Privacy Policy

Last updated: November 4, 2026

This policy explains what information Duodecimal, LLC, a California limited liability company ("we", "us"), collects about you when you use Lean Data Scientist, how we use it, who we share it with, how long we keep it, and your rights. It covers leandatascientist.com, the Vibe Coding course at learn.leandatascientist.com and our MCP servers (together, "the service"). Our Terms of Service also apply.

In short

We collect what we need to run the service: your account (email, name, picture), your Pass purchases, and every SQL query and Python run your AI agent makes in our sandbox, with its results.
We do not sell your information or use it for advertising, and the site has no analytics or advertising trackers.
Stripe handles your card and Clerk handles your password. We never see either.
You can ask to see, correct, export or delete your information at any time: write to support@leandatascientist.com.

What we collect

Your account

Clerk handles sign-up and sign-in. We receive and keep your email address, the name and picture you give (if you have no picture, the site draws one for you in your browser), your language, and when your Pass ends.
If you sign in with Google, Google gives Clerk your name, email address and picture.
Only Clerk stores your password; we never see it. To keep accounts secure, Clerk also records the IP address, browser and device you sign in from.

Buying the Pass

You pay on Stripe's checkout page. Stripe collects and processes your card and billing details; we never see your card number.
We give Stripe your email address and account number so the payment is matched to your account. We keep the amount, currency, payment and refund dates, and Stripe's reference numbers for each purchase.

What you do in the sandbox

Every time your AI agent calls one of our MCP tools, we record which tool and exercise, the SQL or Python code it ran, the result it got back (Python's text output; for charts, only how many, not the images), how long it took, how many rows it returned and any error. We use these records to enforce the daily limits, stop bulk extraction of the data, fix problems and improve the exercises.
Please do not put personal information or secrets such as passwords in your code or queries: they are logged like any other code.

Connecting your AI client

When you connect an AI client such as Claude, ChatGPT or Cursor to our MCP servers, we keep the registration details the client sends (such as its name and return address) and when and for what you authorized it. We store only a cryptographic hash of the access tokens we give it, never the tokens themselves.

Technical information

As on most websites, your IP address, browser details, the address you requested and the time appear in Cloudflare's and our server's request logs.

When you contact us

When you email us, we receive and keep your message and email address.

What we do not collect

We do not use analytics tools such as Google Analytics, advertising pixels or cross-site tracking. We do not collect your precise location, and we do not ask you for sensitive information such as health, race or religion.

How we use it

To run the service: sign you in, turn on your Pass, and run the queries and code your AI agent sends.
To enforce the limits and keep the service safe: find and stop abuse, bulk data extraction and attacks.
To process payments, handle billing questions, and meet tax and accounting obligations.
To answer your messages and tell you about important changes to the service or this policy.
To improve the service, for example by seeing which exercises people get stuck on and what often goes wrong. We do not send marketing email.

Legal bases (EEA and UK users)

Contract: to provide what you signed up for and bought (your account, the Pass, the sandbox).
Legitimate interests: to log sandbox activity and requests so we can enforce the limits, keep the service safe and improve it. You can object to this; see "Your rights" below.
Legal obligation: to keep payment records as tax and accounting law requires.

We give information only to the service providers that help us run the service, and they may use it only as we instruct:

Clerk: sign-up, sign-in and account management.
Stripe: payments, receipts and refunds. Stripe also processes payment information under its own privacy policy, for example to prevent fraud.
Cloudflare: hosts the site and carries traffic securely to our server.
Amazon Web Services (AWS): our server and database run on AWS in Oregon, USA. Python code your AI agent runs is executed in an isolated AWS environment (Amazon Bedrock AgentCore), which knows only your account number, not your name or email.
Purelymail: our email.

The AI client you choose (for example Anthropic's Claude or OpenAI's ChatGPT) sees the queries it runs in our sandbox and their results, as well as your conversation with it. It is not our service provider: its own privacy policy governs that information.

Beyond that, we share your information only when the law requires it (such as a valid court order), to protect the safety of the service and its users, or if our business is merged or sold, in which case the new owner must keep to this policy. We do not sell your personal information or share it for cross-context behavioral advertising.

Where your information is stored

Our server and database are in the United States. If you use the service from outside the US, your information is transferred to the US to be processed. Where required, our service providers protect these transfers with legal mechanisms such as the EU Standard Contractual Clauses.

How long we keep it

Account information: for as long as your account exists. When you ask us to delete your account, we delete it from Clerk and from our database within 30 days.
Sandbox activity records: kept, to prevent abuse and improve the exercises. When you delete your account, they are unlinked from it and can no longer be tied to you.
Payment records: for as long as tax and accounting law requires, usually up to 7 years. When you delete your account, our records are unlinked from it as well; Stripe keeps its own records under its policy.
AI client authorizations: access tokens expire after 1 hour and refresh tokens after 30 days, and are deleted 7 days after they expire, or when you delete your account.
Python sessions: variables and files in a session are deleted with it, after 15 minutes without use or 2 hours at most.
Request logs: overwritten as new logs come in, normally within a few weeks.
Your messages: as long as needed to handle your request and follow up on it.

Your rights

Wherever you live, you can ask us to:

tell you what information we hold about you and give you a copy, in a machine-readable format if you like;
correct information that is wrong (you can also change your name and email in your account settings);
delete your account and information, except what the law requires us to keep, such as payment records;
stop a particular use of your information that relies on our legitimate interests.

Write to support@leandatascientist.com from your account's email address, which is how we confirm it is you. We will reply within 30 days. You will not be treated differently for using these rights.

EEA and UK: you also have the right to restrict processing, and to complain to your local data protection authority.
California: you have the right to know, delete and correct the personal information we collect, and you can use an authorized agent to make a request for you. In the past 12 months we have collected these categories: identifiers (email address, name, account number, IP address), commercial information (purchase records), internet activity (sandbox activity records and request logs), and account login credentials (used only by Clerk to sign you in). We do not sell or share personal information.

Cookies and browser storage

Clerk uses cookies to keep you signed in. They are needed for the service to work, so they do not need separate consent.
The Vibe Coding course saves your progress in your own browser's local storage; it is not sent to us.
We use no analytics, advertising or other tracking cookies. The site's fonts are served from our own site, not loaded from a third party.

Security

Every connection is encrypted with HTTPS. Our database is not open to the internet; only we can reach it.
Clerk stores passwords and Stripe stores card numbers; we keep only hashes of access tokens.
Code your AI agent runs is executed in an isolated environment with no internet access, which cannot see our keys or other users' data.
No system is perfectly secure. If a security incident affects your personal information, we will tell you as the law requires.

Age requirement

The service is only for people aged 16 and over. We do not knowingly collect information from anyone under 16; if we learn that we have, we delete the account and its information. If you believe someone under 16 is using the service, please contact us.

Changes to this policy

We may update this policy. We will change the date above and tell signed-in users about significant changes on the site before they take effect.

Contact

Duodecimal, LLC (Lean Data Scientist)
support@leandatascientist.com