Privacy Policy

Our digital-card platform helps individuals and organizations create, distribute and manage digital business cards, contact capture forms, NFC cards, email signatures, virtual backgrounds and other networking tools. We operate from Hungary and comply with the EU General Data Protection Regulation (GDPR), the UK Data Protection Act (including the 2025 Data (Use and Access) Act), the California Consumer Privacy Act as amended by the California Privacy Rights Act (CCPA/CPRA) and other relevant privacy laws. This policy applies to all users of our website, mobile and web applications, NFC and QR products, APIs and any offline services that reference this notice, whether you hold a registered account or use the Service as a guest. We do not knowingly collect or store special categories of personal data such as racial or ethnic origin, political opinions, religious beliefs, health data or biometric identifiers; the information stored in our system is typically the type contained on a business card (e.g., name, company, title, contact details). The policy does not apply to external websites linked from our Service; those sites have their own privacy practices, and we encourage you to review them.

We collect and process personal data consistent with the GDPR's data-minimization principle:

• Account and profile dataWhen you register or update an account, you provide your name, email address, password, company, job title and contact details. You may upload photos, logos and social links. Billing information is collected only for paid plans.
• Contact card contentYou control the information you place on each digital card – names, titles, phone numbers, email addresses, postal addresses, social media handles, bios, logos, galleries, audio files, documents or custom fields.
• Contact capture and consentWhen collecting another person's details, you must provide a clear capture disclaimer and link to your privacy policy. Recipients must tick a consent checkbox before you process their information. By submitting someone else's contact details to our Service (e.g., their email address), you represent that you have obtained their consent and may share the details accordingly. Voice notes and recordings: where you record a conversation or capture a voice note, we store the audio, transcribe it, and generate a written summary using a third-party AI provider. You are responsible for obtaining the consent of everyone present before recording, and for deleting a note if someone withdraws that consent. We do not permit the provider to use this content to train its models.
• Smart Scan and OCR dataWhen you use our Smart Scan feature to photograph or upload a paper business card, the image is processed using optical character recognition (OCR) and then sent to a third-party AI provider (currently OpenAI) to extract structured contact data such as names, phone numbers, email addresses and job titles. Source images are stored temporarily to complete the extraction and are deleted within 30 days. The extracted text, language metadata and resulting contact record are retained in your account. We do not permit our AI provider to use your data for model training.
• Third-party integrationsWhen you connect social-login providers, CRM platforms (such as Salesforce or HubSpot), marketing tools or other third-party services, we receive basic profile data and authorization tokens required to operate those integrations. Contact data you choose to sync between our Service and a CRM is transmitted only at your direction.
• Automatic data collectionWe automatically log pages you visit, features you use, timestamps, referring URLs, device type, operating system, browser type, IP address (hashed) and general location (country level). We use cookies, web beacons and local storage to authenticate you, remember preferences, measure performance and monitor whether emails are opened. Analytics or marketing cookies are set only after you provide explicit consent; you can manage cookie preferences via our cookie banner and browser settings.
• NFC/QR interactionsWhen you tap an NFC card or scan a QR code, the Service exchanges a URL or vCard with the recipient's device. We record the date, time, card identifier, device type and general location. Our NFC cards employ encryption, authentication protocols, domain whitelisting and dynamic QR fallbacks aligned with ISO 27001 and GDPR. Lost or stolen cards can be deactivated through your account settings.
• Wallet pass dataWhen you add a digital card to Apple Wallet or Google Wallet, we generate a pass containing your selected card information. For Apple Wallet, we register your device token to deliver automatic pass updates via push notifications and track pass versioning. For Google Wallet, we store a wallet object identifier. We record wallet-save statistics (wallet type, date) for analytics purposes.
• Push notification dataIf you enable push notifications, we collect a Firebase Cloud Messaging (FCM) token for each of your device sessions. These tokens are used solely to deliver notifications you have opted into (e.g., card scan alerts, connection requests). You can disable push notifications at any time through your device settings or notification preferences in your account.
• Guest user dataYou may create a digital card as a guest without full registration. We store the card content you provide and assign a guest token. If you later create an account, guest data is merged with your registered profile.
• CommunicationsWe collect messages sent to customer support, feedback forms or surveys for quality assurance and service improvements.
• Contact enrichment dataWe may offer optional contact enrichment features that supplement user-provided or AI-scanned contact data with publicly available information from third-party data providers (for example, company details, job titles, social media profiles or professional biographies sourced from public business directories, company websites or professional networks). Enrichment is performed only at your request or when you enable an enrichment feature, never automatically without your knowledge. Enriched data is clearly distinguished from user-provided data and can be reviewed, corrected or deleted at any time. We do not use enrichment data to build profiles for advertising purposes. The legal basis for enrichment processing is your consent (GDPR Article 6(1)(a)) or legitimate interest (GDPR Article 6(1)(f)) where you have a reasonable expectation that such processing may take place.
• Replies to emails sent through the ServiceWhen an organization sends follow-up emails to its leads through our Service with reply tracking switched on, the emails carry a reply address operated by us. A reply sent to that address is received by us on the organization's behalf: we store the sender's name and email address, the subject and the content of the reply, record the reply on the matching lead in the organization's account, and forward it to the member of the organization who sent the original email. Attachments are never stored. The received message itself is deleted as soon as the reply has been recorded, and a message we cannot match to an email sent through the Service is deleted within 14 days. The stored reply, including any excerpt of it handed to an AI employee of the organization, is kept for 90 days and then deleted; a note that a reply arrived stays on the lead, without the reply's subject or sender address. We do not read anyone's mailbox. An administrator of the organization can switch reply tracking off: emails sent after that carry the sender's own reply address, and a reply that still reaches us for an email sent earlier is forwarded to the sender without being stored.

