Privacy Policy
1. Who We Are
Lynxify.me (“we”, “us”, “our”) operates the Lynxify.me platform available at app.lynxify.me, an HR performance management tool that enables teams to run structured feedback cycles and generate AI-assisted performance summaries.
For privacy-related questions, contact us at: support@lynxify.me
2. What Data We Collect
2.1 Account & Profile Data
- Full name, work email address, and password (hashed, never stored in plain text)
- Company name and team membership
- User role within your organisation (Owner, Manager, Employee)
- Social login identity (Google or Microsoft) if you choose SSO sign-in
2.2 Feedback & Performance Data
- Feedback text submitted or drafted within feedback cycles
- Criteria ratings (1–5 scale) per feedback cycle
- AI-generated summary text produced from submitted feedback content
- Cycle status history (active, finished, archived)
2.3 Usage & Analytics Data
- Page views, feature interactions, and in-app events (e.g. feedback submitted, cycle created) collected via Amplitude Analytics
- We do not use Amplitude for advertising or sell this data to third parties
On the marketing website (lynxify.me), analytics depends on where you are:
- Visitors in Europe (the EU/EEA, the UK, and other European countries): until you accept analytics cookies, we only count page views and clicks on site buttons anonymously, together with the campaign tags and referring site of the current visit. That count stores nothing on your device, does not record your IP address, and does not link visits to each other or to a person. Full analytics (cookies, sessions, and campaign attribution) starts only after you accept.
- Visitors outside Europe: analytics cookies are on by default. You can switch them off at any time with “Reject all” or “Customize” in the cookie banner, or later from the “Cookie settings” link in the site footer, and tracking stops immediately.
- We determine your region from your browser’s time zone. If it cannot be determined, the European rules apply.
3. How We Use Your Data
| Purpose | Legal Basis |
|---|---|
| Provide and operate the platform | Contract performance |
| Authenticate your identity and manage sessions | Contract performance |
| Generate AI-assisted feedback summaries via OpenAI | Legitimate interest / contract performance |
| Send invitation and welcome emails | Contract performance |
| Analyse feature usage to improve the product | Legitimate interest |
| Website analytics, visitors in Europe | Consent. The anonymous page-view count before consent: legitimate interest (basic audience measurement with no device storage and no identifiers) |
| Website analytics, visitors outside Europe | Legitimate interest, with an opt-out |
| Signup attribution (first-visit record) | Visitors in Europe: consent. Visitors outside Europe: legitimate interest, with an opt-out |
| Advertising measurement (Google Ads) | Consent, everywhere |
| Comply with legal obligations | Legal obligation |
4. AI-Generated Summaries
When a feedback cycle owner requests an AI Summary, the aggregated feedback text for that cycle is sent to OpenAI’s API for processing. OpenAI processes this data according to its own API data usage policy. We use OpenAI’s API in a way that opts out of training data use. The resulting summary is stored in our database and is accessible only to users with management access to that cycle.
Before sending feedback content to OpenAI, all personally identifiable information is anonymised. Real names of employees, reviewers, and any other identifiable references are replaced with neutral placeholders so that no individual can be identified from the data transmitted to OpenAI. The original, non-anonymised text is never shared with third-party AI services.
5. Third-Party Services
| Service | Purpose | Data Shared |
|---|---|---|
| OpenAI | AI feedback summary generation | Anonymised feedback text (no personally identifiable information) |
| Amplitude (EU region) | Product and website analytics | In the app: user ID, name, email, role, company, events. On the marketing website: page and event data, without name or email |
| Google Ads | Advertising measurement | Ad cookies and click ID, only with marketing consent |
| Google reCAPTCHA v3 | Bot detection on registration | Page interaction signals, IP address |
| Google OAuth / Microsoft OAuth | Social sign-in | OAuth identity token (email, name) |
| Transactional email provider | Invitation and welcome emails | Recipient email address and name |
6. HRIS Integrations
Lynxify.me supports optional integrations with PeopleForce, BambooHR, HiBob, and Factorial. If your organisation activates an integration, employee data (such as names and email addresses) may be synchronised from your HRIS provider into Lynxify.me. This synchronisation is configured by your organisation’s Owner and governed by your agreement with each HRIS provider.
7. Data Retention
- Account data is retained for as long as your organisation has an active account with us.
- Feedback and cycle data is retained for the lifetime of the account and may be archived but not automatically deleted.
- Analytics events are retained in Amplitude per Amplitude’s retention policy (default: 24 months).
- Upon account termination, we will delete or anonymise personal data within 90 days, unless we are required by law to retain it longer.
8. Your Rights
If you are located in the European Economic Area (EEA), the UK, or another jurisdiction with applicable data protection laws, you have the right to:
- Access the personal data we hold about you
- Rectify inaccurate data
- Erase your personal data (“right to be forgotten”)
- Restrict or object to certain processing
- Data portability: receive your data in a structured, machine-readable format
- Withdraw consent at any time where processing is based on consent
To exercise any of these rights, contact us at support@lynxify.me. We will respond within 30 days.
You can also withdraw or change your cookie consent at any time from the “Cookie settings” link in the footer of lynxify.me.
9. Cookies
In the app (app.lynxify.me):
| Cookie | Purpose | Type |
|---|---|---|
Session cookie (sessionid) | Maintains your login session | Essential |
CSRF token (csrftoken) | Protects forms against cross-site request forgery | Essential |
| Amplitude device ID | Analytics user identification | Analytics |
On the marketing website (lynxify.me):
| Name | Purpose | Type | Lifetime |
|---|---|---|---|
lynxify_consent (cookie + local storage) | Remembers your cookie choice | Essential | 6 months |
lynx_first_touch (cookie + local storage) | Records how you first arrived (campaign tags, referrer, Google Ads click ID, landing page) so signups can be attributed in the app. The Google Ads click ID is included only if you accept marketing cookies, or, outside Europe, until you opt out. | Analytics (Europe: only after consent) | 12 months |
AMP_a2d19edecc, AMP_MKTG_a2d19edecc | Amplitude device ID, session and campaign attribution | Analytics (Europe: only after consent) | 12 months |
AMP_PAGE_VIEW, AMP_URL_INFO (session storage) | Amplitude page-view tracking | Analytics (Europe: only after consent) | Browser session |
Google Ads cookies (e.g. _gcl_au) | Ad conversion measurement | Marketing (only after consent) | Up to 90 days |
In Europe, the first-visit record is saved only after you accept analytics cookies, and it describes the page where you accepted. Outside Europe, it is saved by default and not saved once you opt out.
You can change or withdraw your cookie choices at any time from the “Cookie settings” link in the footer of lynxify.me. Disabling session cookies will prevent you from logging in.
10. Changes to This Policy
We may update this policy from time to time. When we do, we will update the “Last updated” date at the top of this page. Material changes will be communicated to account Owners via email.
11. Contact
For any questions about this Privacy Policy or how we handle your data:
Email: support@lynxify.me