Privacy policy
Last updated 8 November 2026
This policy explains how Lynt-X Global Tech Limited (“we”) handles personal data when you visit our website or use Lyntcast. We are the controller for account, billing and website data. For content and personal data inside the CMSs you connect (“Customer Data”), we act as a processor (service provider) on behalf of our customer, under our Data processing addendum.
1. What we collect
| Data | Why | Legal basis (GDPR / UK GDPR) |
|---|---|---|
| Name, email, password hash, workspace membership and role | Create and secure your account; let teammates review | Contract |
| Audit log entries (who did what, when; agent names; reviewer notes) | Provide the audit trail you rely on; security | Contract; legitimate interests |
| Billing details (handled by Paddle; we receive plan, country and payment status, not card numbers) | Charge for paid plans; tax compliance | Contract; legal obligation |
| Technical data: IP address, user agent, request logs, error reports | Keep the Service running and secure, prevent abuse, fix bugs | Legitimate interests |
| What you enter in the contact form (name, email, company, website, CMS, number of sites, message) | Reply to you; run the design partner programme if you apply | Legitimate interests; steps before a contract |
| Emails you send us | Support | Legitimate interests; contract |
We do not use analytics or advertising trackers, we do not sell or share personal data for cross-context behavioural advertising, and we do not use Customer Data to train AI models.
2. Customer Data
When you connect a CMS, Lyntcast reads and writes content through its API, and stores proposed changes, diffs, snapshots and the encrypted CMS credentials. This content may include personal data (for example an author’s name). We process it only on our customer’s instructions to provide the Service. If you are a person whose data appears on a customer’s website, please contact that customer; we will help them respond.
3. AI processing
If a workspace uses AI policy rules, the text of a proposed change is sent to a model provider through the Vercel AI Gateway to check it against the policy. No AI processing happens without such a rule. AI agents you connect to Lyntcast are chosen and operated by you, under their providers’ terms.
4. Who we share data with
Only with service providers that help us run Lyntcast, listed on our Subprocessors page, and with integrations you turn on (such as Slack). We may disclose data if required by law, to protect rights and safety, or as part of a merger or acquisition, with notice.
5. International transfers
Our providers may process data outside your country, including in the United States. Where the DIFC Data Protection Law, GDPR, UK GDPR or UAE PDPL requires, we rely on adequacy decisions, the EU Standard Contractual Clauses, the UK International Data Transfer Addendum, or other lawful transfer mechanisms. Enterprise customers can choose a hosting region.
6. Retention
- Account data: while your account is active, then deleted within 30 days of closure.
- Audit log and change history: for the life of the workspace (unlimited history is part of every plan), then deleted within 30 days of workspace deletion.
- Sessions expire automatically; error logs are kept for 30 days.
- Billing records: as long as tax law requires.
7. Your rights
Depending on where you live, you may have the right to:
- access, correct or delete your personal data, or receive a copy in a portable format;
- object to or restrict processing based on legitimate interests;
- withdraw consent where we rely on it;
- California (CCPA/CPRA): know what we collect, delete, correct, and opt out of sale or sharing (we do neither), without discrimination for exercising these rights. You can use an authorised agent.
- DIFC (DIFC Law No. 5 of 2020): access, correct, erase, restrict or object to processing, data portability, and not to be subject to solely automated decisions with significant effects.
- UAE (PDPL): obtain information, request correction or erasure, restrict or stop processing, and object to automated decisions.
- complain to your data protection authority (for us, as a DIFC company, the DIFC Commissioner of Data Protection; in the UK, the ICO; in the EU, your local authority; elsewhere in the UAE, the UAE Data Office).
To exercise a right, email hello@lyntcast.com. We will respond within one month (45 days under CCPA) and may need to verify your identity.
8. Security
See our Security page. CMS credentials are encrypted at rest with AES-256-GCM; passwords are hashed; the audit log is tamper-evident.
9. Cookies
We use only strictly necessary cookies. See the Cookie policy.
10. Children
Lyntcast is not directed to children and we do not knowingly collect their data.
11. Changes
We will post updates here and, for material changes, notify account holders by email.
12. Contact
Lynt-X Global Tech Limited, Innovation One, Dubai International Financial Centre (DIFC), Dubai, United Arab Emirates. Privacy questions: hello@lyntcast.com. If we appoint a data protection officer or an EU or UK representative, their details will be listed here.