Privacy Policy

Last updated: 6 August 2026 | PayoutPilot by LeanAI Studio srl

1. Data controller

PayoutPilot is a product of LeanAI Studio srl, an Italian company registered as:

P.IVA/CF: 14561020968
Email: info@leanaistudio.com

As data controller, LeanAI Studio srl determines the purposes and means of processing your personal data.

2. The calculator runs in your browser

The PayoutPilot commission calculator runs entirely on your own device. The comp plan you define or paste and the rep, quota, and revenue figures you enter are processed in your browser to produce the results on screen. They are not transmitted to us and not written to any database of ours. We never see them and they are never used to train any model.

Three exceptions, and they are the only three. One is a file you chose to upload, one is text you pasted and one is a bounded extract of a file you chose to upload: only its header row and up to five sample rows. Each one takes an action of yours. Each is described in its own paragraph below. If you upload a comp plan FILE and ask PayoutPilot to read it for you, the contents of that file are sent to our server and on to Anthropic's Claude API, which turns the document into the structured rates you are then asked to confirm. That sentence is about the comp plan file and nothing else. It does not apply to the rep, quota and revenue figures you enter, which are never transmitted. The file is processed for that single request, is not stored by us, and under Anthropic's commercial terms is not used to train their models.

Pasted text is read on your device. If you use Or paste the plan as text instead of uploading a file, the text is parsed by code running in your own browser and is not sent anywhere. If that on-device reader cannot find any rates in what you pasted, we tell you so and OFFER to send the text to the same AI reader. That send happens only if you press the button that says so. We never fall back to it silently, because a silent fallback would make the sentence above untrue for the one person it exists to protect.

A team file's COLUMNS are matched by AI, and the rest of the file stays on your device. When you upload a team file, PayoutPilot reads it in your browser and sends us the header row and up to five sample rowsof it, which go on to Anthropic's Claude API. The only question asked is which column holds which meaning: which one is the rep, which is the quota, which is the closed revenue. Those rows are the whole of what is sent, however many rows the file has, and the grouping and every sum are computed in your browser afterwards, because summing currency is arithmetic rather than judgement and this is payroll. Those five sample rows do contain real names and real figures, which is why they are named here rather than described as column information. They are processed for that single request, are not stored by us, and under Anthropic's commercial terms are not used to train their models.

So that leaving the page does not destroy your work, the calculator keeps a copy of your current comp plan and rep figures in your own browser's local storage, on your device. This is what lets you return from the checkout page, or come back tomorrow, and find your figures as you left them. That copy never leaves your device and is not readable by us. You can erase it at any time with Start freshon the calculator, or by clearing this site's data in your browser settings.

Data leaves your device to us in seven cases. Six of them are you asking us to read a comp plan FILE you uploaded, read plan text you pasted, on the button we offer when the on-device reader cannot find your rates, match the columns in a team FILE you uploaded, where the only thing sent is its header row and up to five sample rows, send you a sign-in link, where the address you type is stored with the link and handed to Resend to deliver it, take a subscription, where checkout is handled by Stripe and collects your email and billing details, or create a workspace, where the documents you explicitly save are held on our servers. Every company that receives any of it is named in section 5. Following a link to another company's page is a different thing and is not one of these seven: your browser makes that request itself, and nothing you typed into the calculator goes with it. The founder-call buttons are one such link, and section 5 says what following one hands Calendly.

One case is not one you ask for each time. We check whether you are a subscriber, which happens by itself while you are signed in: your address goes to Stripe so we can ask it whether a subscription exists, and it is asked again on each visit until one does. It stops the moment you sign out. And for a visitor who is not signed in, this check never reaches Stripe: it answers from the receipt we set in your browser at checkout, or, if you have no valid receipt, that you are not a subscriber.

3. If you create a workspace, we do hold that data

The free calculator needs no account. Signing in is itself the first thing that sends data: the address you type at Sign in is written to our database with the sign-in token, and handed to Resend to deliver the link to you. That happens whether or not you go on to save anything. If you then create a workspace, we store the following on our servers so your work survives closing the browser and follows you between devices:

your email address, so you can sign back in
the workspace documents you choose to save: comp plans and the roster attached to them, saved period runs with their per-rep rows, and archived rep statements
if you have a paid plan, your billing status mirrored from Stripe, never your card details

Your workspace data is private to your account. It is never shared with other users, never sold, and never used to train any model. The figures you type into the calculator do not reach our servers unless you press a save button.

