the platform and compliance with legal requirements to keep connection and access records.

5.4. Product usage and technical records

Pages and features accessed, actions performed, errors, response times, request volume, consumption of the storage quota and of AI features, and an audit trail of administrative changes (who changed what and when).

5.5. Customer content

Forms, flows, dashboards, responses, attachments, external values and conversations with the assistant. We process this content as processor (section 4) — we access it only when necessary to operate the Service, investigate an incident, comply with a legal requirement or provide support you request.

5.6. Billing

On paid plans: name or company name, tax identification document, address, billing email, invoice and payment history. Full card data neither passes through us nor is stored by us — it stays with the payment processor (section 9).

5.7. Communication and support

Messages you send us, support requests and whatever is necessary to answer them. In the emails we send, we record delivery, bounces, opens (through a tracking image) and clicks, to diagnose delivery failures and to measure whether the notice arrived. You can block images in your email reader to prevent the recording of opens.

5.8. Data of people who respond to forms

Everything the customer decides to ask in their form, plus the technical record of the submission (date, time, IP address, browser identification) and the attached files. This data belongs to the customer — see section 4.

5.9. Website browsing and ad measurement

Before you accept, or after you reject, the Google tag loads on leafproton.com, but it stores no cookie and no identifier of your browser. Google receives only signals about the visit: the page, the time, the type of browser, the state of your choice and, when you arrived through one of our ads, the identifier of the click on that ad, which comes in the page address. Google uses these signals only for aggregate estimates of visits and conversions.

If you accept visit and ad measurement, Google Analytics records a random identifier of your browser, the pages viewed, where the visit came from (which website or search brought you), the type of device, the browser, the language and the approximate region. Google Ads records whether the visit came from one of our ads, so we can measure the results of our ads. We do not use this data for personalized ads or remarketing.

Measurement never uses your name, your email or your account, and it only happens on the website — not in the product nor in the forms. Google Analytics does not store the IP address.

6. Where the data comes from

1. From you, when you sign up, use, configure, subscribe or write to us.
2. From your use, generated automatically by our systems (records, measurements).
3. From the identity provider, when you choose to sign in with Google.
4. From one of our customers, when they enter third-party data into the platform — in which case we act as processor and it is up to them to inform the data subject.
5. From the payment processor, regarding the status of invoices and charges.

7. What we use it for and on what legal basis

The bases below use the terminology common to the main data protection laws. The basis applicable to you is the one provided in the legislation of your country (section 18).

7.1. About legitimate interest. Where we rely on legitimate interest, we assess in advance the purpose, the necessity and the impact on you, we use the minimum sufficient data and we do not carry out, on that basis, processing you would not expect. You may object through the channel in section 2 — and, where applicable, we will stop carrying it out, unless there is an overriding ground.

7.2. We do not sell, rent or assign personal data to third parties for advertising, and we do not carry out advertising profiling.

7.3. We do not use customers' content to train artificial intelligence models, our own or third parties'.

8. When the processing depends on your consent

8.1. Almost everything we do relies on contract, legal obligation or legitimate interest — not on consent. Where consent is the basis (for example, website visit and ad measurement with cookies, section 12, or commercial communication to someone who is not a customer), it is collected prominently and can be withdrawn at any time, without affecting the lawfulness of what was done before.

8.2. Withdrawing consent to commercial communication does not stop the transactional messages necessary for the Service (security notices, invoices, changes to the terms).

9. Who we share it with

9.1. We share personal data only with those necessary for the Service to work, to the minimum indispensable extent, under a contract that imposes security and confidentiality obligations and prohibits use for the vendor's own purposes.

9.2. Categories of vendors and what each one processes:

9.3. Who they are, and where they process. The named and up-to-date list — with the country of processing of each vendor — is published at leafproton.com/en/legal/subprocessors/ and forms part of this Policy. It is updated when a vendor joins or leaves; replacing a sub-processor that processes customer data follows the prior notice in the Terms (Annex I, A5.2).

9.4. AI features. AI model vendors only receive data when you use an AI feature, and receive only what is necessary for the task (the file sent to the assistant and the conversation). No AI feature is run on your content on our initiative. The rest of the product — forms, responses, flows and dashboards — works without sending anything to these vendors.

