Privacy Policy

This privacy policy describes how Lynxio collects, uses, and protects your personal data when using our open-source intelligence (OSINT) platform.

Identification Data

• Email address (required for account creation)
• Username

Usage Data

• OSINT search history
• Types of analyses requested (email, domain, phone, etc.)
• Application usage frequency
• Preferences and settings

Payment Data

• Billing information (via secure third-party processors)
• Subscription and payment history
• Subscription status (lite, standard, premium)

Technical Data

• Device type and operating system
• Application version
• IP address (for security)
• Error and performance logs

Service Operation — Provide OSINT analyses, manage your account, process your queries. Legal basis: Contract execution

Payment Management — Process subscriptions, issue invoices, manage billing. Legal basis: Contract execution

Security — Prevent fraud, detect abuse, ensure platform security. Legal basis: Legitimate interest

Service Improvement — Analyze usage, fix bugs, develop new features. Legal basis: Legitimate interest

We share your data only with:

• Payment processors: RevenueCat, Apple Pay, Google Pay
• Infrastructure: Hetzner Online GmbH, Helsinki, Finland (EU) — ISO 27001:2022 certified
• Object storage: Cloudflare R2, European jurisdiction
• Email service: Brevo (Sendinblue SAS), Paris, France
• Authorities: Only if required by law

We never sell your data to data brokers, advertisers, social networks, or marketing companies.

• Account data: While active + up to 30 days after deletion (backups purged within 30 days)
• Search history: According to your subscription (5 to 100 saved searches)
• Payment data: 10 years (legal obligations)
• Technical logs: 6 months maximum
• Server logs: 6 months maximum (retained for security and abuse prevention only)

• AES-256 encryption of sensitive data
• Mandatory HTTPS/TLS connections
• Brute-force protection and rate limiting
• Firewall and DDoS protection
• 24/7 security monitoring

• Right to Access: Request a copy of all your personal data
• Right to Rectification: Correct or update your information
• Right to Erasure: Delete your personal data — you can do this directly from the account deletion page
• Right to Portability: Export your data in a readable format
• Right to Object: Object to data processing
• Right to Restriction: Limit data usage

Response time: 30 days maximum. Contact: support@lynxio.io

Lynxio is intended for users aged 18 and over. We do not knowingly collect personal data from individuals under 18. If we discover that a user is under 18, we will immediately terminate their account and delete their data.

When you use Lynxio to search for information about a third party (a person other than yourself), we process publicly available data about that individual. The legal basis for this processing is our legitimate interest (Article 6(1)(f) GDPR) in providing security research and investigation tools.

We implement the following safeguards:

• (a) all sensitive data is masked before display (passwords, full emails, etc.)
• (b) raw breach data is never stored after your session
• (c) we process only publicly available information and breach-exposure indicators from third-party intelligence services, which are always partially masked before display

Third parties whose data appears in search results may contact us at support@lynxio.io to request information about processing or to exercise their rights.

You have the right to lodge a complaint with the supervisory authority in your country of residence. In France, this is the Commission Nationale de l'Informatique et des Libertés (CNIL):

• Website: cnil.fr
• Address: 3 Place de Fontenoy, TSA 80715, 75334 PARIS CEDEX 07
• Tel: +33 1 53 73 22 22

Some of our service providers may process data outside the European Union. When this occurs, we ensure appropriate safeguards are in place: Standard Contractual Clauses (SCC) approved by the European Commission, or adequacy decisions.

Our current data processors and their locations:

• Hetzner Online GmbH (Helsinki, Finland, EU) — server hosting
• Cloudflare R2 (European jurisdiction) — object storage
• Brevo / Sendinblue SAS (France, EU) — transactional emails
• RevenueCat Inc. (USA) — subscription management — Standard Contractual Clauses apply
• Apple Inc. (USA) — App Store / Apple Pay — Standard Contractual Clauses apply
• Google LLC (USA) — Google Play / Google Pay — Standard Contractual Clauses apply

Lynxio uses artificial intelligence to generate search summaries. AI processing is performed by third-party providers, some of which may be located outside the EU. Appropriate safeguards are applied where required. Search queries and OSINT results may be sent to these services to generate analytical summaries. We do not use your data to train AI models.

Phone Search: Lynxio does not retrieve profile photos from messaging applications. Phone search results are limited to carrier, line type, country, and other publicly available information.

Image OSINT Module: When you use the Image OSINT module, you may upload images for analysis. We process uploaded images to extract metadata (EXIF), perform AI-based geolocation and scene analysis, and run reverse image searches across public sources. Uploaded images are processed temporarily for the duration of your session and are not retained after your search completes, unless required for your saved search history (according to your subscription plan). Image analysis may involve third-party AI providers subject to the safeguards described in the "Artificial Intelligence Processing" section above.

When searching for breach exposure, Lynxio queries third-party breach intelligence databases. Sensitive data returned (passwords, full email addresses, financial data) is masked before being displayed and is never stored in our systems. We retain only the name of the breach source (e.g., "LinkedIn 2021") and the count of records found, for your search history.

Lynxio uses the following storage mechanisms for essential functionality:

• (a) Authentication tokens: stored in your browser's local storage for session management and security — no consent required
• (b) Device identifier: a pseudonymous device fingerprint stored in both a browser cookie and local storage to prevent abuse — no consent required

We do not use advertising, tracking, analytics, or third-party marketing cookies.

Search queries and their targets (the identifiers you searched for) are automatically deleted from our systems after 90 days. You may request earlier deletion at any time by contacting support@lynxio.io or using the account deletion feature.

We use the following sub-processors to operate Lynxio:

• Hetzner Online GmbH (Helsinki, Finland, EU) — server hosting — DPA signed
• Cloudflare Inc. (EU jurisdiction) — object storage — DPA signed
• Brevo / Sendinblue SAS (France) — transactional emails — DPA signed
• RevenueCat Inc. (USA) — subscription management — SCC applied
• Apple Inc. (USA) — App Store / Apple Pay — SCC applied
• Google LLC (USA) — Google Play / Google Pay — SCC applied

In the event of a personal data breach likely to result in a risk to your rights and freedoms, we will notify the CNIL within 72 hours of becoming aware of it (Article 33 GDPR). If the breach is likely to result in a high risk, we will also notify you directly without undue delay (Article 34 GDPR).

We do not sell, rent, or share your personal information with third parties for commercial purposes. California residents have the right to request disclosure of any sale of personal information — our answer is: we do not sell personal information.

Just4Work, as the data controller, is established in France (EU) and acts as its own EU representative. For UK residents: Lynxio processes UK personal data in compliance with the UK GDPR and the Data Protection Act 2018. Complaints may be lodged with the Information Commissioner's Office (ico.org.uk).

Email: support@lynxio.io

Website: https://lynxio.io