Data processing agreement
For customers whose traffic through Lyntway contains personal data — which, given what this service is for, is most of them.
This applies automatically when you use the service; you do not need to sign anything. If your procurement requires a signed copy on your own paper, write to legal@lyntway.com and we will sign yours.
1. The parties and the roles
You are the controller. Lynt-X Global is the processor, at IH-00-01-03-OF-05, Level 3, Innovation Hub, Dubai International Financial Centre, Dubai, United Arab Emirates.
We process only on your documented instructions. Your configuration — which traffic you route, which mode you choose, whether you enable reversible tokenisation — is those instructions. We will tell you if an instruction appears to breach applicable data protection law rather than simply carrying it out.
2. What we process, and why
| Subject matter | Inspecting AI traffic and issuing signed records of what was found |
|---|---|
| Duration | For as long as your account exists |
| Nature | Transient inspection in memory; substitution where you enable it; recording classes and counts |
| Purpose | Detecting personal data in flight, and evidencing what happened to it |
| Categories of data | Whatever your traffic contains. Typically names, contact details, identifiers, payment details, credentials and free text |
| Categories of subject | Whoever appears in your traffic — your customers, your staff, your users |
3. What we retain, and what we do not
By default, no content is retained at all. Content is inspected in memory and released. We keep classes and counts of findings, never values, and never a digest of a value.
One exception, and it is yours to enable: if you switch on reversible tokenisation, we store a mapping between substituted values and the originals so they can be restored. That mapping is personal data, we are its processor, and it is the only thing in this service that could be turned back into your data. It is off unless you turn it on.
Receipts are returned to you. Unless you configure a destination, they are retained by nobody — we keep only their digests, which are one-way and contain no personal data.
Content processed by the browser extension or the on-device agent is processed on your device, by software we supply and you install. It does not reach us. The device reports classes, counts and decisions to your account, and the mapping behind any substitution stays on the device, encrypted under a key we never hold. For that processing you are the controller and the device is yours; we are the processor only of what the device reports.
4. Confidentiality and security
Everyone with access is bound by confidentiality obligations. The measures we take are listed in the privacy policy and form part of this agreement: encryption in transit and at rest, hashed credentials, a minimal runtime with no shell, detection models running inside our own network, and 35-day backups.
We hold no SOC 2 report and no independent penetration test. This is stated here because a processor should not leave a controller to find that out during an audit.
5. Sub-processors
You authorise these, and only these:
| Who | For | Where |
|---|---|---|
| Microsoft Azure | Hosting and storage | Germany West Central |
| Stripe | Payment processing | Per Stripe's terms |
We will give 30 days' notice before adding or replacing one, and you may object. If we cannot resolve your objection, you may terminate and we will refund the unused part of any prepaid fee.
The AI providers you route to are not our sub-processors. You chose them, you hold the relationship, and we forward to them on your instruction.
6. Transfers
Data is stored in Germany and accessed from the UAE for operating the service. There is no adequacy decision for the UAE or the DIFC, so a transfer from the EEA or the UK is a restricted transfer requiring Article 46 safeguards. We will enter into standard contractual clauses on request and assist with your transfer impact assessment.
If you would prefer no transfer at all, self-host. Nothing reaches us, and this agreement becomes unnecessary.
7. Helping you meet your obligations
- Data subject requests. If one reaches us, we will pass it to you promptly and not answer it ourselves. Given how little we hold, most requests are answerable from your own records.
- Breach notification. We will tell you without undue delay and in any event within 48 hours of becoming aware, with what we know and what we are doing about it.
- Impact assessments. We will give you the information you reasonably need. Much of it is already public in the privacy policy, deliberately.
8. Audit
You may verify our compliance once in any twelve months, on 30 days' notice, and more often if a regulator requires it or after a breach. We will answer questionnaires and provide documentation.
There is also a form of verification most processors cannot offer: the receipts themselves. They verify against a published key, offline, with no account. You do not have to take our word for what we did — and a coverage report states, in the same document, what we could not see.
9. Deletion and return
On termination we erase your account data and activity. Receipts already delivered to you are yours to keep.
Two things erasure cannot reach, stated plainly rather than buried: a receipt already delivered to you cannot be recalled by us, and a digest already written to the transparency log cannot be removed without destroying the property that makes the log meaningful. Digests are one-way and contain no personal data.
10. Law
Governed by DIFC Data Protection Law No. 5 of 2020 as amended, and by the laws of the DIFC. Where you are subject to the GDPR or UK GDPR, this agreement is intended to satisfy Article 28, and we will agree any additional terms your regulator reasonably requires.
Last updated 2 October 2026. Earlier version: 16 August 2026.