We process personal information for legitimate purposes based on consent, contractual necessity and legitimate interests. Uses include:

• Providing core servicesDisplaying the fields you choose to share, enabling you to exchange digital cards, manage leads, generate email signatures, create virtual backgrounds and add cards to mobile wallets.
• Contact capture and lead managementStoring contact details with recipients' explicit consent for follow-up communications.
• Smart Scan processingExtracting contact data from uploaded business-card images using OCR and AI, and creating structured contact records in your network.
• Operating and improving the ServiceUsing logs and analytics to ensure functionality, diagnose issues, analyze trends and develop new features.
• Personalization and marketingTailoring content, recommendations or notifications based on usage patterns; sending marketing communications with consent; allowing you to opt out at any time.
• Security and fraud preventionDetecting suspicious behaviour and protecting against malware, phishing and unauthorized access.
• Legal and regulatory complianceMeeting tax, accounting and other legal obligations and responding to lawful requests.
• Research and developmentUsing aggregated and anonymized data for research and to improve our algorithms; providing transparency and human oversight when deploying AI or machine-learning tools.
• Contact enrichmentSupplementing contact records with publicly available business information at the user's request, such as company details, job titles and professional profile links, to help users maintain accurate and complete contact databases.

We retain personal data only as long as necessary to fulfil the purposes outlined above:

• Account and content dataRetained while your account is active and deleted or anonymized within 30 days after account closure, unless a longer retention period is required by law or contract.
• Smart Scan source imagesSource images uploaded for OCR are retained for up to 30 days to allow reprocessing and quality review, then automatically deleted. The extracted contact data persists in your account until you delete it.
• Usage and operational logsOperational logs (including truncated IP addresses, hashed identifiers, device/browser metadata and referring URLs) are retained up to 90 days for analytics, debugging, security and support; then deleted or anonymized.
• GDPR minimization and retentionWe apply data minimization to logs and analytics by default, pseudonymize identifiers where possible and limit retention to the shortest period needed for security and service performance. Log data is automatically purged within 90 days unless legally required to retain it longer.
• Communications and transaction recordsRetained up to seven years to satisfy tax, accounting and legal obligations.
• Anonymized or aggregated dataMay be retained indefinitely for research, benchmarking and business insights.
• Contact enrichment dataEnriched data fields are retained as part of the contact record for as long as the contact exists in your account. If you delete a contact or your account, enrichment data is deleted with it.
• Calls, recordings and deleted leadsCall recordings and their transcripts are kept until someone in your organization deletes them, or for the period your organization sets (30, 90 or 365 days), after which they are erased automatically. The record of each call (the number called, time, duration, outcome and credits used) is kept with the lead for billing and reporting. A lead your organization deletes is erased 30 days later, together with its notes, files and call recordings; its call records stay for billing with the phone number removed. A scanned contact you delete is erased 30 days later, with its images.

