Privacy Policy
Last updated: 2026-10-21
1. Who we are and how to reach us
Lepsto (formerly Lessly) is operated by Apliteni OÜ, a private limited company registered in Estonia (registry code 14296961, Tornimäe tn 3 // 5 // 7, Tallinn, Estonia).
For all privacy-related questions, requests, or complaints, contact us at privacy@lepsto.com. We aim to respond within 30 days.
We do not have a designated Data Protection Officer (DPO). For GDPR inquiries, privacy@lepsto.com reaches the person responsible directly.
2. What data we collect and why
We collect only what we need for each stage of the product.
When you visit our website
Our analytics are cookieless unless you allow statistics cookies in the consent banner. If you allow them, the legal basis for analytics is Consent; section 7 names the cookies.
| Data | Why we collect it | Legal basis |
|---|---|---|
| Page view and interaction events (cookieless) | To understand which parts of the website drive sign-ups and improve the experience | Legitimate interest (product analytics) |
| Page view and interaction events (with analytics cookies, only if you allow statistics cookies) | Same purpose, with the pages and visits from one browser linked together | Consent (you may withdraw at any time by emailing privacy@lepsto.com) |
If you joined the waitlist
The waitlist is closed: we no longer take new sign-ups. For the entries we already hold, we keep the data below on the schedule in section 6.
| Data | Why we collect it | Legal basis |
|---|---|---|
| Email address | To notify you when Lepsto launches and to send a confirmation email | Consent (you submitted the form) |
Referring URL, landing page, and any campaign tags carried in the link you followed (utm_source, utm_medium, utm_campaign, utm_term, utm_content) | To see which pages, posts and campaigns bring people to the form | Consent (you submitted the form) |
| The network address your sign-up reaches us from, and your browser's user-agent string | Proof that you consented, and rate limiting to keep the form from being abused | Legal obligation (GDPR Art. 7(1): we must be able to show that you consented) for the proof; legitimate interest for rate limiting |
| The moment you accepted, and the wording and version of the notice you accepted | The same proof — so we can show not only that you consented but to what text | Legal obligation (GDPR Art. 7(1)) |
| Sign-up status and its dates (confirmed, invited, registered, withdrawn) | To know who is still waiting for an invitation and who has asked to be taken off the list | Consent (you submitted the form) |
About that network address. We store the address the sign-up request reaches our servers from. Depending on how the request is routed to us, that can be your own address or one belonging to our infrastructure, and we cannot currently tell the two apart after the fact. We treat it as though it were yours: it is covered by the rights in section 8 and it is deleted with the rest of your entry on the schedule in section 6.
When you book an Enterprise call
If you use the "Contact us" link on our pricing page, Cal.com collects your name, email address, company and meeting topic. We use these details to arrange the call, create an event in Lepsto's Google Calendar and discuss your enquiry.
| Data | Why we collect it | Legal basis |
|---|---|---|
| Name, email address, company and meeting topic | To schedule and prepare for the Enterprise call and respond to your enquiry | Legitimate interest (responding to business enquiries) |
Lepsto is the controller for this data. Cal.com processes it on our behalf as our sub-processor (see section 4). We keep it for 12 months from the call (see section 6).
After you create an account
| Data | Why we collect it | Legal basis |
|---|---|---|
| Email address, display name | Account identity and communication | Contract performance |
| If you sign in with GitHub: your GitHub account ID, name and email address, and the OAuth token GitHub issues at sign-in | To sign you in | Contract performance |
| Data from accounts you connect (GitHub, Google Ads, YouTube, Google Drive and others) | Running the features you connect them to; see "Connected third-party accounts" below | Contract performance |
| Workspace content (code, environment variables, secrets, databases) | Running your applications on the Lepsto platform | Contract performance |
| Payment details (Stripe customer ID, last 4 digits of card) | Processing subscription payments | Contract performance |
| Audit log entries (user ID, action, timestamp) | Security, accountability, and compliance | Legitimate interest + legal obligation |
| Application and request logs | Diagnosing errors and monitoring platform health | Legitimate interest |
Signing in with Google
If you sign in with Google, Google shares your name, email address and profile picture with us (the openid, email and profile permissions). We use them only to create and secure your Lepsto account and to show who is signed in. We do not keep the access or refresh token Google issues when you sign in, and signing in gives Lepsto no access to anything else in your Google Account.