Deleting your data. You can permanently delete your account and every document in your workspace at any time from the account section of your workspace, or by emailing info@leanaistudio.com. Deletion is immediate and irreversible. Sign-in links expire after 15 minutes and work once.

We use your email address only to send sign-in links and essential service messages about your subscription.

When you visit this site, analytics tools may collect:

IP address (used by Vercel for hosting, anonymised before any analytics processing)
Page views, referrer, approximate country, device and browser type, via Google Analytics
Anonymised interaction data (clicks and scrolling) via Microsoft Clarity

4. Legal basis

Performance of a contract (GDPR Art. 6(1)(b)): processing your email and billing details through Stripe when you choose to subscribe, and holding your workspace documents so we can provide the workspace you asked for
Consent (GDPR Art. 6(1)(a)): analytics cookies, where consent is required in your region
Legitimate interest (GDPR Art. 6(1)(f)): keeping the site secure and understanding aggregate usage

5. Every company that can touch your data

This is the complete list. Each entry says what reaches that company, why it goes there, and where it is processed. A company not named here does not receive your data.

Anthropic PBC (Claude API)

What reaches them: Three things, one is a file you chose to upload, one is text you pasted and one is a bounded extract of a file you chose to upload: only its header row and up to five sample rows. What you ask us to do with them: read a comp plan FILE you uploaded, read plan text you pasted, on the button we offer when the on-device reader cannot find your rates, and match the columns in a team FILE you uploaded, where the only thing sent is its header row and up to five sample rows. Never the rep, quota and revenue figures you type into the calculator itself.
Why: Turning the document into the structured rates you are then asked to confirm.
Where it is processed: United States.

MongoDB, Inc. (MongoDB Atlas, workspace database)

What reaches them: Your email address from the moment you ask for a sign-in link, so the link can be checked when you click it. Then, only if you save them: the comp plans and rosters you save, saved period runs with their per-rep rows, and archived rep statements.
Why: Checking your sign-in link, and keeping your saved work so it survives closing the browser and follows you between devices.
Where it is processed: Frankfurt, Germany. Our cluster runs in the AWS eu-central-1 region.

Vercel Inc. (hosting and analytics)

What reaches them: The ordinary traffic of serving a website: your IP address, the pages you request, and privacy-friendly page analytics. And, because our own API runs on Vercel, anything you send us passes through it in transit: a comp plan file you ask us to read, plan text you ask us to read, the address you type to sign in, and the documents you save to a workspace.
Why: Serving this site, running our API, and keeping it up.
Where it is processed: United States.

Plus Five Five, Inc. (Resend, transactional email)

What reaches them: Your email address, from the moment you ask for a sign-in link, and the link sent to it. No workspace is needed first: asking for the link is what sends it.
Why: Delivering the sign-in link and essential messages about your subscription.
Where it is processed: United States.

Stripe (Stripe, LLC and Stripe Payments Europe, Limited)

What reaches them: While you are signed in, your email address, so we can ask Stripe whether you have a subscription. And, only if you subscribe, the billing details you enter at checkout. Your card number goes to Stripe directly and is never held by us.
Why: Taking the payment, holding the subscription, and answering whether a signed-in visitor has one.
Where it is processed: United States, with Stripe Payments Europe, Limited in Ireland for accounts held outside the Americas.

Calendly, LLC (Calendly, call booking)

What reaches them: Only if you follow one of the two founder-call links: your IP address, your browser and device details, and the campaign parameters written into the link, which name the button you pressed. Then, if you fill in the booking form on their page, the name and email address you type into it. The rep, quota and revenue figures you enter into the calculator stay in your browser and are no part of a booking.
Why: Offering you a call with the founder, and showing us which page the booking came from.
Where it is processed: United States, and its addendum reserves other jurisdictions outside the residence of the data subjects, which it does not name. Calendly, LLC is the contracting entity.

