Privacy policy

This website sets no cookies and builds no profiles. Fonts and all other assets are served from this domain; your browser makes no requests to third parties when you visit. We measure the site's reach without cookies using Plausible, as described below. The only input on this site, the address of your studio website, is not processed here but handed over to our portal, see below.

You are not obliged to provide any personal data. Without the technical connection data described below, the site cannot be delivered. We make no automated decisions and do no profiling.

Controller

Controller: Leon & Vera OÜ
Data protection officer: heyData GmbH, Schützenstraße 5, 10117 Berlin, Germany, datenschutz@heydata.eu
Address: Sepapaja tn 6, 15551 Tallinn, Estonia
Contact: hello@leonandvera.com · privacy@leonandvera.com

Hosting and server logs

This website is hosted by Vercel Inc., 440 N Barranca Avenue #4133, Covina, CA 91723, USA. When you visit the site, the hosting provider automatically processes technical connection data (IP address, date and time of access, requested resource, browser and operating system information) in server logs. This processing is necessary to deliver the website and to ensure its stability and security (Art. 6(1)(f) GDPR). Transfers to the USA are safeguarded under the EU-US Data Privacy Framework and standard contractual clauses; a copy of the safeguards is available on request. Log data is not merged with other data sources and is kept only as long as needed for security and stability, then deleted.

Reach measurement

We measure the use of this website with Plausible Analytics, a service of Plausible Insights OÜ, Västriku tn 2, 50403 Tartu, Estonia. Plausible sets no cookies, stores no IP addresses and builds no profiles. It records page views, the referring page, browser and device type and the country, aggregated and without reference to any person. The measurement runs through our own domain and is forwarded to Plausible on our server; your browser still makes no request to third parties. The legal basis is our legitimate interest in a data-sparing measurement of reach (Art. 6(1)(f) GDPR). The data stays in the EU.

Entering your website

When you enter your studio website on the start page, it is not processed on this site but handed over in the link to our portal app.leonandvera.com, where you create your account. This policy covers the portal too, see "If you create an account" below. This site does not store the address.

The phone app

Our phone app Leon & Vera uses the same account and the same data as the portal, so everything in this policy applies to it too. What is particular to the app:

You sign in with a four-digit code we send to your email address, or with Google.
The app asks for access to the camera only when you take a photo or record a video, for the microphone only for videos with sound, and for your photos only when you choose a picture or video.
The photos and videos you choose are uploaded to your studio's library.
The app sends us two technical events: that it was opened, and that an error occurred. Each contains the platform and the ID of the app update; an error also says where it happened and what the error was. Both are linked to your account.
The app checks for updates at Expo, our app-update provider, and sends a random install ID with the check.
The app contains no advertising software and no analytics software, and it uses no advertising ID.

If you use our software: processing on your behalf

If you use the software for your studio, we process your prospects' data - who enquires, what they write, which trial session they book - on your behalf. For that you are the controller and we are the processor under Art. 28 GDPR. What that means, which providers we use for it and how we protect the data is set out in the data processing agreement you accept together with the terms when you create your account. For the data of your own account - your e-mail address, your settings, your invoices - we remain the controller, and this policy applies.

Google user data (Google Calendar)

This section applies if you connect a Google Calendar in the portal (Settings, Your studio software). It says which Google user data Leon & Vera accesses, how we use it, with whom we share it, how we protect it and how long we keep it.

What we access. With your permission, through the Google Calendar API (scopes calendar.calendarlist.readonly, calendar.calendars.readonly, calendar.events.freebusy and calendar.events):

the list of calendars you can write to (ID, name, time zone), so you can choose the calendar for trial sessions;
the name of your primary calendar, as the label of the connection;
the busy periods of the calendar you chose - start and end time only, through Google's free/busy query. We do not read the titles, descriptions, attendees or any other content of your appointments.

We also write: for each trial session a prospect books with you, we create one event in the chosen calendar (title: your word for the trial session and the prospect's name; also the prospect's contact, start and end). We never change or delete any other event.

How we use it. Only for the booking feature you switch on by connecting: we calculate free trial-session times from your opening hours minus the busy periods, offer these times to your prospects on your booking page and in the assistant's replies, and enter each booked session into your calendar. We do not use Google user data for advertising, profiling, credit decisions or any other purpose, and we do not use it to develop, improve or train AI or machine-learning models.

How we share it. We do not sell Google user data and do not pass it to advertisers, data brokers or any other third party. The only data derived from your calendar that leaves our systems are the calculated free times (start and end, no content): your prospects see them, and our language-model provider Nebius Token Factory receives them so that the assistant can offer them. Nebius Token Factory does not use customer content to train models. Our hosting and database providers (Vercel, Supabase, see below) process the data only on our behalf under data processing agreements.

How we protect it.

Every connection between your browser, our servers, Google and our providers is encrypted with TLS; our sites are served over HTTPS only.
The tokens Google issues (access and refresh token) stay on the server. They are stored in a database table that is closed to every user account by row-level security, so only our own server functions can read it, and they are never sent to a browser or the app.
The database runs at Supabase in Frankfurt am Main and is encrypted at rest (AES-256).
Access to our production systems is limited to the people who run the service and protected by two-factor authentication.

How long we keep it.