Access to Google Ads, YouTube or Google Drive is separate: Lepsto has it only if you connect that integration. "Connected third-party accounts" below explains what we do with it, including how our use of Google user data follows Google's Limited Use requirements.
Connected third-party accounts
Some Lepsto features work with accounts you hold elsewhere: an ad account, a YouTube channel, files in Google Drive, a code repository. Lepsto connects to such an account only when you connect it yourself, in Integrations (in your product or organization settings) or with Lepsto's API and MCP tools, and only after you approve the access on the provider's own consent screen. This section covers every integration listed below, including the Google user data we receive through Google Ads, YouTube and Google Drive.
What each integration asks for and why.
| Provider | Access we request | What Lepsto does with it |
|---|---|---|
| Google Ads | https://www.googleapis.com/auth/adwords | Tracking reads your campaigns, ad groups and ads, with their daily spend and performance, to show which ads bring you customers. If you turn on conversion upload, it sends conversions back to Google Ads: the Google click ID (gclid), the conversion action, time, value, currency and order ID, and your visitor's consent signal for ad data. Only if you also turn on Enhanced Conversions does it add the email address and phone number of the person who converted, hashed with SHA-256 before they leave Lepsto. |
| YouTube | https://www.googleapis.com/auth/youtube.readonly, https://www.googleapis.com/auth/youtube.upload | Content shows the connected channel, uploads the videos of posts you publish to it, and reads the statistics of the channel and those videos. |
| Google Drive | https://www.googleapis.com/auth/drive.file | Brain reads only the files you pick in Google's file picker, and the files inside any folder you pick, and turns them into memory for your product. Google limits this permission to the files you pick. |
| GitHub | A GitHub App installation on the repositories you choose (no OAuth scopes) | Deployments builds and deploys your code. If you set up ingestion, Brain reads the repository's Markdown files (or the files you configure) and the titles and descriptions of its issues and pull requests. |
openid, profile, w_member_social | Content publishes the posts you schedule, as you, and reads their likes and comments. | |
| X | tweet.read, tweet.write, users.read, offline.access | Content publishes the text posts you schedule and reads their public metrics and your follower count. |
identity, submit | Lepsto identifies the connected account by its username. Lepsto does not currently publish to or read from Reddit. | |
| Cloudflare | zone.read, dns.read, dns.write, offline_access | Lepsto creates, updates and removes the DNS records for custom domains you attach to your product, in the Cloudflare zones you connect. |
| ClickUp | The whole workspace you authorise (ClickUp offers no narrower permission) | Brain reads tasks, task comments, Docs, and the chat channels you choose with their text attachments, and checks them for changes on a schedule. Lepsto registers a ClickUp webhook to learn about changes. |
Google Ads, YouTube and Google Drive also ask for openid and email, so that Integrations can show which Google account is connected.
What we store.
- The access token for the account and, where the provider issues one, the refresh token. For GitHub we keep no long-lived token: when a deployment needs one, we create a GitHub installation token that expires after about an hour and store it with the deployment, encrypted.
- What identifies the connected account, so you can see which one is connected: the Google account ID and email address; the YouTube channel ID, title and handle; the Google Ads accounts you can reach (IDs, names, currency) and the one you choose for your product; the Drive files you picked; the LinkedIn member ID and name; the X user ID, username and name; the Reddit username; the Cloudflare account ID and name; the ClickUp workspace ID, name, colour and avatar; the GitHub installation, account name, account type and avatar.
- What the feature produces from it: Google Ads campaigns, ad groups, ads and their daily metrics, and a log of the conversions uploaded (click ID, action, time, value, currency, order ID and result, without the hashed email or phone); the posts published through Content, with their links and the statistics the network returns for them; the Brain memory built from Drive, ClickUp and GitHub content, including the facts extracted from it and the vector embeddings used to search it.
We store nothing from a connected account beyond what the feature you use needs.
