Privacy policy

Last updated: October 14, 2026.

This Privacy Policy explains how LeanProjax (“LeanProjax”, “we”, “us”) collects, uses, shares, and protects your information when you use our websites, the LeanProjax web application, and the LeanProjax iOS app (together, the “Service”). It applies to both our public/marketing pages and the signed-in product. By using the Service you agree to this policy and to our Terms of Service.

1. Who we are

LeanProjax provides a multi-tenant Six Sigma / DMAIC project workspace. It is founded and operated by Nasser Al‑Sulaihim, a practitioner with fifteen-plus years of operational-excellence work in the banking industry. For data submitted by an organisation's members, that organisation is the data controller and LeanProjax acts as a processor; for account and usage data we describe below, LeanProjax is the controller. Privacy questions: legal@leanprojax.com.

2. Information we collect

• Account data — your name, email address, the sign-in method you use (Apple, Google, or email + password), and, for password sign-in, a salted hash of your password (never the plaintext). Also your country: you choose it on the email sign-up form; with Apple or Google it is taken from your browser's time zone (or, failing that, its language setting) when the account is made, never from your IP address. You can change it in Settings.
• Workspace & project content — the projects, charters, process data, measurements, toolkit runs, files you import, and notes you create. We treat this as confidential to your organisation and scope it to your workspace.
• Usage & product analytics — how you navigate and interact with the Service (pages viewed, features and buttons used, and where flows are abandoned), collected via our analytics provider (PostHog) to improve the product. Session recording is disabled and the analytics SDK does not capture what you type into form fields. We never send project content, measurements or file contents to the analytics provider; the visible label of a control you click is captured, so a name you gave a project can appear in an analytics event. You can opt out (see “Your choices”).
• Diagnostics & error data — when the app errors or crashes, we collect technical diagnostics (error type, stack trace, app version, device/OS, and a coarse request context) via our error-tracking provider (Sentry) to find and fix bugs. We scrub credentials and request bodies and do not enable Sentry's “send default PII” option.
• Voice conversations with the assistant — the in-product assistant (Noura or Khalid, whichever you choose) can hold a spoken conversation with you in the web app. This is optional and starts only when you press Voice and allow the browser to use your microphone; nothing listens before that, and the assistant's presence on a page makes no recording and no request to any AI provider. While a call is open, your microphone audio is streamed to OpenAI, which produces the assistant's speech and a text transcript, and — for questions that need checking — to OpenAI's reasoning model, which works from our reviewed product documentation and, only where you have granted workspace context access, a minimal view of your workspace. We do not store the audio. We store the transcript of what you and the assistant said as part of your support conversation history, with when the call happened and how long it lasted. We build no voice profile and do not attempt to recognise emotion. What you say may itself contain personal or project details — declining workspace context does not filter your own words. You can mute your microphone or the assistant's sound, read captions instead of listening, end a call at any time, hide the assistant for a session or for your account (Settings → Your assistant), and delete a conversation, transcript included, from the Support page. Text support offers the same help without a microphone.
• Log & device data — minimal server request logs (timestamp, path, status code, coarse/anonymised IP, user agent) and, on iOS, standard device identifiers the operating system provides to apps. Retained for a limited period (see “Retention”).
• Emails with our team — members of our team write to some people individually, from their own addresses at leanprojax.com (for example sara@leanprojax.com), to ask for feedback or to introduce the Service. The team is AI-assisted, and every email says so. To make an email relevant to you, the writer may look at what you have published in your professional role (for example on your company's website) or, if you have a LeanProjax account, at how you have used the Service (for example which tools you have tried — never what is in your projects). We keep the emails in the conversation, your name, address and company, and a short note of why we wrote. The first email we send anyone is approved by a person; when you reply, the team member may answer on its own, but anything about prices, contracts, data protection or a complaint goes to a person first. Use the unsubscribe link (many mail apps show it beside the sender's name) or reply “no thanks” at any time, and nobody on the team writes to you again; we keep your address on a do-not-email list so that this stays true. We do not write to account holders who have switched email off in Settings.
• FlowTown game progress — if you play FlowTown, the free game, as a guest, your town (its businesses, staff, coins and settings) is kept only in your browser's local storage. If you play signed in, the same town is also saved with your LeanProjax account, with a few progress numbers (level, experience, time played), so you can carry on from another device. It is game data about a fictional town; it holds nothing from your workspace. Starting over in the game deletes it, and signing out from the game removes it from that browser. Product analytics count a few moments of play (a town ready to play, started, and its first fix at the bottleneck, with the kind of device), never what is in the town. While you play signed in we also keep a short history of your town: its milestones (levels reached, places opened, missed disasters, promotions, demotions, start-overs), the minutes you played each day, saves that could not be stored, and whether your account was made in the game. We use it to help you if your town is ever lost or goes back, and to understand how the game is played.
• Cookies & local storage — a session cookie to keep you signed in, a cookie that remembers which way you last signed in on that browser (Google, Apple or email — never your address) so the sign-in page can offer it first, and local storage for preferences (e.g. theme, analytics opt-out). If you arrive from one of our Google ads, a first-party Google Ads cookie may record that click so we can count game starts and sign-ups that came from advertising; when we count a FlowTown game start, a random id kept in local storage stops that browser's start from being counted twice. If you arrive from one of our Meta ads (Instagram or Facebook), the click id Meta adds to the ad's link is kept in your browser's local storage for the same purpose. See “Advertising measurement” for both. No Meta script or Meta cookie is placed on our pages, and we do not run remarketing.

