Privacy Policy — Leandre
LeandreLog in to Leandre

Home › Privacy Policy

Privacy Policy

At Leandre, we take the protection of your personal data seriously. This Privacy Policy explains, clearly and transparently, how we collect, use, keep and protect your data when you use the website leandre.ai and the app uk.leandre.ai (the “Service”).

It is written in line with the UK General Data Protection Regulation (“UK GDPR”) and the Data Protection Act 2018. By creating an account or using the Service, you confirm that you have read this policy.

1. Who is responsible for your data

The controller of the personal data collected through the Service is:

  • Company name: NL MARKETING FZCO
  • Legal form: free zone company (Free Zone Company – FZCO)
  • Registration: Dubai Silicon Oasis Authority (DSOA), United Arab Emirates
  • Registered office: Dubai Silicon Oasis, Dubai, United Arab Emirates
  • Legal representative / Director of publication: Nathan Lewis
  • Contact email: support@leandre.ai

(“Leandre”, “we”, “us” or “our”).

2. The personal data we collect

We only collect the data we need for the purposes described below. Depending on how you use the Service, we process the following categories of data.

2.1 Account and identification data

  • Email address;
  • Name and/or first name, when you provide them or when they are passed to us by your sign-in provider;
  • Login identifier and, where applicable, your Google account identifier when you sign in with Google;
  • Password (where applicable), stored in encrypted / hashed form; we never have access to your password in plain text.

2.2 Payment and subscription data

Payments (Creator, Pro and Elite subscriptions, credit top-ups) are processed by our payment provider Whop. We do not store your full card numbers, which are processed directly by Whop and its payment institution. We receive and keep:

  • Your subscription identifier and the plan you have chosen (free, Creator, Pro, Elite);
  • The history and status of your payments (successful, renewed, cancelled);
  • Your credit balance and credit history.

2.3 Data about how you use the Service

  • Connection data and technical logs: IP address, browser type, operating system, dates and times of connection;
  • Actions taken in the app (product searches, features used, credits spent);
  • Your account preferences and settings.

2.4 Content you create and AI-generated content

The Service relies on artificial intelligence. For this reason, we process:

  • The prompts, instructions, keywords and information you enter to generate content (product research, logos, brand identity, product pages, ad visuals, UGC videos, etc.);
  • The content generated by the AI in response to your requests (text, images, videos), and any material you upload.

Please do not include sensitive personal data, or data about other people, in your prompts unless you have the right to use it.

2.5 Communication and support data

  • The content of the messages you send us (support, emails, forms);
  • Where applicable, your consent to receive marketing communications and the history of emails sent to you (opens, clicks), to measure how well they work.

3. Why we use your data, and our lawful bases

Each use of your data relies on a lawful basis under Article 6 of the UK GDPR:

  • Creating and managing your account (sign-up, authentication, giving you your 25 free credits): lawful basis performance of a contract (Article 6(1)(b)).
  • Providing the features of the Service, including AI content generation and credit management: performance of a contract.
  • Managing subscriptions, payments and invoicing: performance of a contract and compliance with a legal obligation (Article 6(1)(c), in particular accounting and tax obligations).
  • Support and customer service (answering your requests): performance of a contract and legitimate interests (Article 6(1)(f)) in responding to you.
  • Improving, securing and running the Service (usage statistics, preventing fraud and abuse, security): legitimate interests in operating, securing and improving our Service.
  • Sending marketing communications and newsletters: your consent (Article 6(1)(a)) for prospects, or, for customers, similar products and services under the “soft opt-in” rule of the Privacy and Electronic Communications Regulations (PECR); you can object or unsubscribe at any time.
  • Cookies and trackers that are not strictly necessary: your consent.
  • Complying with our legal obligations and handling any disputes: legal obligation and legitimate interests in defending our rights.

4. Who receives your data (recipients and processors)

Your data is accessible to authorised people at Leandre, only as far as their role requires. To provide the Service, we also use technical providers acting as processors under Article 28 of the UK GDPR. These providers only use your data to carry out the services we ask of them, under data processing agreements.

  • Supabase: database hosting, authentication and storage of accounts and content. The data is hosted in the European Union (Central Europe region).
  • Whop: subscription, payment and invoicing management.
  • Resend: sending transactional emails and, where applicable, communications about the Service.
  • Artificial intelligence model providers: processing your prompts to generate text, images and videos. We use providers of text generation and of image / video generation. Your prompts are sent to them only to produce the content you asked for.
  • Google sign-in provider: when you choose to sign in with your Google account.
  • Our host: Vercel Inc., 340 S Lemon Ave #4133, Walnut, CA 91789, United States (vercel.com).

We may also share your data with public or judicial authorities when the law requires us to. Apart from these cases, we never sell or rent your personal data to third parties.