Microsoft Corporation (Microsoft Clarity, behavioural analytics. A data controller in its own right, not our processor)

What reaches them: Anonymised interaction data: clicks, scrolling and page views. When your browser reports an EU or EEA time zone the Clarity tag is placed on the page only after you accept, so a visitor who declines gets a page that never loads it. When it reports anything else there is no banner and the tag is placed on first load, so collection begins before the visitor has acted.
Why: Seeing where the site confuses people.
Where it is processed: Microsoft Ireland Operations Limited for EU customers, transferring to Microsoft Corporation in the United States under Standard Contractual Clauses between those two entities.

Google Ireland Limited (Google Analytics 4, traffic measurement)

What reaches them: Page views, referrer, approximate country, device and browser type, and a randomly generated visitor id. No figure entered into the calculator is ever sent: the tag is configured with no custom event parameters, so the only thing it can report about a page is that the page was viewed. When your browser reports an EU or EEA time zone the tag is placed on the page only after you accept, so a visitor who declines gets a page that never loads it. When it reports anything else there is no banner and the tag is placed on first load, so measurement begins before the visitor has acted.
Why: Knowing which pages people arrive on and which channel brought them, which is the only way to tell whether a distribution attempt worked.
Where it is processed: Google Ireland Limited for EU visitors, transferring to Google LLC in the United States under Standard Contractual Clauses and the EU-US Data Privacy Framework.

Booking a call goes to Calendly. The two buttons that offer a founder call, Book a founder call and See the calendar, are plain links to a booking page Calendly serves. Following one hands Calendly your IP address, your browser and device details, and the campaign parameters written into the link, which name the button you pressed. Fill in the booking form on that page and the name and email address you type there go to Calendly too. Both links carry rel="noopener noreferrer", so your browser withholds the address of the page you came from, and the figures you entered into the calculator stay in your own browser.

The rep, quota and revenue figures you enter into the calculator are not sent to any of these companies unless you save them to a workspace. Otherwise they are processed only in your browser. The three exceptions are named in section 2: read a comp plan FILE you uploaded, read plan text you pasted, on the button we offer when the on-device reader cannot find your rates, and match the columns in a team FILE you uploaded, where the only thing sent is its header row and up to five sample rows. Not all of them are files. The rep figures you type are never sent there.

6. What we checked, and when

Every claim below was read off the vendor's own published terms on 31 July 2026, and the Calendly entry on 6 August 2026, the day that company was added. Where a vendor publishes no answer, we say so rather than paraphrase one.