We do not sell personal information. We share data only in limited circumstances:

• With other usersWhen you share a card via QR code, link or NFC tap, recipients see only the fields you choose to disclose.
• With your consentWe may share information for a specific purpose when you authorize us to do so.
• Service providers and partnersTrusted vendors host infrastructure, process payments, send emails, provide analytics and support customer service. They receive only the data necessary to perform their functions and must keep it confidential. Key categories of service providers include cloud hosting, payment processors, email delivery services and customer-support platforms.
• Analytics and advertising providersWe use analytics providers (currently Google Analytics for Firebase, Microsoft Clarity, which records how our web pages are used, and PostHog, which provides product analytics and error tracking) and advertising partners (Meta and Google Ads) to measure performance and improve our marketing. These providers may use cookies or similar technologies and process data under their own privacy policies. PostHog identifies you only by a pseudonymous user id, never by name or email address, and processes this data in the European Union or the United States; its privacy policy is at https://posthog.com/privacy. On our website, no analytics or advertising cookies are set in the EEA, the UK or Switzerland before you agree in the cookie banner. Elsewhere, analytics and Google's advertising measurement are on until you turn them off in the cookie settings, and a Global Privacy Control signal from your browser turns advertising off. Meta receives information from our website, and from our servers about your sign-ups and purchases, only after you allow advertising cookies. Our mobile apps include Meta's software development kit, which measures app activity such as installs, sign-ups and purchases. In the EEA, the UK and Switzerland it sends nothing until you allow it; elsewhere it is on until you turn off "Share app activity with advertising partners" in the app's settings. While it is on, it may also receive your email address or phone number in hashed form and your device's advertising identifier, and our servers may report your sign-ups and purchases in the app to Meta; on iPhone, these happen only if you also allow tracking when iOS asks, and in the EEA, the UK and Switzerland allowing tracking is how you allow the kit.
• AI and machine-learning processorsWhen you use Smart Scan, uploaded business-card images and extracted text are sent to OpenAI for structured data extraction. OpenAI processes this data under a Data Processing Agreement and is prohibited from using it for model training. No other personal data is shared with AI providers without your knowledge.
• Telephony providerWhen you call a lead from Lynqu, on our website or in our apps, the call is carried by a telephony provider (currently Telnyx). It processes the phone numbers on both ends, the call's metadata (time, duration, outcome) and the call audio in order to connect the call, and it also sends the code that verifies your caller ID. If your organization turns on call recording, the lead is first told who is recording the call and why, and asked whether they agree. The call is recorded only after the caller confirms that the lead agreed; otherwise nothing is recorded. The provider keeps a recording only until we have stored it in your organization's account, after which the provider's copy is deleted. Where your organization keeps transcripts, the recording is transcribed and summarised by our AI provider (currently OpenAI), which may not use it to train its models. Your organization decides whether calls are recorded at all, whether a recording keeps the audio, the transcript or both, and whether call recordings are deleted automatically after 30, 90 or 365 days. The caller can stop a recording during the call, in which case nothing recorded on that call is kept, and can mark a lead who objects so that later calls are not recorded. Deleting a recording or a note erases it, transcript included.
• CRM and integration partnersWhen you enable a CRM integration (e.g., Salesforce, HubSpot), contact data is transmitted to that provider at your direction using OAuth or API credentials you supply. We do not initiate CRM syncs without your explicit action.
• Legal requirements and protection of rightsWe may disclose information if required by law, subpoena or court order, or to enforce our agreements and protect our rights or respond to legal claims.
• Business transfersIf we undergo a merger, acquisition or asset sale, personal information may be transferred as part of the transaction; we will notify you of any material changes.
• Aggregated or de-identified dataWe may share anonymized analytics for research, marketing or benchmarking that do not identify individuals.
• International transfersData may be transferred to and processed in countries outside your jurisdiction. We rely on Standard Contractual Clauses, the UK International Data Transfer Addendum or relevant Data Privacy Frameworks and commit to resolving complaints about our handling of personal information. We are certified under the EU-U.S., UK and Swiss Data Privacy Frameworks and abide by the Data Privacy Framework Principles.
• Onward transfer accountabilityIf we transfer your data to a third-party agent, we require them to provide at least the same level of protection and remain liable for their processing.
• Contact enrichment providersWhen you use contact enrichment features, limited contact data (such as name, email address or company name) may be sent to third-party enrichment providers to retrieve publicly available business information. These providers process data under Data Processing Agreements and are prohibited from using your data for their own purposes. No enrichment data is shared without your knowledge.