3. How we use information

• To provide, secure, and operate the Service and keep your data scoped to your org.
• To diagnose, debug, and fix errors, and to monitor reliability and uptime.
• To understand product usage in aggregate so we can improve features and flows.
• To send transactional messages (verification, password resets, magic links, important service notices).
• To write to people individually about the Service, to ask for feedback or introduce it (see “Emails with our team”).
• To prevent abuse, enforce our Terms, and comply with legal obligations.

4. Legal bases (EEA/UK)

Where the GDPR / UK GDPR applies, we rely on: performance of a contract (to provide the Service), legitimate interests (to secure, debug, and improve the Service, to understand aggregate usage, and to write to people individually about the Service — balanced against your rights, with an opt-out for analytics and a plain way to say no in every email), and legal obligation where applicable. We do not report visits to Meta from the EEA, the UK or Switzerland, and the Google Ads tag runs there in its “consent denied” mode (section 5).

5. Analytics, error tracking & your choices

We use PostHog for product analytics and Sentry for error tracking. Neither is used for advertising and neither tracks you across other companies' apps or websites; on iOS we do not use the device advertising identifier, so no App Tracking Transparency prompt is required.

Advertising measurement. When we run Google Ads campaigns, we use the Google Ads conversion tag on the web only to count how many people who clicked an ad went on to start playing FlowTown, create an account or create their first project. A FlowTown start means opening a new town for play, not visiting the page. It is counted at most once per browser, for guests and signed-in players alike, until that browser's site data is cleared (Safari clears it after seven days without a visit). It is used for measurement, not for building advertising profiles: ad personalisation is disabled, we do not run remarketing, and we never send your project content to Google. In the European Economic Area, the United Kingdom and Switzerland the tag runs in a “consent denied” mode by default, which means it sets no cookies there. We additionally omit FlowTown game-start conversions when the browser's time zone is in an excluded region or cannot be determined. A game-start conversion contains an opaque deduplication identifier, the game page and the website you came from (its address only, never the page), never your account ID, email or town contents. We do not enable enhanced conversions. Switching usage data off prevents our conversion events and tells an already-loaded Google tag to use denied consent; on subsequent page loads the tag is not loaded. Pending game starts are cancelled and are not replayed when usage data is switched back on.

