Privacy Policy
Last updated: October 30, 2026
Dayuan "Frank" Zeng, an individual resident in China, trading as LeanSRM (“we”), operates LeanSRM. This page explains what we collect, why, how long we keep it, and what you can ask us to do. Contact for privacy requests and contract notices: frank@leansrm.com. The service is operated from China; the processing and international-access disclosures below apply even where a hosting provider stores data outside China.
1. What we collect
| What | Why | How long |
|---|---|---|
| Your account email and name, sign-in records, and your company’s business details | To create and run your account and secure sign-in | While needed to run and secure the account; organization deletion does not erase sign-in records |
| Order, supplier, item, price, shipment and receiving records you enter | To provide the Service | While your account is active |
| Files you upload — packing slips, damage photos, resale certificates | To provide the Service | While your account is active |
| Standard server logs (IP address, browser type, timestamps) | Security and troubleshooting | As needed for security and troubleshooting; provider retention depends on hosting and monitoring settings |
| Billing contact name, company, billing address and tax identifiers; transaction/subscription identifiers, amounts, tax and payment/refund status; and masked payment details if supplied by the merchant | To reconcile purchases, provide subscription access, apply credit, assist refunds and resolve billing or legal issues; the merchant separately processes checkout and payment data | While needed for billing, service, tax, fraud prevention or disputes; records required by law may remain after service deletion, and the merchant applies its own lawful retention periods |
| A language-preference cookie and a session cookie | To keep you signed in and remember the language you chose | Language: up to 12 months; sign-in cookies: until session expiry or sign-out, subject to browser settings |
We do not use advertising trackers. We do not sell your personal information and we do not share it for cross-context behavioral advertising.
2. Material you send for a free PO Change Check
If you send us purchase order emails or receiving records for a free PO Change Check:
- Frank (the founder) reads them personally;
- they are not put through an AI assistant or any other automated tool;
- they are not entered into the product;
- they are deleted after you receive the report, unless you start a pilot and ask us to keep them;
- they are not shared with anyone else.
3. Service providers, payment merchants and international access
Providers integrated for hosting, database, file storage and error monitoring include Vercel (hosting), Neon (database), Cloudflare R2 (file storage), and Sentry (error monitoring). They process data for those services when enabled. Ask for the current enabled providers and processing locations before onboarding. We update this list before adding a provider that touches your data.
Paddle is our primary merchant of record and the seller of record for purchases made through its checkout. You enter payment details directly into Paddle’s checkout. Paddle processes billing and payment information for its own checkout, payment, tax, fraud-prevention, refund, chargeback and legal-compliance purposes as an independent controller, under the Paddle Buyer Terms and its own privacy notice provided at checkout. We do not receive or store your full card number or card security code. We may receive billing contact and business details, billing address and tax identifiers, transaction or subscription identifiers, amounts and tax, payment or refund status, and masked payment details such as card brand and last four digits if supplied by the merchant. Do not email us card details. We use this limited information to provide access, reconcile billing, apply credit, assist refunds and handle disputes or legal obligations.
Creem is a backup merchant of record, not an additional payment-data recipient merely because it is listed here. If we offer Creem for your purchase, we identify it before payment and provide its buyer terms and privacy notice at checkout. As between Paddle and Creem, only the merchant selected for that transaction receives the information submitted through that checkout; its own payment service providers may also process it under its privacy notice. For its own seller, payment, tax, fraud-prevention, refund, chargeback and legal-compliance activities, Creem acts as an independent controller. We do not send your PO contents, supplier records or free-check materials to either payment merchant as part of billing.
The Operator works from China. Account information, business records, supplier/contact information, uploaded files, free-check materials, support communications and the limited billing information described above may be accessed and processed by the Operator in China to operate and support LeanSRM. This includes remote access from China to records stored outside China. Information may therefore move from the United States or another country to China, and from China to the enabled international service providers used to operate the service. The payment merchants also process information in the countries described in their own privacy notices. We do not promise US-only storage or processing. Ask about current locations and any required contractual safeguards before sending location-restricted information. Do not provide export-controlled technical data, government-restricted data or other information that you are not lawfully permitted to make accessible from China. This disclosure does not override a legal restriction on a transfer or substitute for safeguards required by applicable law.
4. Your rights
Depending on where you live, you may have the right to know what personal information we hold about you, to get a copy, to correct it, to delete it, to opt out of sale or sharing (we do neither), and to not be discriminated against for exercising these rights. You may use an authorized agent.
Write to frank@leansrm.com and we will respond within the time your state requires (generally 45 days under California law, with any permitted extension explained in that period). We do not sell or share information for cross-context behavioral advertising, whether or not you send a Global Privacy Control signal.
5. Export and deletion
Organization owners can export a ZIP of their organization’s business records and uploaded files and request organization deletion. You can undo deletion within 7 days; after that, live business records and files are queued for permanent removal, not erased at the exact 7-day mark. The export and automatic deletion do not include authentication records; retained audit records, billing or dispute records and provider backups may remain. Email us for identity-data deletion or other privacy requests. We restrict retained records to the relevant security, legal or dispute purpose and remove them when no longer needed. Ask for current provider retention periods and processing locations before supplying location-restricted data; we do not promise US-only processing or immediate erasure of all copies.
Deleting your LeanSRM organization does not erase records independently held by the merchant of record for its own tax, payment, fraud-prevention or legal obligations. For that merchant’s privacy requests, use the contact or request process in its privacy notice. We can assist with identifying the relevant transaction but cannot promise deletion of records that the merchant must lawfully retain.
6. Changes
If we change this policy, we post the new date at the top of this page.