• Separate consent checkboxesOur forms include distinct checkboxes for analytics, marketing and third-party sharing with clear descriptions. Boxes are never pre-ticked; you can withdraw consent at any time, and we maintain timestamped consent logs for audit trails.
• Cookie controlsOur cookie banner offers "Accept All", "Essentials Only" and "Customize", with separate switches for analytics (Google Analytics, Microsoft Clarity, PostHog), personalization and advertising (Meta Pixel, Google Ads) cookies. In the EEA, the UK and Switzerland, no non-essential cookies are set until you agree. Elsewhere, analytics and Google's advertising cookies are on until you turn them off, and Meta's are set only after you allow advertising. You can reject them and still use our Service, and change your choice at any time in the cookie settings.
• Opt-out of targeted advertisingWe never use the contact details you capture (cards, scans and leads) for advertising. Our own advertising measurement, described under Analytics and advertising providers, can be turned off in the cookie settings or with a Global Privacy Control signal from your browser.
• User communications and consent for othersIf you provide another person's contact details, you must obtain their consent. We may disclose such information if required to comply with legal processes.

We act as data controller for our own user accounts, billing records and usage logs, and as data processor when we handle your customers' contact data. We execute Data Processing Agreements (DPAs) defining our obligations, security measures, retention periods and subprocessor authorizations. A DPA is available upon request for enterprise customers. Subprocessors (e.g., cloud hosting, analytics providers, payment processors, AI processors) are vetted, contractually bound to confidentiality and security requirements, and subject to our privacy obligations. A current list of subprocessors is available on request; we will notify you of material changes to that list at least 30 days in advance, giving you the opportunity to object before new subprocessors begin processing your data.

We employ physical, technical and administrative safeguards to protect personal data. Measures include encryption at rest and in transit, role-based access controls, single sign-on (Google, Microsoft and Apple), domain whitelisting, dynamic link generation, regular vulnerability testing, employee privacy training and incident-response procedures. We cannot guarantee absolute security, but we take reasonable steps to prevent loss, misuse or unauthorized access. Data protection principles are integrated into product design, and high-risk processing triggers Data Protection Impact Assessments (DPIAs).

Our analytics and personalization tools may use machine learning to suggest networking connections or optimize engagement. Our Smart Scan feature uses OCR and a third-party large language model (currently OpenAI GPT-4o-mini) to extract contact data from business-card images. We have a Data Processing Agreement with OpenAI that prohibits using your data for model training and requires deletion of inputs after processing. When deploying AI, we inform you how personal data is used, provide meaningful information about the logic involved and ensure human oversight. Under the EU AI Act and GDPR Article 22, you can object to automated decision-making and request human review. AI-powered or beta features are provided "as is," may change or be discontinued, and should not be used for critical decisions without independent verification. AI-processed contact data, including Smart Scan extractions and contact enrichment results, may contain inaccuracies. You are solely responsible for reviewing and verifying AI-processed data before relying on it for business decisions or communications.

