Legal
Privacy Policy
This policy explains what personal information Lynx AI Labs collects through this website, why we collect it, who sees it, how long we keep it, and what rights you have. It is written in plain English.
1. Who we are
Lynx AI Labs ("we", "us") is a team of developers based in Israel and South Africa that builds AI agents, data infrastructure, integrations and dashboards for businesses. This website is lynxailab.com. We decide how and why the personal information described here is used, which makes us the "controller" under the GDPR and the "responsible party" under South Africa's POPIA.
To contact us about privacy, use the contact form and choose "A privacy request". We treat every such message as a formal request.
2. What we collect and why
| What | Why | Legal basis | How long |
|---|---|---|---|
| Contact form. Your name, email, company (optional), what you are interested in (optional) and your message. | To read and reply to you, and to scope any work you ask about. | Our legitimate interest in answering enquiries, and steps you ask us to take before a contract. | Up to 24 months after our last contact, unless we work together (section 6). |
| Security check and spam protection. Your IP address and browser signals, processed by Cloudflare Turnstile and a rate limiter when you send the form. | To keep bots and abuse out and to stop repeated sends. | Our legitimate interest in security. | Processed as you send the form. We do not store it ourselves. |
| Visit data. Pages viewed, device and browser type, approximate country and page-load performance, collected by Cloudflare Web Analytics, plus standard server logs kept by Cloudflare. | To keep the site running and secure, and to see which pages are useful. | Our legitimate interest in running and improving the site. | Cloudflare keeps detailed analytics for about 7 days and summarised figures after that. Server logs are short-lived. |
| Fonts. Your browser fetches typefaces from Google Fonts, so Google sees your IP address and browser type. | To display the site as designed. | Our legitimate interest in a readable site. | Governed by Google's own policy. |
We do not collect your information from anywhere else. We do not ask for anything we do not need, and we ask you not to put sensitive information (for example health, financial account or government ID details) in the contact form.
3. Cookies
We do not set cookies for tracking, advertising or analytics, so there is no cookie banner to dismiss. Our providers (Cloudflare, for hosting and for the security check) may use cookies or similar technologies that are strictly necessary for security and for telling people from bots. Because we do not track you, there is nothing to opt out of, and we treat a browser's Global Privacy Control signal as a valid opt-out request regardless. We do not respond to the older Do Not Track header.
4. Who we share information with
We do not sell personal information, and we do not share it for advertising. We share it only with these groups, and only as needed:
| Who | What for | Where |
|---|---|---|
| Cloudflare | Hosting, DNS and content delivery, the security check, rate limiting, website analytics, and sending the email that delivers your enquiry to us | United States and its global network |
| Google (Google Fonts) | Serving typefaces to your browser | United States and its global network |
| Our email provider | Receiving and storing your enquiry | Where the provider operates |
| Our team | Developers in Israel and South Africa who read enquiries and reply | Israel, South Africa |
| Advisers and authorities | Legal, accounting and security advice, or where the law requires it | As needed |
5. Artificial intelligence
We do not use what you send through the contact form to train AI models, and we do not make decisions about you based solely on automated processing. If we use an AI assistant to help read or draft a reply, a person decides what is sent. The examples on this site that show an AI agent at work are illustrations, not real customer data.
6. How long we keep it
- Enquiries that do not lead to work: up to 24 months after our last contact, then deleted.
- If we work together: we keep what we need for the engagement and for as long as accounting, tax and legal duties require. The written agreement for that work covers client data in more detail.
- Backups are removed in the normal cycle after the original is deleted.
- Provider logs and analytics follow each provider's own retention, described in section 2.
7. Where your information goes
We work from Israel and South Africa, and our providers operate in the United States and across a global network, so your information can be processed in several countries. Where the law requires safeguards for transfers, we rely on adequacy decisions (for example the European Commission's decision for Israel), standard contractual clauses in our providers' terms, or the conditions in section 72 of POPIA.
8. Security
The site is served over HTTPS. Access to enquiries is limited to our team, and the credentials our systems use are stored as encrypted secrets rather than in our code. No system is perfectly secure, so we cannot promise absolute security. If a breach affects your information, we will tell you and the relevant authority as the law requires.
9. Your rights
Your rights depend on where you live. We recognise all of them for people anywhere, as far as the law and practicality allow.
| Where you live | Your rights | We reply within |
|---|---|---|
| EU, EEA, UK, Switzerland | Access; correction; erasure; restriction; portability; objection, including to direct marketing at any time; withdraw consent; not to be subject to solely automated decisions with significant effects; complain to a supervisory authority | 1 month, extendable by up to 2 more months for complex requests (we tell you) |
| California | Know and access; delete; correct; opt out of sale and sharing (we do neither); limit use of sensitive information (we do not use it); no retaliation | Confirm within 10 business days; answer within 45 days, extendable once by 45 days |
| Other US states with privacy laws | Access; correct; delete; portability; opt out of targeted advertising, sale and profiling (we do none); appeal a refusal | 45 days, extendable once by 45 days |
| South Africa | Be told what we hold and who has it; correct or delete; object to processing; object to direct marketing; withdraw consent; complain to the Information Regulator; request access to records under PAIA | A reasonable time; formal PAIA requests within 30 days |
| Israel | Inspect, correct or delete your data; object to direct marketing | Generally 30 days |
| Elsewhere | Access, correction, deletion and objection as far as local law gives them | 30 days |
10. How to make a request
- Use the contact form, choose "A privacy request", and say which right you are using and which country or state you live in.
- Verification. We confirm it is you by replying to the email address you gave, and we may ask for a little more if needed. We will not ask for more than necessary or use it for anything else.
- Agents. You may use an authorised agent. We will ask for your written permission and may confirm with you directly.
- Cost. Nothing for ordinary requests. We may decline or charge for requests that are manifestly unfounded or excessive, as the law allows.
- Refusals and appeals. If we refuse, we say why. Reply with the word "appeal" and we will respond within the period your law sets and tell you how to contact your regulator.
- No retaliation. We do not treat you worse for using your rights.
11. Notes for specific regions
California. In the past 12 months we have not sold or shared personal information. We disclosed identifiers, contact information and internet activity to the providers in section 4 for the business purposes in section 2. We offer no financial incentives for personal information.
EU and UK. Our legal bases are in section 2. Where we rely on legitimate interests, they are answering enquiries, keeping the site secure and running it well, and we balance them against your rights, so you may object. You may complain to your supervisory authority, for example the Information Commissioner's Office in the UK or the authority in the EU country where you live or work.
South Africa. We process information lawfully for the purposes stated, collect only what we need, keep it only as long as section 6 says, keep it accurate, and secure it as POPIA sections 19 to 22 require. You may complain to us first, and then to the Information Regulator (South Africa), JD House, 27 Stiemens Street, Braamfontein, Johannesburg, 2001; enquiries@inforegulator.org.za; complaints.IR@inforegulator.org.za.
Israel. You may inspect and correct your information and ask to be removed from direct-marketing lists under the Privacy Protection Law. You may also contact the Privacy Protection Authority.
12. Children
This website is for businesses and is not for anyone under 18. We do not knowingly collect information from children. If you believe a child has sent us personal information, tell us through the contact form and we will delete it.
13. Marketing
We only email you in reply to your enquiry. We do not send a newsletter or marketing messages today. If that changes, we will ask for your consent first and include an unsubscribe link in every message.
14. Changes
We will update the date at the top of this page when we change this policy. If a change is material and we hold your email address because you contacted us, we will tell you before it applies.
15. Contact
Lynx AI Labs. Use the contact form and choose "A privacy request". See also our Terms of Use.