Data processing agreement

The controller is the business or person that uses Lyng to make and run sites or apps (“the customer”). The processor is Sheikh Ventures AS (“we”).

This agreement is part of the terms of service and applies automatically when the customer uses features that process personal data about the customer's own users. If you would like a signed copy, write to hello@lyng.ai.

We process the personal data only to provide Lyng to the customer: to store, show and pass it on as the features the customer has turned on require. The agreement lasts as long as we process personal data for the customer.

The data subjects are visitors, customers, members, subscribers and users of the customer's sites and apps, others who fill in forms there, and people who have written a public Google review of the customer.

• Contact details: name, email, phone and address.
• Sign-in: email address, and name when signing in with Google or Apple. Apple only gives the name the first time, and the email may be a hidden address from Apple. One-time codes are stored as a hash.
• Orders: products, amounts, delivery address and payment status. Card numbers never reach us.
• Bookings: service, time and contact details.
• Gift cards and punch cards: the code, the balance or punches left, when the card expires, and the name and email of the buyer and the recipient with the greeting. The code and the recipient are stored encrypted.
• Memberships: plan, status (for example active or cancelled) and when the period ends. The payment is in the customer's own Stripe account.
• Newsletters: the subscribers' email and name (encrypted), when they signed up and confirmed, and which newsletters have been sent. We do not track opens or clicks.
• Google reviews: public reviews of the customer's business, with the name and profile picture of the person who wrote them.
• Files: images, audio files and documents the customer uploads.
• Forms and tables: whatever the customer decides the site should collect.
• Statistics: page views without cookies and without stored IP addresses.

The service is not made for special categories of personal data (Article 9) or national identity numbers. The customer must not collect such data with Lyng without first agreeing it with us.

• We process the data only on the customer's instructions. The instructions are the settings the customer chooses in Studio and the use of the features. If we believe an instruction is unlawful, we will say so.
• Everyone at our end with access to the data is bound by confidentiality.
• We have security measures under Article 32: encrypted traffic (HTTPS), customer details in orders, bookings, gift cards and newsletters encrypted with AES-256-GCM, a separate database and database user per project, access only for those who need it, and encrypted backups.
• We help the customer respond to requests from data subjects, and with data protection impact assessments when needed.
• In Studio the customer can find, download and delete everything Lyng has about a person in the project (access, data portability and erasure). Orders are anonymised instead of deleted, because bookkeeping law requires them to be kept. Gift cards and punch cards stay with their balance, without name and email, because the business still owes the value. Every action is logged without the email address in plain text.
• If we discover a personal data breach, we notify the customer without undue delay and at the latest within 48 hours.
• We give the customer the information needed to show that the agreement is followed, and allow audits with reasonable notice.

The customer gives us general authorisation to use subprocessors. These process information about the customer's users:

• DigitalOcean (Frankfurt, EU): servers, database, file storage and backups.
• Resend (USA): email to the customer's users, such as one-time codes, order confirmations, booking confirmations, gift cards and newsletters.
• Sveve (Norway) or Twilio (USA): SMS to the customer's users, only when the customer has turned on SMS for bookings.
• The browsers' push services (EU and USA): short notifications to the customer's staff, with no details about the users.
• Google (EU and USA): only when the customer has turned on “Continue with Google” on the site or in the app.
• Google (USA and other countries): fetches public reviews of the customer's business with our own key, only when the customer has turned on Google reviews. The response is stored by us.
• Apple (USA): only when the customer has turned on “Sign in with Apple” in an app. We send no information about the users to Apple.
• OpenRouter and the model providers (USA): when the customer has turned on the AI customer chat, what visitors write in the chat on the site and facts about the customer's business, to create the answer. The chats are stored with us in the EU and deleted after 90 days. Otherwise only if the customer adds information about users to the chat with the AI.
• Email provider (EEA, not chosen yet): only when the customer has email on their own domain. Email to and from the customer's customers is stored in the mailboxes there.

Payments, including for memberships, go through the customer's own agreement with Stripe or Vipps MobilePay. Accounting goes to the customer's own Fiken account, with a key the customer gives us and that we store encrypted. To Fiken we send order lines, amounts and date, not names or contact details. These are the customer's own providers. We place the same requirements on subprocessors as this agreement places on us. We notify the customer at least 30 days before we replace or add a subprocessor, and the customer can object and end the agreement.

The data is stored in the EU. Any transfer outside the EEA relies on the European Commission's standard contractual clauses (SCC), or goes to providers certified under the EU-US Data Privacy Framework.

• Have a legal basis for the processing and inform their users, for example with a privacy policy on the site.
• Only collect what is needed, and keep tables with personal data closed for reading from the site.
• Have consent from everyone who receives newsletters, and not import addresses unless each person has said yes.
• Respond to requests from their own users, with our help when needed.

When the customer deletes a project or the account, the data is deleted from production straight away, and from backups within 7 days. The customer can see the data in Studio and Kontor and should keep what they need before deleting.

Liability is governed by the terms of service and GDPR Article 82. In case of conflict, this agreement takes precedence over the terms where personal data is concerned.

Contact about privacy and data processing: hello@lyng.ai.