5. Transfers of data outside the United Kingdom

Leandre is established in the United Arab Emirates, and some of our processors, in particular some payment, email and artificial intelligence model providers, may be established or store data outside the United Kingdom, especially in the European Union and the United States. Transfers to the European Economic Area are covered by UK adequacy regulations. For other countries, we make sure transfers are protected by appropriate safeguards under the UK GDPR, such as the UK International Data Transfer Agreement, the UK Addendum to the EU standard contractual clauses or, where applicable, UK adequacy regulations (including the UK Extension to the EU-US Data Privacy Framework for certified US companies). You can get a copy of these safeguards by contacting us at the address given in section 11.

6. How long we keep your data

We only keep your data for as long as necessary for the purposes it was collected for; after that, we delete or anonymise it.

  • Account data: for as long as you have an account, then for up to 3 years after your last activity or the deletion of your account (for marketing and evidence purposes), unless you ask us to delete it sooner.
  • Generated content and prompts: kept while your account is active so that you can access them; deleted when your account is deleted, subject to any legal obligations.
  • Billing data and accounting records: kept for 10 years to meet accounting and tax obligations.
  • Connection data and technical logs: kept for up to 12 months.
  • Marketing data (prospects who are not customers): kept for 3 years from your last contact with us.
  • Cookies and trackers: your consent choice is kept for up to 6 months; trackers have a maximum lifetime of 13 months.

7. Keeping your data secure

We use appropriate technical and organisational measures to protect your data against loss, alteration, disclosure or unauthorised access: encrypted connections (HTTPS/TLS), secure hosting in the European Union, access controls, separation between user accounts and activity logging. No system is infallible, so we cannot guarantee absolute security. If a personal data breach is likely to result in a high risk to your rights and freedoms, we will tell you and notify the Information Commissioner’s Office (ICO) as required by the UK GDPR.

8. Your rights

Under the UK GDPR, you have the following rights over your personal data:

  • Right of access: to find out whether we process your data and to get a copy of it;
  • Right to rectification: to have inaccurate or incomplete data corrected;
  • Right to erasure (“right to be forgotten”): to ask us to delete your data in the cases provided by law;
  • Right to restriction of processing: to ask us to temporarily stop using some of your data;
  • Right to data portability: to receive the data you gave us in a structured, commonly used and machine-readable format, and to have it sent to another controller;
  • Right to object: to object, on grounds relating to your particular situation, to processing based on our legitimate interests and, at any time and without giving a reason, to direct marketing;
  • Right to withdraw your consent at any time, where processing is based on consent, without affecting the lawfulness of processing carried out before you withdrew it;
  • Rights relating to automated decision-making: we do not make decisions about you based solely on automated processing that have legal or similarly significant effects on you.

You can exercise these rights by emailing support@leandre.ai or by writing to us at Dubai Silicon Oasis, Dubai, United Arab Emirates. If we have reasonable doubts about your identity, we may ask you for proof of identity. We will reply within one month; this can be extended by two further months for complex requests, in which case we will let you know.

If you are unhappy with how we have handled your data, please tell us first at support@leandre.ai so we can try to put things right. You also have the right to complain to the UK supervisory authority, the Information Commissioner’s Office (ICO): Wycliffe House, Water Lane, Wilmslow, Cheshire SK9 5AF; helpline 0303 123 1113; ico.org.uk.

9. Cookies and trackers

The Service uses cookies and similar technologies. There are three types:

  • Strictly necessary cookies, needed for the Service to work (authentication, security, keeping you signed in). They do not require your consent.
  • Analytics and performance cookies, which help us understand how the Service is used and improve it.
  • Advertising and personalisation cookies, where used.

On our website we use the following tools: PostHog (product analytics, hosted in the EU), Microsoft Clarity (heatmaps and session recordings, to improve our pages), the Meta Pixel (to measure the performance of our Facebook and Instagram ads), our payment provider’s page-view measurement, and a first-party cookie that records how you arrived on our site (for example from an ad or an email) for up to 30 days.

Under the Privacy and Electronic Communications Regulations (PECR), cookies and trackers that are not strictly necessary need your consent. You can refuse them or withdraw your consent at any time, for example by deleting and blocking cookies in your browser settings, or through our cookie preferences tool when it is available.

10. Children

The Service is not intended for children. You must be at least 18 years old to create an account and take out a subscription. We do not knowingly collect data about anyone under 18.

11. Contact

For any question about this policy or your personal data, you can contact our data protection contact:

  • Email: support@leandre.ai
  • Postal address: Dubai Silicon Oasis, Dubai, United Arab Emirates

12. Changes to this policy

We may update this Privacy Policy from time to time, in particular to reflect legal, regulatory or technical changes. The version that applies is the one published on this page. If we make a significant change, we will let you know by an appropriate means (a notification in the app or an email).

Last updated: 26 September 2026.