Meta (Instagram and Facebook) ads. When we run ads on Instagram or Facebook for FlowTown, our server reports a few moments to Meta's Conversions API, so we can see which ads bring players: a game started, the first fix at the bottleneck, and a new account, each at most once per browser. A report is sent only if you arrived from one of our Meta ads in the last seven days, and never from the European Economic Area, the United Kingdom or Switzerland (judged by your browser's time zone and by your internet address; when either cannot tell where you are, nothing is sent), nor when you have switched usage data off or your browser sends Global Privacy Control. A report contains the click id from the ad's link, your IP address and browser type (which Meta uses to match the report to that click), the moment and the page; for a new account, also a one-way hash of your email address (SHA-256, the form Meta uses to match it with accounts it already knows), never the address itself, your name or anything from the game or your workspace. We ask Meta to process these reports under its Limited Data Use setting, which restricts how Meta may use them in the US states whose laws give people that choice. There is no Meta script and no Meta cookie on our pages, and we do not run remarketing.

In the iOS app, we use Google Analytics for Firebase for the same limited purpose: counting app installs, sign-ups and sign-ins that result from our ads, and understanding aggregate app usage. Install attribution uses Apple's privacy-preserving SKAdNetwork, which reports campaign results in aggregate only. The app never reads the device advertising identifier (IDFA), never shows an App Tracking Transparency prompt, and never sends your project content to Google. The iOS analytics opt-out in Settings also stops Firebase collection.

Opt out of analytics at any time: on the web, use the privacy toggle in Settings, or in FlowTown, Menu → Usage data (where a guest has no Settings page); on iOS, use the privacy toggle in Settings. Opting out stops product-analytics collection and advertising measurement, Google's and Meta's alike, in that browser or app. A browser that sends Global Privacy Control is never measured for advertising. Error/diagnostic reporting may continue at a minimal level because it is necessary to operate the Service securely.

6. Sub-processors & sharing

We share data only with vetted providers that help us run the Service:

• Railway — cloud hosting / infrastructure.
• Sentry — error and crash diagnostics.
• PostHog — product analytics (US data region).
• Google (Firebase Analytics / Google Ads) — aggregate advertising measurement: web conversion counting and iOS app-install and sign-up measurement, as described in section 5. No advertising profiles, no remarketing, no IDFA.
• Meta Platforms — advertising measurement for our Instagram and Facebook ads: the server-to-server reports described in section 5, under Meta's Limited Data Use setting. No Meta script or cookie on our pages, no remarketing.
• Better Stack — uptime monitoring.
• Email provider — transactional email delivery, and the emails our team sends and receives.
• OpenAI — powers our in-product assistant (Noura or Khalid): the messages you write to the assistant, and, when you choose a voice call, your microphone audio and its transcript (see “Voice conversations with the assistant” above); and, when enabled, drafts an automated reply to support tickets you submit, from the ticket's subject and description. Under OpenAI's API data-use policy this content is not used to train their models; we instruct OpenAI not to store voice sessions, and we cannot promise more than OpenAI's own terms allow. Your project content is sent only where you have granted the assistant workspace context access, and never for ticket drafting.
• Anthropic — powers the internal assistants our own team uses to operate the Service. When we ask them to, they read what an administrator can see in our admin tools (for example account names and email addresses, support tickets and platform health) and draft replies to support tickets, which a person reviews before anything is sent to you, and write the emails our team sends (see “Emails with our team”). They do not act on your account on their own. Under Anthropic's commercial terms this content is not used to train their models.
• Apple and Google — sign-in (SSO) when you choose them; Apple for iOS app distribution and push notifications; Google also for advertising conversion measurement on the web when we run campaigns (see section 5).

We do not sell, rent, or share your project content for others' advertising, and we do not train AI models on your project content. We may disclose information if required by law or to protect the Service and our users. A current sub-processor list is available on request from legal@leanprojax.com.