Where we rely on legitimate interests as the legal basis for processing (for example, analytics, security monitoring or service improvement), we have conducted a Legitimate Interest Assessment (LIA) balancing our interests against your rights and freedoms. A summary of each assessment is available upon request by contacting our Data Protection Officer.

Our infrastructure is hosted in the EU and the United States. For cross-border transfers, we rely on Standard Contractual Clauses, the UK International Data Transfer Addendum, Data Privacy Framework certification and other recognized safeguards. We monitor and comply with evolving regulations, including the EU Digital Services Act, Digital Markets Act, AI Act, the UK Data (Use and Access) Act 2025 and India's DPDP Act 2023.

The Service is not intended for anyone under 16, and we do not knowingly collect personal data from them. If we learn that someone under 16 has provided personal information without parental consent, we will delete it.

We do not collect biometric identifiers or biometric information as defined by the Illinois Biometric Information Privacy Act (BIPA), the Texas Capture or Use of Biometric Identifier Act (CUBI) or similar state or national laws. Our Smart Scan feature processes images of paper business cards to extract printed text; it does not analyse facial features, fingerprints or other biometric characteristics. NFC interactions use radio-frequency communication between devices and do not involve biometric data collection.

Subject to applicable law, you have the right to:

• Access the personal data we hold about you
• Rectify inaccurate or incomplete data
• Erase your data (right to be forgotten)
• Restrict or object to certain processing, including direct marketing
• Data portability for information you provided, including AI-scanned and enriched contact data, in a structured, commonly used and machine-readable format
• Withdraw consent at any time without affecting prior lawful processing
• Object to automated decision-making and request human review of decisions that produce legal or similarly significant effects
• Lodge a complaint with a supervisory authority (in Hungary, the NAIH; in other EU/EEA countries, your local data-protection authority)

We will respond to verified rights requests within 30 days (GDPR) or 45 days (CCPA), with the possibility of extension where permitted by law. You can exercise these rights via your account settings or by contacting our Data Protection Officer. You may also export your card data in vCard format at any time through your account. Deletion requests apply to data we control; information shared with other users, stored by subprocessors or synced to external CRMs must be deleted by those parties.

If you are a California resident, the California Consumer Privacy Act as amended by the California Privacy Rights Act provides you with additional rights:

• Right to knowYou may request the categories of personal information we have collected, the sources of collection, the business purposes for collection, the categories of third parties with whom we share data, and the specific pieces of personal information we hold about you.
• Right to deleteYou may request deletion of personal information we have collected from you, subject to certain exceptions (e.g., completing a transaction, detecting security incidents, complying with legal obligations).
• Right to correctYou may request correction of inaccurate personal information.
• Right to opt out of sale or sharingWe do not sell personal information. We share it with advertising partners (Meta and Google) to measure and target our advertising, which the CCPA treats as sharing. On our website you can opt out at any time by turning off advertising cookies in the cookie settings, and we treat a Global Privacy Control signal from your browser as an opt-out. Meta receives information from our website only after you allow advertising cookies. In our mobile apps, you can opt out at any time by turning off "Share app activity with advertising partners" in the app's settings; Analytics and advertising providers describes what Meta's software development kit measures.
• Right to limit use of sensitive personal informationThe only sensitive personal information we collect is your account login credentials, which we use only to sign you in and keep your account secure. We do not use or disclose sensitive personal information for any other purpose, so the right to limit does not apply.
• Non-discriminationWe will not discriminate against you for exercising your CCPA rights. You will not receive different pricing or service quality for making a privacy request.

