Privacy Policy

The data controller is Groupshift Bilişim Teknolojileri ve Yazılım Hizmetleri Sanayi ve Ticaret Ltd. Şti., Adatepe Mah. Doğuş Cad. No: 207AG İç Kapı No: 1 Buca / İzmir. Tax office: Balçova Vergi Dairesi Müdürlüğü, tax number: 4111150488, MERSİS number: 0411115048800001.

For any question or request about your personal data, write to info@lyngl.com.

We process only the data we need to provide LyngL:

• Account data: your name and email address, which we receive from Google when you sign in with Google (with your Google account ID, never your Google password), and your interface language and preferences. For accounts we create for you, a one-way hash of the password (never the password itself).
• Workspace data: the business details you enter, the goals and messages you give the Manager, tasks, plans, files, generated content, brand settings, approvals and the activity history of your workspace.
• Connection data: API keys and access tokens you add for AI providers, GitHub, Vercel, Meta and other services. They are encrypted (AES-256-GCM) before they are stored and are never shown in full again.
• Connected apps: when you connect an app on the Integrations page (for example Gmail, Google Calendar, Notion or Slack), what an employee reads or does in it for a task you gave, for example the emails it reads to write a summary. Composio keeps the app’s access tokens; LyngL keeps which apps are connected.
• Technical data: IP address, the approximate place it points to (country, region, city), browser and device details, preferred languages, session records and service logs needed for signing in, security, support and preventing abuse.
• Enquiries: your name, email address, company, team size and message when you write to us through the form on our pricing page.
• Website chats: when you talk to Lina, the AI advisor on our website, what you write and her answers, the pages you are on, your IP address and the approximate place it points to, browser and device details, preferred languages and the page you came from, and the name, phone number, email address and company you choose to leave. Lina is an AI; the chat is recorded and authorized LyngL staff can read it.
• Billing data, when you pay: your name, email address, phone number and billing address, your Turkish identity number if you choose to give it for the invoice, and the amount, date and outcome of each payment. Your card details never reach LyngL: you enter them on the page of iyzico, the licensed payment institution, which processes them.
• Data from Instagram and Facebook: see section 3.

We collect this data electronically: through our website and app, and through the APIs of the services you connect. Account data is required to provide LyngL; everything else depends on the features you use.

When you connect Instagram and Meta Ads to a workspace, you authorise LyngL through Facebook Login. For the accounts you select, LyngL can then access:

• the Facebook Pages you manage and the Instagram professional accounts connected to them (ID, username, name and profile picture);
• the media you publish through LyngL and their insights (views, reach, likes, comments, saves and shares);
• comments on your Instagram content and mentions of your account (the commenter’s username and the text), so that LyngL can notify you and your team;
• the Meta ad accounts you manage and the campaigns, ad sets, creatives and ads LyngL creates for you, with their results (spend, impressions, clicks and conversations).

You can also connect only Instagram, on the Integrations page: you then sign in with your Instagram professional account through Composio’s Instagram app, Composio keeps the access token, and LyngL reaches the Instagram data described above through it. Removing Instagram on the Integrations page revokes that access.

We use Meta Platform Data only to provide the features you use: publishing, reporting, comment notifications and managing your ads. We do not sell it, use it for advertising, share it with data brokers or use it to build profiles of Instagram users.

Access tokens are stored encrypted and deleted when you disconnect. You can remove LyngL’s access at any time in your workspace (Settings → Instagram & Meta) or in Facebook (Settings & privacy → Settings → Apps and websites, or Business integrations). To have the data we received from Meta deleted, follow the steps on our Data Deletion page.

Meta bills advertising directly to your own ad account. LyngL never collects, holds or finances advertising money.

We process personal data for these purposes and on these legal bases:

• To create and run your account and workspaces and to carry out the work you request — necessary to conclude and perform our contract with you (KVKK art. 5/2-c; GDPR art. 6(1)(b)).
• To take payments, issue invoices and keep the records tax and commercial law require — performing our contract with you and our legal obligations (KVKK art. 5/2-c and 5/2-ç; GDPR art. 6(1)(b) and (c)).
• To keep LyngL secure — authentication, rate limiting, preventing fraud and abuse, audit logs — our legitimate interests and legal obligations (KVKK art. 5/2-ç and 5/2-f; GDPR art. 6(1)(c) and (f)).
• To meet legal obligations such as tax and commercial record keeping and requests from authorities, and to establish, exercise or defend legal claims (KVKK art. 5/2-ç and 5/2-e; GDPR art. 6(1)(c) and (f)).
• To contact you about your account, security and changes to the service — our contract with you and our legitimate interests (KVKK art. 5/2-c and 5/2-f; GDPR art. 6(1)(b) and (f)). We send marketing messages only with your explicit consent, which you can withdraw at any time (KVKK art. 5/1; GDPR art. 6(1)(a)).
• To answer the enquiries you send us, for example about Enterprise plans — steps taken at your request before a contract and our legitimate interests (KVKK art. 5/2-c and 5/2-f; GDPR art. 6(1)(b) and (f)).
• To answer your questions in the website chat and improve those answers — steps taken at your request before a contract and our legitimate interests (KVKK art. 5/2-c and 5/2-f; GDPR art. 6(1)(b) and (f)) — and to call or email you when you leave your details and agree to be contacted — your explicit consent, which you can withdraw at any time (KVKK art. 5/1; GDPR art. 6(1)(a)).