How we protect it. Access and refresh tokens are stored only encrypted, with AES-256-GCM. The encryption key is kept in Google Secret Manager, is different in every environment, and is never in our code. A token is decrypted only when a Lepsto feature needs it to act for the product the account is connected to, and is handed only to that feature. Refresh tokens stay inside the Lepsto service that manages integrations: a feature receives a short-lived access token, or the stored access token where the provider issues no refresh token. We connect to providers over HTTPS. No Lepsto staff tool displays tokens, and we do not write them to logs. The tokens and the data listed above are stored on Google Cloud in the EU (section 5).
AI processing. Brain processes the Drive, ClickUp and GitHub content it turns into memory with Google Vertex AI (Gemini) models in Google Cloud's EU location, to extract facts and build search. It does this only to show that memory to you and to the agents you use with your product. Data from the other integrations is not sent to an AI model. We never use data from connected accounts to train, fine-tune or improve any AI model.
How long we keep it, and how to delete it. We keep a token while the integration is connected. When you disconnect an integration, we delete its stored token immediately. For Google integrations we also revoke Lepsto's access at Google, unless the same Google account is still connected to another Lepsto integration, or we cannot rule that out. Removing one product from an integration that your organization or other products still use is not a disconnect: the token stays until the integration is removed from the organization. If you withdraw Lepsto's access in your account with the provider, we delete the token as soon as the provider tells us the access has ended, and show the integration as needing to be reconnected.
Disconnecting does not delete what a feature has already built from the account: Google Ads data, Brain memory, and published posts with their statistics stay part of your product's data. Posts you published also stay on the provider's platform; delete them there. You can delete Brain memories in the product at any time. To have any other data from a connected account deleted, email privacy@lepsto.com and we will delete it within 30 days, as with any request under section 8. When a product is deleted, the Google Ads data, Brain memory and connected-account tokens that belong to it are deleted with it, on the schedule in section 6; deleting an organization also removes all of its integrations and their tokens. Published posts and their statistics are not yet deleted automatically: email privacy@lepsto.com and we will delete them within 30 days.
Who sees it. We do not sell data from connected accounts or share it with third parties. It goes only to the provider itself, when a feature acts on your instruction (for example publishing a post or uploading a conversion), and to the sub-processor in section 4 that runs the service, Google Cloud Platform, which also runs the Vertex AI models above. We do not use it for advertising or retargeting, to assess creditworthiness, or to train AI models. Lepsto staff do not read it unless you ask us to (for example in a support request), it is needed for security, or the law requires it.
Google user data. Lepsto's use and transfer of information received from Google APIs to any other app will adhere to the Google API Services User Data Policy, including the Limited Use requirements.
Providers are not our sub-processors. Google, GitHub, LinkedIn, X, Reddit, Cloudflare and ClickUp are services you use under your own agreement with them. We exchange data with them only on your instruction, and what they do with it is governed by their own terms and privacy policies. They are not on the sub-processor list in section 4 for this reason.
We never access the content of customer databases. Lepsto is infrastructure — your data belongs to you.
3. Legal bases for processing
We process your data on one of these grounds for each category:
- Consent — analytics cookies and optional communications. You can withdraw consent at any time by emailing privacy@lepsto.com.
- Contract performance — account, workspace, and payment data are necessary to provide the service you signed up for. Data from accounts you connect is processed at your request, to run the features you connect them to.
- Legitimate interest — security monitoring, fraud prevention, service improvement, responses to business enquiries, and product analytics on the landing page without personal profiles. We balance these interests against your rights before relying on this basis.
- Legal obligation — retaining audit logs as required by applicable law.
4. Who we share your data with
We use the providers listed below to process personal data. Cal.com processes Enterprise booking data on our behalf. We have not confirmed DPA coverage for our Cal.com Free-plan account as of 15 October 2026.