To make a request, contact us at the email address provided on our website or use the privacy controls in your account settings. We will verify your identity before processing requests. An authorized agent may act on your behalf with written permission. We respond to verified requests within 45 days. In the preceding 12 months we have collected these categories of personal information, for the business purposes described in Section 3: identifiers (such as name, email address, phone number, account ID and IP address); customer records and professional information (such as company, job title and the content of your cards); commercial information (your subscriptions and purchases); internet or other electronic network activity (how you use the Service, and device and browser data); approximate location derived from your IP address; audio information (voice notes and, where your organization records calls, call recordings); inferences (such as lead scores and suggested next steps); and sensitive personal information (your account log-in credentials). How long we keep each category is set out in Data Retention. We disclose these categories to the service providers described in How We Share Information. Advertising partners receive only identifiers and internet activity (such as cookie and device identifiers, a hashed email address, the pages you visit, and your sign-ups and purchases), as described in Right to opt out of sale or sharing.

Some browsers transmit a "Do Not Track" (DNT) or "Global Privacy Control" (GPC) signal. We honour GPC signals as a valid opt-out of sale or sharing under the CCPA/CPRA. For DNT signals, because there is no universally accepted standard, we do not currently alter our data-collection practices in response to DNT headers, but we do respect your cookie-consent preferences.

In the event of a personal data breach that is likely to result in a risk to your rights and freedoms, we will notify the competent supervisory authority (the Hungarian National Authority for Data Protection and Freedom of Information, NAIH, or the relevant authority in your jurisdiction) within 72 hours of becoming aware of the breach, as required by GDPR Article 33. If the breach is likely to result in a high risk to your rights and freedoms, we will also notify you without undue delay via email or through the Service, describing the nature of the breach, the likely consequences, the measures we have taken or propose to take, and how you can contact our Data Protection Officer. We maintain an internal breach register documenting all incidents regardless of severity. For California residents, notification will also comply with California Civil Code Section 1798.82.

When you set a digital card's visibility to "Public," the card page and the information displayed on it become accessible to anyone on the internet, including search-engine crawlers and bots. We include the URLs of Public cards in our sitemap, which we submit to search engines (such as Google and Bing) to facilitate indexing and discoverability. Only the information you choose to display on your card (for example, name, job title, company, bio, avatar, banner image and enabled contact fields) is exposed on the public page. We do not expose your account email address, password, billing details, analytics data or any other information you have not added to the card itself. Cards set to "Private" or "Secure" are excluded from our sitemap, served with a "noindex" robots directive and require authentication or a PIN to view; they are not intended to be indexed by search engines. You can change your card's visibility at any time through your account settings. Please note that after you change a card from Public to Private, cached versions may persist in search-engine indexes until the search engine re-crawls and removes the content; we have no control over third-party caching behaviour. If you need expedited removal, you can use search-engine removal tools (for example, Google's Remove Outdated Content tool). By setting your card to Public you consent to this processing on the legal basis of your explicit consent (GDPR Article 6(1)(a)) and acknowledge that the information may be collected and displayed by third-party services.

We may update this privacy policy to reflect changes in law or our practices. Significant changes will be communicated through the Service or by email at least 30 days before they take effect, and we will note the effective date. Continued use after the effective date constitutes acceptance. For privacy questions, data-protection requests or complaints, contact our Data Protection Officer at the email address provided on our website. EU residents may also contact our EU representative; UK residents may contact our UK representative. Contact details for our DPO and representatives are published on our website. If you are not satisfied with our response, you have the right to lodge a complaint with your local supervisory authority.

For some business contacts, we may supplement (enrich) the contact record with publicly and commercially available business information so that company and professional details are more complete. This section explains where that data comes from, why we process it, how long we keep it, and how anyone can object. You decide which contacts are enriched: we act on the request of the customer who holds the contact record, and it is that customer who confirms they have a basis to enrich it, including where the only address they hold is a personal one. We check every request against the objections recorded below before we look anything up, and we decline to enrich a contact we cannot identify well enough to make that check.