9.5. Other cases of sharing:

1. Authorities and courts — upon a court order, a request from a competent authority or a legal obligation. We will inform the data subject or the customer whenever not legally prohibited.
2. Defense of rights — to lawyers, auditors and experts, to the extent necessary in administrative, judicial or arbitration proceedings.
3. Corporate reorganization — to an acquirer, successor or investor, in the event of a merger, acquisition, spin-off or sale of assets, keeping the purposes of this Policy and with prior notice to data subjects.
4. At your request — when you set up an integration, a webhook, a delivery to a third-party system or connect a third-party AI to your account (section 9.6). In that case, the processing carried out by the recipient is governed by its own policy, not by this one.

9.6. Connected AI. When you connect a third-party AI of your choice to your account, it receives the data it requests, within the scope you authorized and the permissions you have in each space; the processing it carries out belongs to that AI's provider. On our side, we record the authorization — who authorized it, when, which AI, the address the authorization returned to, the scope and the version of the Terms accepted — and, for 90 days, the actions each connection took, without the content of the data. The connection expires in 7 days and can be undone at any time in your account.

10. International data transfer

10.1. As the vendor list shows (section 9.3), processing takes place in more than one country — in particular at the infrastructure, anti-bot, identity and AI model vendors. Depending on where you are, this may constitute an international transfer.

10.2. These transfers rely on the mechanisms admitted by the legislation applicable to you: standard contractual clauses, adequacy decisions for the destination country, equivalent contractual safeguards, or the necessity of the transfer to perform the contract you requested.

10.3. Website visit and ad measurement (section 5.9) is processed by Google, in Google Analytics and Google Ads, in the United States, with the contractual safeguards the vendor offers for the international transfer. With cookies, it only happens if you accept; without your acceptance, only the cookieless signals of section 5.9 reach Google.

10.4. If you do not want your content to be transmitted to AI vendors in other countries, do not use the AI features: the rest of the Service works fully without them.

11. How long we keep it

11.1. Once the periods end, the data is deleted or anonymized, except where the law requires or authorizes its retention — legal obligation, exercise of rights, or use exclusively by us in anonymized form.

11.2. Backups follow their own rotation cycle and may temporarily contain data already deleted from the production environment. They are restored only in the event of a disaster and are subject to the same security controls.

12. Cookies and storage in your browser

12.1. Essential and measurement. Most of what we store in your browser is essential: without it the website, the product or the form do not work, or forget a choice you made yourself. The only thing that is not essential is website visit and ad measurement, and it only stores cookies if you accept. We do not use cookies for personalized ads, remarketing or social media. With your acceptance, we only measure whether the visit came from one of our ads.

12.2. On the website (leafproton.com):

12.3. On LeafProton (app.leafproton.com):

12.4. On the public form (the link of a form opened directly):

12.5. Consent on the website. On your first visit, the website shows a notice with three options of equal weight: accept, reject or choose by category. The Google tag loads on every visit but, before you accept and after you reject, everything stays denied: it stores no cookie and only sends Google the cookieless, identifier-free signals of section 5.9. Accepting enables visit and ad measurement; personalized ads and remarketing are always denied. Your choice is valid for 6 months; after that the notice asks again, and it also asks when the notice changes. You can change your mind whenever you want through the "Cookie preferences" link in the footer of every page: when you withdraw consent, measurement with cookies stops and the Google Analytics and Google Ads markers are deleted from your browser.

12.6. On the platform, only a notice. LeafProton and the public forms have no advertising nor third-party measurement, and that is why they do not ask for consent: the notice shown there only informs what stays in the browser. Whoever has already answered the website notice does not see it again. Forms embedded in a customer's website do not show our notice — whoever publishes them is responsible for their own page.

12.7. How to delete. You can delete this data in your browser settings. If you delete the session credential, you are signed out; if you delete the record of your choice, the website notice asks again.

13. Security

13.1. We adopt technical and administrative measures compatible with the risk and with the state of the art, including:

• encrypted traffic (TLS) between you and the platform;
• passwords stored only as a hash, with an algorithm designed for passwords;
• two-step verification available for all accounts, with the key encrypted at rest;
• sessions recorded on the server, revocable at any time, and a notice of sign-in on a new device;
• data isolation per space, with role-based access control;
• temporary, signed links to access files, instead of public files;
• request limits, anti-bot challenge and blocking of internal destinations in outbound integrations;
• audit trail of administrative changes;
• internal access restricted to what is necessary, under a duty of confidentiality.

13.2. No system is completely secure. These measures reduce the risk but do not eliminate it, and they do not represent a guarantee of inviolability. Security also depends on you: a strong and unique password, two-step verification enabled and care about whom you invite to your spaces.