Tokens, the label and the chosen calendar: as long as the connection exists. When you disconnect in the portal's settings, we delete all three at once. You can also withdraw our access at any time at myaccount.google.com/permissions.
Busy periods: used only while the free times are calculated, never stored.
The time zone of your calendar: kept as your studio's time zone, also after you disconnect.
The events we create are yours and stay in your calendar. In the portal we keep the booking (name, contact, time and the event's ID) among your bookings.
When you delete your account, we delete all of this with it.

Limited Use. Leon & Vera's use and transfer to any other app of information received from Google APIs will adhere to the Google API Services User Data Policy, including the Limited Use requirements.

If you create an account

To run your account we store your e-mail address, your studio's name and address, your brand sheet (logo, colours, photographs, texts, prices, opening hours), your settings, your connections and your invoices. The legal basis is the contract with you (Art. 6(1)(b) GDPR). We keep this data as long as your account exists and delete it 30 days after the end, except invoices and payment records, which Estonian accounting law makes us keep for seven years. If you delete your account, we delete the data at once, see "Deleting your account" below.

These providers receive parts of your account data so that we can run the portal. Each is bound by a data processing contract; where one sits in the USA, the transfer rests on the EU-US Data Privacy Framework or standard contractual clauses.

Supabase Inc. (USA): Database and sign-in, hosted in Frankfurt am Main.
Google Ireland Ltd.: If you sign in with Google, Google passes us your e-mail address and name, nothing else.
Vercel Inc. (USA): Hosting of the portal and its server functions, executed in Frankfurt am Main.
Stripe Payments Europe Ltd. (Ireland): Payment and invoices. Stripe collects your card details, billing address, company name and VAT number; card details never reach us. Stripe issues the invoices on our behalf.
Resend Inc. and Loops (USA): System e-mails: sign-in links, notifications, invoices. Occasional news only if you ticked the box; one click stops it.
Nebius B.V. (Netherlands): The language models (Nebius Token Factory): they read your website, your reviews and your inputs and draft answers and texts. No training on your data. Nebius runs the models on servers in the EU and the USA.
PostHog (EU cloud) and Plausible Insights OÜ (Estonia): How the portal is used, without cookies and without profiles; PostHog links the steps to your account so we see where the portal fails you (legitimate interest, Art. 6(1)(f) GDPR).

Measuring our own advertising

If you reach the portal from one of our adverts on Facebook or Instagram, we report to Meta Platforms Ireland Ltd. from our server that the visit led to an account or a payment: your IP address, your browser and the click id from the advert's link, which we keep in your browser's storage for this purpose. We do not send your e-mail address. That is how we learn which advert works. Meta acts under its Business Tools terms and is certified under the EU-US Data Privacy Framework. The legal basis is our legitimate interest in measuring our own advertising (Art. 6(1)(f) GDPR); you can object at any time, see below.

Deleting your account

You can delete your account for the Leon & Vera app, made by Leon & Vera OÜ, at any time. The app and the portal share one account, so it is deleted in both.

How to delete it.

In the app: More → Account → Delete account. Type your email address and tap "Delete everything".
On the web: sign in at app.leonandvera.com, open More and the tile with your studio at the top. Under Your data click Delete account, type your email address and click "Delete everything".
Without access to the app or the portal: write from your account's email address to privacy@leonandvera.com with the subject "Delete my account". We then delete the account for you.

What is deleted. At once, when you delete the account:

your account and its sign-in;
your studio profile and brand details, your Brand DNA and your studio page;
the posts, adverts, films and pictures made in the app, and the photos and videos you uploaded;
your conversations and the drafted answers;
bookings and first-visit requests;
the connections to your studio software and your channels (you can also remove the access of Leon & Vera in your Meta, TikTok or Google settings);
your entry on our mailing list.

Running subscriptions are cancelled at the same time.

What we keep.

Invoices and payment records, which Estonian accounting law makes us keep for seven years.
Our daily database backups, which still contain the data for up to seven days and are then overwritten.
Posts already published on Instagram, Facebook, TikTok or your Google profile, which stay there until you delete them on the platform.

Contact by email

If you contact us by email, we process the personal data you provide (name, email address, content of your message) to handle your enquiry (Art. 6(1)(b) and (f) GDPR). We keep correspondence only as long as needed for this purpose or as required by statutory retention duties. Our email runs on Google Workspace (Google Ireland Ltd. / Google LLC); the same transfer safeguards described above apply.

External links

This site links to brand websites such as sestala.com and robla.fit. Those sites are separate services with their own privacy policies. The call with us is booked on cal.com (Cal.com, Inc., USA), which has its own privacy policy.

Your rights

Under the GDPR you have the right to access, rectification, erasure, restriction of processing, data portability and objection. You also have the right to lodge a complaint with a supervisory authority - in Estonia, the Data Protection Inspectorate (Andmekaitse Inspektsioon, aki.ee) - or with the supervisory authority of your place of residence.

If you are in the United Kingdom, you have the same rights under the UK GDPR and can complain to the Information Commissioner's Office (ico.org.uk). If you are in Switzerland, the Swiss Data Protection Act applies and the Federal Data Protection and Information Commissioner (edoeb.admin.ch) is competent. If you are in the United States, the United States addendum sets out your state rights.

Right to object

Where we process data based on legitimate interests, you can object at any time for reasons arising from your particular situation. Write to privacy@leonandvera.com.

Last updated: 30 September 2026