| Vendor | Role | Data processed | Region | Transfer safeguard |
|---|---|---|---|---|
| Google Cloud Platform | Hosting, compute, databases, object storage, secrets, AI inference (Vertex AI / Gemini) | All customer and end-user data processed by the platform | EU (europe-west4, Netherlands; Vertex AI in the EU multi-region) | none (EU processing) |
| GitHub (Microsoft Ireland Operations Ltd) | Source-code connector, OAuth sign-in | Account identity (name, email), OAuth tokens, repository metadata | EU / global (Microsoft Ireland contracting entity) | DPF-certified (Microsoft) |
| Amazon Web Services (Amazon SES) | Transactional email delivery through Lepsto Mail | Recipient email address, message content | EU (eu-north-1, Stockholm) | none (EU processing) |
| Stripe | Payment processing (activates with billing) | Payment card (last4), billing name and email, Stripe customer id | EU / US | DPF-certified + SCCs (known US exception) |
| Inngest | Workflow orchestration | Workflow event payloads (may include account identifiers) | US | SCCs (Art. 46 GDPR) |
| Anthropic PBC | LLM inference (Claude) for the natural-language analytics service — text-to-SQL and answer summarization | End-user analytics questions (free text, unredacted, may contain personal data) and query result rows. Result rows are person-level — one row per tracked profile, product end user (including waitlisted signups) or mail contact — and the queryable views carry normalised email and phone columns for person-graph identity resolution, so a result row may carry a direct identifier | US | SCCs (Art. 46 GDPR) |
| Cal.com | Scheduling Enterprise calls | Name, email address, company and meeting topic supplied by the person booking | US | Unconfirmed — see note below |
Services you connect to Lepsto yourself, such as Google Ads, GitHub or YouTube, are not on this list either: they are not our sub-processors, and section 2 ("Connected third-party accounts") explains what we exchange with them.
Product analytics is not on this list: we process it ourselves, on our own EU infrastructure (Lepsto Tracking), with no third-party processor involved.
We do not sell your personal data. We do not share it with advertisers.
5. Where your data is stored
All primary data storage is on Google Cloud Platform in europe-west4 (Netherlands). This region is within the EU/EEA, so no cross-border transfer mechanism is required for GCP.
Inngest runs background jobs, and our AI feature providers listed in section 4 serve inference, through US infrastructure. These transfers are covered by DPAs and Standard Contractual Clauses (SCCs) adopted by the European Commission under GDPR Article 46(2)(c), or by the provider's active EU–US Data Privacy Framework certification as listed in the table above.
Cal.com processes Enterprise call bookings in the US. Lepsto has not confirmed the transfer safeguard applicable to its Cal.com account.
All other sub-processors listed above, aside from Cal.com, store data in the EU, or operate under adequacy decisions, SCCs, or equivalent transfer mechanisms.
6. How long we keep your data
| Data type | Retention period | Notes |
|---|---|---|
| Waitlist email (not converted) | 6 months from sign-up | Deleted after the period ends |
| Account and workspace data | Until you delete your account, then 30 days | 30-day window lets you recover from accidental deletion |
| Application and AI request logs | 90 days | Auto-purged |
| Connected account tokens | Until you disconnect the integration, then deleted immediately | Section 2 ("Connected third-party accounts") explains what disconnecting deletes and what stays |
| Audit logs | 2 years | Retained under GDPR Art. 17(3)(e) — legal claims basis. Contains only user ID, action type, and timestamp; no personal content. |
| Payment records | As required by Estonian accounting law | Typically 7 years |
| Backups | 30 days | Rolling backup window |
| Enterprise call booking data (Cal.com and the matching Google Calendar event) | 12 months from the call | Deleted after the period ends, whether or not the enquiry led to a subscription |
| Website session recordings and heatmaps (Lepsto Tracking) | 30 days from the start of the recording | Deleted automatically after the period ends |
| Website analytics events and the identifiers linked to them (Lepsto Tracking) | No fixed period | Kept while we operate the website analytics. On request (section 8) we delete the events and profile linked to your browser; a raw event archive kept for recovery is deleted only together with the whole analytics dataset |
7. Cookies and local storage
Essential items. On the Lepsto website we store only what the site needs to function:
lepsto_consent— a cookie that records your cookie-consent choice. While the consent banner checks which domain it can store that choice on, it may setlepsto_consent_probeand remove it straight away.lessly_theme— a cookie, shared across lepsto.com and its subdomains, and a copy under the same name in your browser's local storage. They remember your light or dark theme and are set only when you pick one.
After you create an account, the platform additionally sets a session token and a cross-site-request-forgery (CSRF) protection token. These are strictly necessary to keep you signed in securely.