Anthropic. Its Commercial Terms state that “Anthropic may not train models on Customer Content from Services”, so the plan file you send is not training data (commercial terms). For API traffic, Anthropic automatically deletes inputs and outputs within 30 days of receipt, with longer retention in a small number of cases it lists, including enforcing its usage policy and complying with law (retention). For transfers out of the EEA, the UK and Switzerland, Anthropic's Data Processing Addendum incorporates the 2021 EU Standard Contractual Clauses together with the UK and Swiss addenda (DPA).
MongoDB. MongoDB lets the customer pick the deployment region (their DPA, section 9.1). That part is theirs. The next part is ours, not something you can check in their terms: we picked Frankfurt, so workspace data sits in the EU and there is no other region in play. MongoDB certifies under the EU-US Data Privacy Framework, the UK Extension and the Swiss-US framework, and its DPA also carries the 2021 Standard Contractual Clauses with the UK and Swiss variants (DPA).
Vercel. Its addendum states that primary processing facilities are in the United States, and incorporates the 2021 Standard Contractual Clauses plus the UK International Data Transfer Addendum (DPA).
Resend. Primary processing is in the United States. Its addendum applies the EU Standard Contractual Clauses with the UK and Swiss variants, and it certifies under the EU-US Data Privacy Framework. It deletes customer data within 90 days of an account closing (DPA).
Stripe. Accounts in the Americas contract with Stripe, LLC and accounts elsewhere with Stripe Payments Europe, Limited. Transfers to the United States run under Stripe's Data Transfers Addendum, which applies the Standard Contractual Clauses, the UK addendum or the Data Privacy Framework as each case requires (DPA).
Calendly. Its Data Processing Addendum is incorporated into its Customer Terms rather than signed separately, so it applies to the account behind the booking links already. Section 2.2 states that “Calendly is the Processor of Personal Data and shall Process Personal Data on behalf of and in accordance with Customer's Instructions”, and section 2.3 states that processing “will occur in the United States and other jurisdictions outside the residence of the Data Subjects”, which is wider than the United States alone and names none of those other jurisdictions. For transfers out of the EEA and the UK, section 3.1 relies first on the Data Privacy Framework, under which Calendly, LLC self-certifies together with the UK Extension, and falls back to the Standard Contractual Clauses with the UK Addendum if a framework is invalidated (DPA). One part of a booking is theirs rather than ours, and we would rather name it than let the row above stand for all of it. Section 9 of that same addendum says Calendly also processes some personal data as a controller for its own purposes, and it lists seven: managing the relationship with its customer, which here is us, including creating the account, handling billing and performing sales and marketing; its internal business operations, such as accounting, audits, tax preparation and filing, and compliance; monitoring, investigating, preventing and detecting fraud, security incidents and other misuse of the Services; identity verification; complying with legal or regulatory obligations applicable to the processing and retention of personal data to which it is subject; developing, improving and understanding usage of its products and services; and anything else permitted under data protection law and set out in Calendly's own Privacy Notice, which is a separate document from this addendum. A DPA we sign covers what Calendly does on our instructions. It does not reach that part, and no wording of ours could make it.
Microsoft. Clarity in the EU is contracted through Microsoft Ireland Operations Limited, which holds Standard Contractual Clauses with Microsoft Corporation in the United States for the transfer between those two entities. Microsoft states this on Clarity's own FAQ, and the same page says Clarity acts as a data controller rather than as our processor, which makes it a different relationship from the seven above, and that Clarity data is available to us for up to 30 days from recording (Clarity FAQ). Whether the Clarity tag is placed on the page at all depends on which region your browser reports, and we would rather set out both cases than let one of them stand for both. If your browser reports an EU or EEA time zone the tag is not placed until you press Accept on the cookie banner, and if you decline it is never placed at all. Otherwise there is no banner: analytics consent is recorded on your behalf when the page first loads, and the tag is placed then, before you have done anything. Which of the two you get is decided by your browser's own time-zone setting rather than by looking up your address. We match that setting against a named list of EU and EEA zones, which includes Cyprus and the French outermost regions as well as every zone whose name begins with Europe, so a browser reporting one of them gets the banner wherever it happens to be, and a browser reporting a time zone we cannot read at all is treated as European. The limit of that method, stated plainly: a browser reporting a zone outside the list is treated as outside the EEA, so a visitor whose device is set to somewhere else does not see the banner. The reason the EEA branch withholds the tag itself rather than just the consent signal is that Microsoft's FAQ is explicit that Clarity without cookie consent still records page views and basic interactions, so consent-signalling a tag that is already running would not be enough.

What we do not claim. We hold no SOC 2, no ISO 27001 and no third-party privacy audit, and nothing on this page is a certification or a compliance badge. This section is a factual description of where your data goes, kept accurate as the product changes. If your procurement process requires an audited processor today, we are not the right tool for you yet, and we would rather say that here than at the end of a review.

Data processing agreement. If your organisation needs a signed DPA covering the seven sub-processors above, email info@leanaistudio.com and we will send one. There is no charge and you do not need to be a customer to ask for it.

7. Retention

Calculator data you do not save to a workspace is never stored by us: it lives only in your own browser, on your device, until you clear it with Start fresh or clear this site's data, so there is nothing on our side to retain or delete. Workspace documents are retained until you delete them or delete your account, at which point they are removed immediately. Sign-in links expire after 15 minutes, and a sign-in session lasts 90 days, refreshed while you keep using the tool, so that signing in once is normally enough. If you subscribe, Stripe retains your billing records under its own policy. Contact details you send us by email are retained until you ask us to remove them. Analytics data is retained according to each provider's standard retention period.

8. Your rights

Under the GDPR you have the right to access, rectify, erase, restrict, or port your data, and to object to processing. To exercise any of these rights, email info@leanaistudio.com. You also have the right to lodge a complaint with your local supervisory authority.

9. Cookies

We use cookies for anonymous product analytics, plus one strictly necessary cookie that keeps you signed in if you create a workspace. There are no advertising cookies on this site. Visitors whose browser reports an EU or EEA time zone are asked for consent before any analytics cookie is set, and analytics can be declined without affecting your use of the calculator. Otherwise the banner is not shown and analytics consent is recorded on first load, which is the model described in the Microsoft entry above, together with the limits of deciding this from a time zone.

10. Contact

Questions about this policy: info@leanaistudio.com