Security and Data Protection (KVKK)

• We use your workspace content only to do the work you ask for. We do not sell it and we do not use it to train AI models.
• Your data is stored outside Türkiye: our application servers and database in the United States (Railway, US West region), files and encrypted backups in Europe (Cloudflare R2, Eastern Europe region). Section 3 lists every provider.
• Risky actions such as publishing, launching ads, increasing budgets and production deploys wait for your approval, and every task, tool call and approval is recorded.
• API keys and access tokens are encrypted with AES-256-GCM, and every connection to LyngL is encrypted (TLS).
• When your content contains other people’s personal data, we act as your data processor under our Data Processing Agreement, which forms part of the Terms of Service.
• We do not yet hold an independent certification such as ISO 27001 or SOC 2. We say so plainly and answer security questionnaires in writing.

For your own account data, such as your name, email address, sign-in and billing details, Groupshift Bilişim Teknolojileri ve Yazılım Hizmetleri Sanayi ve Ticaret Ltd. Şti. is the data controller. Our Privacy Policy explains how we process it.

For the personal data your business puts into LyngL, for example your customers’ names in a campaign, candidates’ CVs or the emails an AI employee reads for you, your business is the data controller and Groupshift Bilişim Teknolojileri ve Yazılım Hizmetleri Sanayi ve Ticaret Ltd. Şti. is the data processor. We process that data only to provide the service, on your instructions, under our Data Processing Agreement.

LyngL runs on the following providers (sub-processors). Each receives only what its role needs:

• Railway (United States, US West region): application servers, database and job queue, which hold all workspace data.
• Cloudflare (R2 storage, Eastern Europe region): files you upload, generated images and videos, and the encrypted nightly database backups.
• Vercel (United States and its global network): the website; requests to the app pass through it to our servers.
• Anthropic (United States): the AI models that plan and carry out tasks; they receive the parts of your workspace a task needs.
• fal.ai (United States): image and video generation; it receives the instructions and reference images of media tasks.
• Tavily (United States): web search when a task researches the web; it receives the search queries.
• Composio (United States): sign-in and actions for the apps you connect on the Integrations page, such as Gmail or Instagram; it keeps their access tokens.
• Resend (servers in the European Union): sending the emails LyngL sends you.
• Google: signing in with Google, and receiving the emails you send us.
• iyzico Ödeme Hizmetleri A.Ş. (Türkiye): taking payments; your card details reach only iyzico.

Services you connect yourself, such as Meta (Instagram, Facebook, Meta Ads), GitHub, Vercel or your own AI provider keys on Enterprise, receive data only for the actions you authorise, under your own agreement with them.

We announce a new sub-processor on this page at least 15 days before it starts processing customer personal data. Under our Data Processing Agreement you can object to it.

Because these providers are outside Türkiye, using LyngL involves transferring personal data abroad. We carry out these transfers in line with Article 9 of KVKK and, where it applies, Chapter V of the GDPR.

We cannot offer storage in Türkiye today. If your business requires it, or needs a particular transfer arrangement, write to info@lyngl.com and we will tell you what we can do on an Enterprise plan.

• AI employees send a model only the parts of your workspace a task needs, such as your goal, business details and earlier results.
• We do not use your content to train AI models. Under Anthropic’s commercial terms, the data we send through its API is not used to train its models; other providers process requests under their own terms.
• AI output can be wrong. Depending on your autonomy settings, LyngL stops and asks before risky actions; by default publishing, ad launches, budget increases and production deploys wait for your approval.
• On Enterprise you can use your own Anthropic, OpenAI or Gemini keys; those requests then run under your agreement with that provider.

• Encryption: TLS for every connection; API keys and access tokens encrypted with AES-256-GCM; passwords stored only as one-way hashes; database backups encrypted with AES-256-GCM before they are stored; files encrypted at rest by the storage provider.
• Separation: every query is scoped to its workspace, so data does not cross between workspaces.
• Access: sign-in with Google, so there is no LyngL password to steal, or a hashed password for accounts we create; secure session cookies; roles inside workspaces.
• Control: approvals for risky actions, hard ceilings on ad budgets and an emergency stop that pauses all automation with one click.
• Audit trail: every task, tool call, hand-off and approval is recorded with who did it and when.
• Staff access: only authorised LyngL staff can view workspace content, read-only, for support, security and quality control, and every such access is logged.
• Backups: the database is backed up every night, encrypted, and the copies are kept for 14 days (daily), 60 days (weekly) and 400 days (monthly); we test restoring them.
• Abuse protection: rate limits on sign-in and on the API.

• Workspace data is kept while your account exists. You can download project files as a ZIP at any time.
• When you delete a workspace or your account, we delete its data within 30 days and remove its files from storage. Invoices and payment records are kept for the periods tax and commercial law require.
• Deleted data can remain in encrypted backups until they expire, at most 400 days later.
• Disconnecting an app deletes its access tokens and revokes the access.

If a personal data breach affects your data, we tell you without undue delay and at the latest within 72 hours of becoming aware of it, with what we know and what we are doing about it. Where we are the data controller, we also notify the Personal Data Protection Board as KVKK requires.

To report a vulnerability or a security concern, write to info@lyngl.com.

LyngL is a young company and does not yet hold ISO 27001 or SOC 2 certification. Our main infrastructure providers publish their own security certifications on their websites. We answer security questionnaires, and Enterprise customers can carry out reasonable reviews under our Data Processing Agreement.

Our Data Processing Agreement sets out how we process personal data on your behalf. It forms part of the Terms of Service, so it applies to every customer without a separate signature. You can read it online or download it: Data Processing Agreement (PDF). If your business needs a signed copy, write to info@lyngl.com.