Analytics. Our analytics (Lepsto Tracking) set cookies only if you allow statistics cookies in the consent banner. If you do, Lepsto Tracking sets _lt_aid, which recognises your browser across visits and lasts up to 400 days, and _lt_sid, which groups the pages of one visit and ends when you close your browser. It also sets _lt_p and removes it straight away, to check which domain it can store cookies on. If you decline, or have not chosen yet, our analytics are cookieless and set none of these. Our analytics do not store your IP address. The waitlist form, now closed, was separate and stored the address a sign-up reached us from, as consent proof and to rate-limit the form; section 2 lists it. You can withdraw your consent to analytics cookies at any time by emailing privacy@lepsto.com.
We do not use advertising cookies or third-party tracking pixels.
8. Your rights under GDPR
If you are in the EU or EEA, you have the following rights:
| Right | What it means |
|---|---|
| Access (Art. 15) | Request a copy of the personal data we hold about you |
| Rectification (Art. 16) | Ask us to correct inaccurate data |
| Erasure (Art. 17) | Ask us to delete your data. We will process the request within 30 days. Audit logs are retained for 2 years per Art. 17(3)(e). |
| Data portability (Art. 20) | Receive your data in a machine-readable format (account data and workspace metadata) |
| Objection (Art. 21) | Object to processing based on legitimate interest |
| Withdraw consent | Withdraw analytics consent at any time; this does not affect prior processing |
| Lodge a complaint | File a complaint with the Estonian Data Protection Inspectorate (Andmekaitse Inspektsioon) at aki.ee |
To exercise any right, email privacy@lepsto.com with your request. We will respond within 30 days. We may ask you to verify your identity before acting.
9. Children
Lepsto is not directed at children under 16. We do not knowingly collect data from anyone under 16. If you believe we have data from a child, email privacy@lepsto.com and we will delete it.
10. Changes to this policy
We will notify you by email if we make material changes to this policy (for example, adding a new category of data or a new sub-processor). Minor corrections or clarifications are reflected in the "last updated" date at the top of this page without separate notification.
11. Contact
Apliteni OÜ · Estonia
privacy@lepsto.com
12. Notice for visitors in the United States
When you reach lepsto.com from one of our advertisements in the United States, your browser is set to a US time zone and it does not send a Global Privacy Control signal, we do not show the cookie banner. For the rest of that browser session our own analytics (Lepsto Tracking) runs with cookies until you tell us otherwise. For these visits, this section applies instead of what sections 2 and 7 say about the banner and cookieless analytics.
What we collect. The pages you view and the actions you take on the site (for example, clicking "Start 30-day trial"); the address of the page you came from; the full address of each page, including the campaign tags and any advertising click identifier in the link you followed (such as gclid or fbclid); the page title, your screen size, browser language and time zone; and the country we derive from your IP address. Lepsto Tracking sets two first-party cookies on lepsto.com and its subdomains, including docs.lepsto.com: _lt_aid, which recognises the same browser across visits and lasts up to 400 days from your latest visit, and _lt_sid, which groups the pages of one visit and ends when you close your browser. It also keeps a few values for the current visit in your browser's session storage. We record how you interact with pages (session recordings, with everything you type into forms masked) and combine clicks and scrolls into heatmaps. We do not store your IP address.
Advertising. If you sign up after clicking one of our Google Ads, we report that sign-up to Google Ads together with the Google click identifier, so we can measure which ads work. We do not sell or share your personal information.
How long we keep it. We keep this data for the periods set out in section 6.
How to opt out. While this mode is on, a Your Privacy Choices link appears at the bottom of each page. Select it and choose Deny. We then delete the _lt_aid and _lt_sid cookies, stop session recording and stop linking your visits together. Our analytics continue without cookies: they record the pages you view and the campaign tags, under a visitor key computed from your IP address and browser that changes every day. Your choice is stored in the lepsto_consent cookie and applies to your later visits too. If your browser sends a Global Privacy Control signal, we do not use this mode: we show our cookie banner. Until you choose, our analytics set no cookies, record no sessions and collect no advertising click identifiers, and nothing is reported to Google Ads; they count only the pages you view and the campaign tags, without cookies.