Privacy policy

Who we are

leoOS is a workplace application built and operated by atomobits SARL, the company behind Leolab. It covers the leoOS mobile app for iOS and Android, the web app at task.leolab.me, and the leoCompany finance module inside the same app. This policy explains what those collect and what we do with it.

atomobits SARL is registered in Beirut, Lebanon, under commercial register number 1031660 and tax number 3967041. It is the company responsible for the data described here.

You get a leoOS account because an organization invited you to one. That organization decides who joins, what you can see, and what happens to the work you create inside it. We host and run the software on its behalf. Questions about your own account inside an organization are usually answered fastest by that organization's administrator.

What we collect

Your account. Your email address, your name, a password stored only as a hash, an avatar image if you upload one, the encrypted secret behind two-factor authentication if you enable it, and the time you last signed in.

What you create. Tasks, notes, documents, chat messages, files you attach, calendar events, social posts, sales records and finance records. This is your organization's working material, and it is the reason the app exists.

Accounts you connect. If you connect a Google account, leoOS reads and sends mail on your behalf, adjusts your Gmail settings such as signatures and filters, reads your calendar, creates calendar events, and creates Google Meet links for meetings you schedule. The mail and calendar content it reads is stored in leoOS so the app can show it to you. Connecting is your choice, and disconnecting stops the sync.

Your device. If you turn on notifications, we store a push token so we can deliver them. The mobile app saves your email and password in the device keychain so it can sign you back in without asking; that copy stays on your phone and is removed when you sign out. The app asks for your camera or photo library only at the moment you attach a photo or save one, and it reads nothing else from either.

Diagnostics. The mobile app keeps a short record of recent activity and the last crash on the device itself. Nothing in it is uploaded automatically. It leaves your phone only if you open the debug screen and send it to us yourself.

What we do not do

leoOS carries no advertising and no analytics or tracking software. It does not follow you across other apps or websites, which is why it never asks for tracking permission. We do not sell your data and we do not share it for anyone else's advertising.

Why we use your data

To run the product: to sign you in, show you your organization's work, deliver notifications, sync the accounts you connected, and keep a record of who changed what so an administrator can audit it. We also use it to support you when you ask for help, and to find and fix faults.

AI features

leoOS includes AI agents that work inside your organization: they read tasks, messages and records, and write replies and updates. To do that, the relevant content is sent to Anthropic, which provides the models, and is processed there to produce the answer. Agent activity is recorded in your organization's audit log.

Who else handles your data

We use a small number of service providers, each for one job:

• Microsoft Azure hosts the application, the database and uploaded files.
• Google provides Gmail, Calendar, Meet and sign-in, for the accounts you connect.
• Expo delivers push notifications and app updates.
• Anthropic provides the models behind the AI features.
• GitHub is used when your organization links code repositories to its work.
• Giphy serves the images in its picker when you search for one in chat.

We share your data with them only so they can do that job. We also disclose data if the law requires it.

Where your data is stored

leoOS runs on Microsoft Azure in West Europe, and your account data, your content and your uploaded files are stored there. Some of the providers listed above operate outside Europe, so data reaching them is transferred internationally under the terms of our agreements with them.

How long we keep it

We keep your account and its content for as long as your organization keeps you as a member. When an administrator removes you, your account is closed and the work you created stays with the organization, because it belongs to the organization rather than to you personally. Deleted data can survive for a while in our recovery copies: database backups are kept for 7 days, and deleted files stay recoverable for 30 days before they are removed for good.

Your choices

You can change your name, avatar and password in the app, sign out to clear the credentials saved on your device, turn notifications off in your phone's settings, and disconnect any Google account you connected.

You can ask us for a copy of your personal data, for a correction, or for your account and personal data to be deleted. Write to [email protected] and we will answer within 30 days. Deleting your account removes your profile and your personal data; content you contributed to a shared workspace, such as a message in a group chat, stays with the organization unless it also asks us to remove it.

Security

Traffic between the app and our servers is encrypted. Passwords are stored as hashes and never in readable form. Two-factor authentication is available and some organizations require it. On your phone, saved credentials are held in the operating system's keychain rather than in ordinary app storage. No system is perfect, and we will tell you and the relevant authority if a breach affects your data.

Children

leoOS is a tool for people at work. It is not designed or offered for children, and we do not knowingly collect data from anyone under 16.

Changes to this policy

When we change this policy we update the date at the top of the page. If a change affects how we use your data in a way you would not expect, we will tell you in the app before it takes effect.

Contact

Write to [email protected] with any question about this policy or about your data. The company behind that address is atomobits SARL, commercial register 1031660, tax number 3967041, Beirut, Lebanon.