Privacy
What we hold, what we do not, and how to make us stop. Written to be read rather than to be survived.
The short version. Lyntway inspects content as it passes and records what it found — classes and counts, never the values. It does not keep your prompts, your responses, or your customers' data. By default it does not keep anything that could be turned back into them. Receipts are handed to you and, unless you tell us to store them, kept by nobody.
Who we are
Lyntway is operated by Lynt-X Global, registered in the Dubai International Financial Centre:
IH-00-01-03-OF-05Level 3, Innovation Hub
Dubai International Financial Centre
Dubai, United Arab Emirates
The DIFC is a financial free zone with its own legal system. This service is governed by DIFC Data Protection Law No. 5 of 2020, as amended in 2022 and by Amendment Law No. 1 of 2025, and supervised by the DIFC Commissioner of Data Protection. The UAE federal Personal Data Protection Law does not apply inside the DIFC.
Data protection enquiries: privacy@lyntway.com. Everything else: legal@lyntway.com.
Which of us is which
For the account itself — your email address, your organisation, who is on your team — we are the controller. We decide what is needed to run the service.
For the traffic you send through Lyntway, we are a processor acting on your instructions. You decide what passes through and what happens to it. Inspecting content on your behalf is processing whether or not anything is retained, so this applies even when we keep nothing — a point we would rather state plainly than let you discover.
If you self-host, we are neither. Nothing reaches us at all.
What we hold about your account
| What | Why | How long |
|---|---|---|
| Email address | Sign-in, and telling you about your account | Until you delete the account |
| Password, hashed | Sign-in. We never see the password itself | Until you delete the account |
| Organisation and role | Deciding who on your team can do what | Until you delete the account |
| API key fingerprints | Authenticating your calls. We keep a keyed hash, never the key | Until revoked, then kept so old receipts remain explainable |
| Counts and classes of findings | The dashboard, your usage, and your evidence packs | 90 days |
| Billing details | Taking payment, when you are on a paid plan | Held by Stripe, not by us |
What we do not hold
- Your prompts and responses. They pass through and are gone. No handler logs a request or response body.
- The values we detect. A receipt records that a card number was present, never which one.
- Your provider credentials. When you send an API key for OpenAI, Anthropic or anyone else, it is read off the request, forwarded, and forgotten.
- Your receipts, unless you ask us to. By default they are returned to your application and retained by nobody. We keep their digests so a receipt you hold can be checked; a receipt nobody kept cannot be produced by us.
The one thing that is optional, and off
Tokenisation can be reversible, which requires keeping a mapping between a substituted value and the real one. That mapping is the only thing in this system that could be turned back into your data.
It is off unless you switch it on. A new account substitutes values and retains nothing. If you turn it on, you are asking us to hold that mapping, and everything in this policy about not holding your data stops being true for those values. That is your decision to make deliberately, and the console says so where you make it.
What runs on your devices
The browser extension and the on-device agent process content on the machine they are installed on. Detection, substitution and the reading of scanned documents (Tesseract, running locally) happen there. What reaches us from a device is the class and count of what was found, the decision taken, and the device's receipt — never the content and never the values.
When a value is substituted on a device, the mapping back to the real value is kept on that device, encrypted under a key that never leaves it. We do not hold it and cannot restore it. Removing the agent removes the mapping.
If you configure sealed mode, request and reply content that you choose to keep is encrypted under a key you hold. We cannot read it, which is the point of the mode and the reason it is a choice you make rather than a default.
Who else sees it
We use a small number of sub-processors, and only these:
| Who | For | Where |
|---|---|---|
| Microsoft Azure | Running the service and storing account data | Germany West Central |
| Stripe | Payment, on paid plans | Per Stripe's own terms |
We do not sell anything to anybody, and we do not use your content to train anything. The destinations you configure — OpenAI, Anthropic, your own gateway — receive whatever you send them; they are your choice and your relationship, not our sub-processors.
Where it goes
Account data is stored in Germany. Where our own operations require access from the UAE, that is a transfer out of the EEA under your law and into the DIFC under ours.
There is no European Commission adequacy decision for the UAE or the DIFC. If you are transferring personal data from the EEA or the UK, that is a restricted transfer and needs Article 46 machinery — standard contractual clauses and a transfer impact assessment. Ask us and we will put them in place. If you would rather no transfer happened at all, self-host: your infrastructure, your keys, nothing reaching us.
What you can ask for
Under DIFC Law No. 5 of 2020 you may ask for access to your data, its correction, its erasure, a portable copy, restriction of processing, or object to processing. Write to privacy@lyntway.com and we will answer within one month.
You can also delete your account yourself, which erases your account data and your activity. Note what erasure cannot reach: a receipt already delivered to you is yours and we cannot recall it, and a digest already written to the transparency log cannot be removed without destroying the property that makes the log worth having. Digests are one-way and contain no personal data.
If you think we have handled your data badly, tell us first — but you are entitled to complain to the DIFC Commissioner of Data Protection without asking us, and since the 2025 amendment you may also bring a claim in the DIFC Courts.
Keeping it safe
- Encrypted in transit and at rest.
- Passwords hashed with PBKDF2. Keys stored as keyed hashes, never in a form we could present.
- The governing service runs as a static binary with no shell and no package manager.
- Detection models run inside our own network. Your content is never sent to a third-party classifier.
- Backups are retained for 35 days.
Two things we do not yet have, said here rather than left for you to discover: no SOC 2 report and no independent penetration test.If either matters to your assessment, self-hosting removes us from the question entirely.
Cookies
One cookie, holding your sign-in session. No analytics, no advertising, no third-party trackers, and nothing to consent to because there is nothing optional to refuse.
Changes
If we change this in a way that affects you, we will tell the account holder before it takes effect rather than quietly updating a date.
Last updated 2 October 2026. Earlier version: 16 August 2026.