7. International transfers

Our providers may process data in the United States, the European Union, and other regions. Where required, we rely on appropriate safeguards (such as Standard Contractual Clauses) for cross-border transfers.

8. Retention

We keep account and workspace data for as long as your account is active. Server logs and error diagnostics are retained for a limited period (logs ~30 days; error events per our provider's retention, typically 30 days). Audit records — who did what in a workspace, which is what lets an approval or a sign-off be checked later — are kept for 24 months and then deleted automatically. When you delete your account we delete or anonymise associated personal data within 30 days, except where we must retain it for legal or security reasons; audit records outlive the account for the remainder of that 24 months, because they are the record that the deletion happened lawfully.

Voice conversations with the assistant. Voice transcripts are kept for 90 days and then deleted automatically. Records of the call itself (its timing, the models used, why it ended — no content) are kept for the same period. Accounting entries (minutes used) and any support ticket you confirmed during a call follow the retention of billing records and support tickets respectively. You can delete a support conversation, transcripts included, at any time from the Support page; anything the assistant has already said to you cannot, of course, be un-heard by deleting a transcript.

FlowTown. A signed-in player's saved town is kept while the account exists and is deleted with it, or at once when the player starts over in the game. The town's history (milestones, daily minutes played, saves that could not be stored) is kept for 12 months and then deleted automatically; starting over does not delete it, because it is the record of what happened to the town. The note that an account was made in the game is kept while the account exists. All of it is deleted with the account.

Emails with our team. A conversation is kept for 24 months after its last email and then deleted automatically. An address on the do-not-email list is kept for as long as we run the team's email, because deleting it would let us write to you again.

Advertising measurement. The ad click id kept in your browser is replaced by the next ad you arrive from, and goes when you clear the site's data; we stop reporting under it seven days after the click. The random id that keeps a FlowTown game start from being counted twice stays in your browser until you clear the site's data. Reports already sent to Google or Meta are kept under their own terms.

LeanProjax Academy. If you enrol in a class, your class records — your enrollment, submissions and the project snapshots in them, released feedback, attendance, lesson progress, knowledge-check answers and completion record — are kept for 24 months after the class end date and then deleted automatically. Your private class notes belong to you and are deleted with your account, or earlier on request. Courses, decks and other teaching material belong to the teaching workspace that made them and follow that workspace's retention. When you close your account, your name is removed from class rosters, submissions and attendance; a completion record keeps the name it was issued under. You can download your Academy record as JSON at any time while you are enrolled and for 30 days after you withdraw or are removed from a class, from My learning.

9. Security

We use encryption in transit (TLS), tenant isolation enforced in the database and application layers, scoped access controls, and credential hashing. No method is perfectly secure, but we work to protect your data and to limit what our providers receive. Our security & trust page describes the controls — and the gaps — in detail.

10. Your rights

Subject to your jurisdiction (GDPR / UK GDPR / CCPA and others), you may access, correct, export, or delete your data, object to or restrict certain processing, and opt out of analytics. You can export each project to Excel and PDF from the project page, export your Academy record as JSON from My learning, delete your account from Settings, or contact legal@leanprojax.com. We respond within 30 days. We do not sell personal information. Reporting an ad's results to Meta (section 5) could count as “sharing” under some US state laws: we ask Meta to process those reports under its Limited Data Use setting, we honour Global Privacy Control, and you can switch it off at any time in Settings or in FlowTown's Menu (“Usage data”).

11. Children

The Service is not directed to children under 16, and we do not knowingly collect their data. If you believe a child has provided us information, contact us and we will delete it.

12. Mobile (iOS) specifics

The iOS app collects the same categories described above. Our App Store privacy disclosures reflect the diagnostics and product-analytics data we collect. We do not track you across other companies' apps or websites. You can opt out of product analytics in the app's Settings.

13. Changes

We will post material changes on this page with a new “last updated” date and, where appropriate, notify signed-in users. Continued use after a change constitutes acceptance.

14. Contact

Questions or requests: legal@leanprojax.com.