• Sources: we use self-built firmographic lookups together with licensed data vendors (such as People Data Labs and Apollo) for business-profile data and headshots. Our Smart Scan feature additionally uses a third-party AI provider (currently OpenAI) to read scanned business cards.
• Lawful basis: we rely on our legitimate interest in providing accurate business-context information (GDPR Article 6(1)(f)). Enrichment is limited to business-context data; we do not enrich special-category (sensitive) data. You may object to this processing at any time.
• Retention: enriched fields carry a time-to-live (up to 180 days depending on the source) and are automatically purged when they expire. The display-only headshot is removed at the same expiry.
• Third-party AI use: enrichment and scan data may be processed by third-party AI providers to extract or structure information. We do not permit these providers to use your data to train their models, and we disclose that AI is involved in producing this content (EU AI Act transparency).
• Your rights and opt-out (Articles 14 and 21): any person can object and request removal without holding a Lynqu account at: https://lynqu.com/privacy/enrichment-opt-out. On a verified objection we stop enriching, remove the enriched fields, and add the person to a suppression list so they are never re-enriched.

This section supplements, and is governed by, the rest of this Privacy Policy.

We work with advertising and analytics partners (including Meta (Facebook / Instagram)) to measure how our marketing reaches you and to improve the relevance of ads we show across the web and in our app. These partners may receive limited information about your interactions with Lynqu, such as device identifiers (IDFA on iOS when you grant App Tracking permission, AAID on Android, or similar), app events (registration, purchase, content views), and purchase history.

• What's shared: hashed (one-way encrypted) identifiers, event data, and the IP address and browser or app version of the device you used. Never your raw email, phone number, or full name.
• Card statistics: when someone views, shares or saves a card we count it for the card's owner. If you are not signed in we keep only a hashed (one-way encrypted) form of your IP address and user agent, in a cache entry that expires the same day, so that one save is not counted twice. It is never stored alongside the statistic and never reaches the card's owner.
• Your choice: On iOS, you can deny app tracking when prompted, or change it any time in Settings → Privacy & Security → Tracking. On Android, you can opt out of ad personalization in Settings → Privacy → Ads. On the web, in the EEA, the UK and Switzerland nothing is shared with advertising partners until you allow it in our cookie banner. Elsewhere it is on until you switch Targeted Advertising off under “Your Privacy Choices” at the bottom of every page, and a Global Privacy Control signal from your browser always switches it off. We never sell your data.

If you join our Affiliate Program or visit Lynqu through an affiliate's referral link, we process a limited amount of additional data. This section explains what we collect, why, and how long we keep it.

• Affiliates: when you apply and are approved, we process your name, contact details, payout information, and tax forms (such as a W-9 or W-8BEN) to operate the program, pay commissions, and meet our legal and tax obligations. The legal bases are performance of our affiliate agreement (Art. 6(1)(b)) and compliance with a legal obligation (Art. 6(1)(c)). Financial and tax records are retained for the period required by applicable law.
• Referral-link visitors: when you arrive via an affiliate link we set a first-party cookie (lynqu_aff) and store pseudonymized click data (including a hashed (one-way encrypted) form of your IP and user agent) so we can credit the correct affiliate if you later subscribe. We rely on our legitimate interest in operating a referral program (Art. 6(1)(f)). This click data is automatically deleted after 60 days. You can clear your referral attribution at any time at /affiliate/forget.
• Referred users: if you sign up after following a referral link, we record that your account is associated with that referral so commissions can be calculated. We do not share your identity with the affiliate; they see only aggregated, masked figures about their referrals.

Your rights: you can request access to, correction of, or erasure of your personal data. When we honor an erasure or data-subject request, we pseudonymize the related affiliate records while preserving the minimum financial audit trail we are legally required to keep.

This section applies when your organization uses AI employees, the optional add-on seats that work a sales pipeline on an organization's behalf. If your organization has not hired one, nothing described here takes place.