13.3. Incidents. If a security incident with relevant risk to data subjects occurs, we will notify the competent authority and the data subjects within the time limits and in the manner required by the applicable legislation. When the incident affects data for which we act as processor, we will notify the controlling customer, who is responsible for notifying the authorities and the data subjects. Notifying an incident does not mean admitting fault or liability.

14. Your rights and how to exercise them

14.1. Depending on the legislation applicable to you, your rights include:

1. confirmation of the existence of processing and access to the data;
2. correction of incomplete, inaccurate or out-of-date data;
3. deletion, anonymization or blocking of unnecessary or excessive data, or of data processed in breach of the law;
4. restriction of processing in certain situations;
5. portability to another provider, in a structured and commonly used format;
6. objection to processing based on legitimate interest;
7. withdrawal of consent, when that is the basis of the processing;
8. information about whom we share your data with and about international transfers;
9. review of automated decisions, within the limits of section 16;
10. not being discriminated against for exercising any of these rights.

14.2. How to request. You can handle much of it yourself, in the account preferences: view and correct data, change your email and password, end sessions, export content and delete the account. For everything else, write to privacy@leafproton.com.

14.3. Time limits. We respond immediately to requests for confirmation and access in simplified format and, in other cases, within 15 (fifteen) days — or within the shorter period required by the legislation applicable to you. Complex requests may have this period extended, with notice and justification.

14.4. Identity verification. To protect you, we may ask for additional information confirming your identity before handling the request. A request that cannot be securely attributed to a data subject will not be handled — and that is protection, not refusal.

14.5. When we cannot comply. We may decline to comply, in whole or in part, when:

• the data is part of processing in which we are the processor — in that case, we forward the request to the controlling customer and inform you, identifying them when permitted;
• the law requires us to keep the data (for example, access records and tax documents);
• keeping it is necessary for the regular exercise of rights in proceedings;
• complying would mean breaching a commercial or industrial secret, or exposing third-party data.

In any of these cases, we will inform you of the reason.

14.6. Complaint. You can complain to the data protection authority of your country and to the competent consumer protection bodies. We only ask for the chance to resolve it with you first.

15. Children and adolescents

15.1. LeafProton is not intended for people under 18, or under the age of majority in the data subject's country, whichever is higher, and does not allow them to create accounts. Upon learning of an account created by a minor, we will close the registration.

15.2. If a customer uses the Service to collect data from children or adolescents through forms, the customer is the controller of that processing and is responsible for observing the applicable rules, including regarding the consent or authorization of whoever exercises parental responsibility.

16. Automated decisions and artificial intelligence

16.1. We do not make automated decisions with legal effect on you. What exists on our side are automatic security controls (request limits, anti-bot challenge, blocking of suspicious attempts), which temporarily restrict access and never define a right of yours. In case of an undue block, write to the channel in section 2 and we will review it with human intervention.

16.2. The product's automations — flows that approve, reject, classify or charge — are configured and operated by the customer. If an automated decision affected you in some organization's process, the request for review must be addressed to that organization.

16.3. AI features produce suggestions that depend on being applied by a person. They may err, and must not be used as professional advice.

17. Communications we send

18. Data subjects in different countries

18.1. The product is offered in several languages and used in more than one country. The data protection law that applies to you is that of the place where you are, when that law reaches the processing described here. This Policy was written to work under the main laws in the field, which share the same structure: legal bases, data subject rights, purpose limitation and accountability.

18.2. In any country, we honor the rights in section 14 through the channel in section 2, without distinction — even when your local law would not require them.

18.3. Where the legislation applicable to you grants rights in addition to those listed in section 14, those rights will also be honored, within the time limits it sets.

18.4. Where the applicable legislation requires the appointment of a named responsible person or of a local representative, we will comply with the requirement and publish the contact in this Policy.

19. Changes to this Policy

19.1. This Policy may be updated to keep up with changes in the product, in the vendors or in the law.

19.2. Wording adjustments, correction of clerical errors and updates of contact channels take effect upon publication.

19.3. The version in force is always the one published at leafproton.com/en/legal/privacy/, with the version number at the top. Previous versions are archived and may be requested through the channel in section 2.

19.4. Languages. This Policy may be published in several languages. The official version is the one published in Portuguese, at leafproton.com/pt/legal/privacidade/; the others are courtesy translations and, in case of divergence of interpretation, the official version prevails.

Version history

20. Contact

• Privacy, personal data and data subject rights: privacy@leafproton.com
• Support and general matters: support@leafproton.com
• Contractual matters: legal@leafproton.com