LyngL’s AI employees send the parts of your workspace that a task needs — for example your goal, business details and earlier results — to the AI model providers configured for your workspace, such as Anthropic, OpenAI or Google, and to media and web search providers when a task creates images or videos or searches the web. If you add your own API keys, these requests run under your agreement with that provider.

AI output can be wrong; review it before you rely on it. Depending on your autonomy settings, LyngL asks for your approval before risky actions. We do not use your workspace content to train AI models; providers process requests under their own terms. LyngL does not make decisions that have legal or similarly significant effects on you based solely on automated processing.

We share personal data only with service providers that help us run LyngL, and only as much as they need:

• Hosting and infrastructure providers, to host the service, its database and files: Vercel (website), Railway (application servers and database) and Cloudflare (file storage).
• iyzico Ödeme Hizmetleri A.Ş., the licensed payment institution that takes your payments, to process them.
• Email providers, to send the messages we send (Resend) and to receive yours (Google), for example when you write to us through the form on our pricing page.
• The AI, media and search providers your workspace uses, to carry out the tasks you request (see section 5).
• Services you connect yourself, such as Meta (Instagram, Facebook, Meta Ads), GitHub, Vercel or Cloudflare, to perform the operations you authorise.
• Composio, Inc. (United States), which hosts the sign-in to the apps you connect on the Integrations page, keeps their access tokens and carries out the actions your employees take in them, to perform the operations you authorise.
• Anthropic PBC (United States), whose AI model writes Lina’s answers in the website chat, to answer your messages.
• Authorities, courts and professional advisers, where the law requires it or to establish, exercise or defend our rights.

We share personal data on the legal bases in section 4 and in line with Articles 8 and 9 of KVKK. We do not sell personal data.

Some of these providers store or process data outside Türkiye, for example in the European Union or the United States. We carry out these transfers in line with Article 9 of KVKK and Chapter V of the GDPR, with the safeguards they provide for, such as standard contractual clauses.

We keep personal data only as long as the purposes above require:

• Account and workspace data: while your account exists; deleted within 30 days after you ask us to delete your account.
• Access tokens and API keys for connected services: until you disconnect the service or replace the key, or until your account is deleted. Disconnecting an app on the Integrations page also deletes its tokens at Composio and revokes them at the app.
• Security and audit records: deleted together with your workspace data, except records we must keep by law.
• Enquiries: up to two years after our last exchange, unless they lead to a contract.
• Website chats and the details left in them: up to two years after the last message, unless they lead to a contract; write to info@lyngl.com to have them deleted sooner.
• Records we must keep by law, such as invoices and commercial records: for the periods set by Turkish tax and commercial law.
• Backups: deleted data can remain in backups for a limited time until they are overwritten.

We protect data with encryption in transit (TLS), encryption of stored secrets (AES-256-GCM), strict separation between workspaces, role-based access, approvals for risky actions, rate limiting and audit logs. No system is perfectly secure: if a breach affects your data, we will inform you and the authorities as the law requires. Authorized LyngL staff may view workspace content (conversations, jobs, projects and files), read-only, for support, security, quality control and abuse prevention; such access is logged and bound by confidentiality. The details are on our Security and KVKK page.

LyngL uses only the cookies the service needs: a secure session cookie that keeps you signed in, a short-lived cookie that protects signing in with Google, and a cookie that remembers your language. Your theme choice is stored only in your browser. We do not use advertising or tracking cookies.

Under Article 11 of KVKK you have the right to learn whether we process your personal data and to request information about it; to learn why we process it and whether it is used for that purpose; to know the third parties in Türkiye or abroad it is transferred to; to have incomplete or inaccurate data corrected; to have it deleted or destroyed and the third parties it was transferred to informed; to object to a result against you that arises solely from automated analysis; and to claim compensation for damage caused by unlawful processing. Under the GDPR you may also ask us to restrict processing, to give you your data in a portable format and to stop processing based on legitimate interests, and you may withdraw your consent at any time.

Send your request to info@lyngl.com from the email address registered in your account (you may also sign it with a secure electronic or mobile signature), or in writing to Adatepe Mah. Doğuş Cad. No: 207AG İç Kapı No: 1 Buca / İzmir. Your request must include your name and surname (and your signature if it is written); for citizens of Türkiye your identity number, otherwise your nationality and your passport or identity number; an address for notifications; your email address, phone or fax number, if any; and the subject of your request, with any supporting documents.

We conclude your request free of charge within 30 days at the latest; if it requires an additional cost, we may charge the fee set by the Personal Data Protection Board. If we reject your request, our answer is insufficient or we do not answer in time, you can complain to the Personal Data Protection Board within 30 days of our answer and in any case within 60 days of your request. In the EU, you can also complain to your data protection authority.

LyngL is a service for businesses and is not meant for anyone under 18. We do not knowingly collect personal data from children.

We may update this policy when our service or the law changes. We publish the new version on this page with its date and announce significant changes by email or in the app.

Groupshift Bilişim Teknolojileri ve Yazılım Hizmetleri Sanayi ve Ticaret Ltd. Şti. Adatepe Mah. Doğuş Cad. No: 207AG İç Kapı No: 1 Buca / İzmir info@lyngl.com