• What is processed: the lead, contact and deal records your organization already holds, and the engagement our platform itself records against them. Email opens, link clicks, document views, booking responses, capture-form submissions and replies to emails sent through our Service (described under "Replies to emails sent through the Service" above). An AI employee does not read a mailbox. It may read the replies on a lead it works, as part of that lead's record; it hands a reply to a person and never answers it. It works only inside the organization that hired it, and only within the scope an administrator gave it.
• How it is processed: an AI employee's reasoning runs on a third-party language-model provider. We send each request with the provider's own storage switched off, and that provider's retention and model-training commitments are set by our agreement with them. What leaves the platform is the records the AI employee is reasoning about, and nothing else: no credentials, no billing data, and no data belonging to another organization.
• Human approval: by default a person releases every customer-facing message before it is sent. External sends always require an approval, and actions classified as critical never run unattended; neither of those two floors can be configured away. A newly hired AI employee starts in an observe-only mode in which it writes nothing at all.
• Disclosure in outbound mail: email sent by an AI employee carries a machine-readable marking that identifies it as AI-generated content, and states so in the message itself whenever the AI employee is sending without a person releasing it. This reflects the transparency obligation in Article 50 of the EU AI Act.
• Turning it off: an organization administrator can switch off language-model processing for the whole organization under Settings → AI tagging → Data governance. While that switch is on, no new AI employee can be hired and no AI employee picks up new work; runs already in progress finish so they do not leave half-written changes behind.
• Record keeping: every action an AI employee takes, and every action it was prevented from taking, is written to an activity ledger that belongs to your organization, together with the rule that applied and the AI employee's own stated reasoning. The record of what was done is retained; the arguments an action carried, which can include a contact's details, are reduced to a summary after a set period. Requests to access or erase personal data held in that ledger are handled in the same way as requests about the rest of your organization's lead data.

This section applies when a business customer on a plan that includes AI records voice notes about its contacts: on a lead's page, on a contact scanned with an organization card, or by recording a call made through Lynqu with the contact's consent. For these notes Lynqu acts as a processor on behalf of that business customer. If your organization does not use voice notes, nothing described here takes place.

• What is processed: the audio of each note and its transcript. Our AI sub-processor, OpenAI, processes them to produce a transcript, a short summary, follow-up tasks, and suggested contact details, for example a job title or a company. Suggested details are written only into fields that are empty. An email address or phone number heard in a note is shown to the business user to confirm and is not saved automatically.
• Spoken instructions: an instruction spoken in a note, for example to tag the contact, to notify a colleague, or to send a saved email or available meeting times, can be carried out automatically for the business user. Emails sent this way follow the same unsubscribe, bounce and objection rules as every other email sent by Lynqu. Recorded calls never trigger such automatic actions.
• Turning it off: an organization administrator can turn off AI processing of voice notes for the whole organization. Recordings then remain playable and are not sent for transcription.
• Objections: if a person has objected to the processing of their data, nothing derived from voice notes is recorded about them, and any pending suggestions about them are deleted.
• How long we keep it: suggestions that nobody confirmed are deleted after 30 days. The note and its transcript are kept as part of the business customer's records until the customer deletes them or the account is closed.
• What we do not do: no voice-note content is used to train AI models, and none of it is added to any shared or cross-customer data.

Two of our offers are meant once per customer: the free trial of an organization plan, and the one-time Event Pass. To make that rule real we keep a small, hashed record of each grant.

• What we record: when an organization is created, when a trial is granted, and when a plan or a one-time pass is bought, we store a one-way hashed (irreversible) copy of a few identifiers for that grant: your email address in a simplified form, the company domain of a work address, a phone number you verified for calling, and the references our payment processor gives us (a customer reference and a fingerprint of the card). We never store a card number, and a hash cannot be turned back into the value it was made from.
• Why: our legitimate interest in preventing repeat use of an offer that is meant once per customer (Art. 6(1)(f)). This record is never used for advertising, for profiling, or for any decision about you beyond whether one offer is still available.
• How it is used: to refuse a second free trial or a second Event Pass to a customer who already had one, and to flag a purchase for a person to review. Nothing else is refused on this basis, and a refusal can be appealed: contact support and we can clear it for your organization.
• How long we keep it: 24 months, then the record is deleted. It is kept even when the organization or the account is deleted, because a record that disappears with the account cannot stop the same offer being claimed again the next day. This relies on the exception for fraud and abuse prevention in Article 17(3) GDPR.
• What we do not do: no device fingerprinting, no tracking of you across other websites, no IP-address or location profiling, and nothing from this record is sold or shared with advertising partners.