Privacy Notice

Lynna is a product of Lynna Labs Ltd, a company registered in England and Wales (company number 17168299), whose registered office is at 71-75 Shelton Street, Covent Garden, London WC2H 9JQ, United Kingdom ("we", "us", "our"). We are registered with the Information Commissioner's Office (ICO) under reference ZC270880.

Lynna is an AI assistant that UK businesses add to their website and hosted page to answer visitors' questions from the business's own information.

• Businesses that use Lynna: We are the controller of account, workspace and billing data: the people who sign up, their team members and the business's subscription.
• Visitors who chat with an assistant: The business whose assistant you used is the controller of your conversation and any contact details you leave. We process that data on the business's behalf under our Data Processing Agreement. If you are a visitor, please contact that business about your data; we will help them respond.

We collect only what we need to run the service:

• Account data: Name, email address, password (stored only as a secure hash) or Google sign-in, workspace memberships and roles, and when you accepted our terms.
• Workspace data: Business details, assistant settings, and the knowledge you add: website pages, uploaded documents, notes and saved answers, and the searchable sections we create from them.
• Visitor conversations: Messages exchanged with the assistant, the page the visitor was viewing, a random visitor ID, and any rating of an answer.
• Questions: The visitor's question and, only if they choose to leave them and agree to be contacted, their name, email address and phone number, plus the team's answer.
• Billing data: Plan, subscription status and invoices. Card details go directly to Stripe and never reach our servers.
• Technical data: Activity logs, error reports, and a one-way hash of IP addresses used briefly for rate limiting. We do not store raw IP addresses.

• To provide the service (contract): Running your account and workspace, answering visitors from your knowledge, routing unanswered questions to your team, sending answers, alerts and weekly summaries by email, and keeping knowledge up to date.
• To bill you (contract and legal obligation): Taking payment and keeping the accounting and VAT records the law requires.
• To keep the service safe (legitimate interests): Preventing abuse, rate limiting, security logging, fixing errors and giving support.
• Service messages (contract): Emails needed to use the service, such as sign-in links and alerts. We do not send marketing email without your permission.

We do not sell personal data or use it for advertising. Neither we nor our AI providers use your data or your visitors' messages to train AI models.

Your account, knowledge, conversations and uploaded files are stored in the UK, in London (AWS eu-west-2): the database on Neon and uploaded files on Amazon Web Services. The application runs in Vercel's London region. Email is sent through Resend from its EU (Ireland) region.

Answers are generated by OpenAI models through Vercel AI Gateway, with inference in the European Union and zero data retention, so the model provider does not keep prompts or answers after each request. The UK recognises the EEA as providing adequate protection. Transfers to the United States (for example to Stripe, Sentry and Resend) are covered by the UK-US data bridge or the UK International Data Transfer Addendum to the standard contractual clauses.

We use a small number of providers (for hosting, storage, email, payments, error monitoring and AI) under data processing agreements, and each receives only the data it needs. We give businesses at least 30 days' notice before adding or replacing one that handles visitor data.

See the list of sub-processors

• Conversations: 90 days by default. Each business can choose between 30 days and one year.
• Questions: While open, then for one year after they are answered or dismissed.
• Knowledge: Until the business removes it. Removing a source deletes its file and searchable sections straight away.
• Logs: Activity logs 90 days; operational incident records 180 days; rate-limit records 2 days.
• Sessions and sign-in links: Deleted when they expire.
• Account and workspace data: Until the account or workspace is deleted, which removes it straight away, apart from billing records we must keep for tax purposes (normally six years).

The dashboard uses one strictly necessary cookie to keep you signed in. The website widget and hosted pages use no cookies. We do not use analytics, advertising or tracking cookies.

Read how we use cookies and browser storage

Under UK data protection law you can ask to access, correct or delete your personal data, to restrict or object to its use, and to receive a copy in a portable format.

Signed-in users can download their personal data and delete their account from Account settings. Workspace owners can export conversations, erase a visitor's data by email address and delete their workspace from Settings. Visitors should contact the business they chatted with. For anything else, email hello@lynnalabs.com; we respond within one month.

Every conversation tells visitors they are talking to an AI assistant. The assistant answers only from the business's own information, shows its sources, does not give legal or financial advice, and passes anything it cannot answer to a person. It makes no automated decisions that have legal or similarly significant effects on anyone.

Data is encrypted in transit and at rest. Every business's data is kept separate from every other's, production systems use short-lived credentials rather than stored keys, and the widget can only be embedded on websites the business has allowed.

If a personal data breach affects data we control, we will notify the ICO within 72 hours where required. If it affects visitor data we process for a business, we will tell that business without undue delay so it can meet its own obligations.

Lynna is a business service and is not directed at children. Accounts are for adults acting for a business.

We will update this notice when the service or our providers change, and tell businesses by email about material changes. The date at the top shows the latest version.

Email hello@lynnalabs.com with any data protection question or complaint, or write to Lynna Labs Ltd, 71-75 Shelton Street, Covent Garden, London WC2H 9JQ, United Kingdom. If you are unhappy with our response, you can complain to the Information Commissioner's Office at ico.org.uk or on 0303 123 1113.