Privacy policy

What information Lyng stores about you, why, where it is kept and what you can do about it.

Last updated: 8 November 2026

This is a draft. The text will be reviewed by a lawyer before launch.

Company: Sheikh Ventures AS
Email: hello@lyng.ai

1. Who is responsible

Sheikh Ventures AS is the controller for information about you as a user of Lyng: your account, your projects and your payments.

If you make sites or apps that collect information about your customers, you are the controller for that, and we are the processor. There is more about this in section 10 and in the data processing agreement.

2. What we store

Account: email address, and name and profile picture if you sign in with Google. Your chosen language, plan, credits and settings.
Sign-in: sessions in a cookie. Sign-in links work for 30 minutes and are stored only as a fingerprint (hash).
Projects: what you write in the chat, the AI's replies, files, versions, the images, audio files and documents you upload, comments, and content from a website you have asked us to import.
Collaboration: the email addresses of people you invite, and who has Studio open right now.
Usage: every credit change with time, model and number of tokens.
Payment: Stripe's customer ID and subscription ID. The card number never reaches us. Receipts and invoices are kept by Stripe. If you pay with Vipps, we store the ID of the agreement and the charges, amounts and status. If you pay by invoice, we store the organisation number, company name and address from the Central Coordinating Register, KID, invoice number, amount, due date, whether the invoice was sent as EHF, and reminders.
Keys: keys you add for Expo, Apple, Google and Fiken are stored encrypted.
GitHub: your GitHub username and the key Lyng gets when you connect (encrypted), and which repository the project sends the code to.
Security: to stop abuse we count requests per IP address or email in short time windows. We store only a hash, and the rows are deleted when the window is over. Abuse reports are stored with a hash of the IP address.
Domains you buy: the owner details (name or company, org. no., address, email and phone) are stored encrypted. The national ID number for .no domains owned by private persons is sent to the domain provider and deleted by us once the domain is registered.
Email on your own domain: the addresses and aliases of the mailboxes. The email is stored by the email provider, not by us, and passwords are never stored by us.
Agency profile: name, logo, colour, website and support email, shown to your clients.
“We build it for you”: details about the business, your wishes, the files you send and your contact details (encrypted). Partner applications: name, org. no., email and a link to work.
Waiting list: your email address and language, if you joined the waiting list before launch. We only use it to tell you when we open.

We do not keep access logs with the IP addresses of people visiting Lyng or customer sites. Error messages on the server may contain an email address, and they are deleted on a rolling basis.

3. Why, and on what legal basis

To provide the service you have asked for: account, projects, AI, publishing and support (contract, GDPR Article 6(1)(b)).
To keep accounts: receipts and invoices (legal obligation, point (c)).
To keep the service safe: stop fraud, spam and attacks, and find errors (legitimate interest, point (f)).

We do not send newsletters or advertising unless you have said yes. We never sell information, and we do not use your content to train our own AI models.

4. When the AI works

When you ask the AI for something, your message, the files it needs, attachments and any imported content are sent to OpenRouter, which forwards them to the language model you have chosen (Claude from Anthropic or Gemini from Google). The reply comes back to us and is stored in the project. The providers process the data to answer the request, under their terms for API use.

The AI can keep working even if you close Studio. If nobody has the project open when it is finished, we send you an email through Resend with the project name and what you asked for.

Do not paste customer information, passwords or other sensitive data into the chat. The AI does not need it to make the site.

5. Where the data is kept

The database, files, backups and published sites are kept with DigitalOcean in Frankfurt, Germany, which is in the EU.

Some processing takes place outside the EU: AI requests (OpenRouter and the model providers), the sandboxes where the preview runs (E2B), email (Resend), parts of payments (Stripe), Google sign-in, Google reviews and “Sign in with Apple”. These transfers rely on the European Commission's standard contractual clauses (SCC), and for certified providers, the EU-US Data Privacy Framework.

6. Subprocessors

These providers process information on our behalf. They only get what they need for their task.

DigitalOcean
What they do for us
Servers, database, backups, file storage and published sites.
Which data
Everything stored in Lyng: accounts, projects, files and data from customer sites.
Where
Frankfurt, Germany (EU)
OpenRouter
What they do for us
Forwards what you ask the AI to the language model you have chosen.
Which data
Chat messages, the files the AI reads, attachments and content from an imported website. With AI customer chat: what visitors write in the chat on your site, and facts about the business from the site.
Where
USA
Anthropic, Google and the cloud providers OpenRouter uses (for example Amazon Bedrock and Google Vertex)
What they do for us
The language models (Claude and Gemini) that write the code.
Which data
The same as OpenRouter receives for each request.
Where
USA and other countries
E2B
What they do for us
Isolated sandboxes where the preview runs and sites are built.
Which data
The code and files in the project.
Where
USA
Stripe
What they do for us
Subscription payments, receipts and invoices. Card payments in customers' online shops and recurring payments for memberships go through the customer's own Stripe account.
Which data
Name, email, payment details, billing address and, if given, company number.
Where
Ireland (EU) and USA
Vipps MobilePay
What they do for us
Recurring payments for the plan and add-ons when you choose to pay with Vipps.
Which data
The agreement, amounts, charge dates and status. Vipps knows who you are from the app; we do not receive your card details.
Where
Norway, Denmark and Finland (EU/EEA)
EHF access point (PEPPOL)
What they do for us
Sends the invoice as EHF to the accounting system of businesses that pay by invoice.
Which data
Company name, organisation number, address, email address as reference, invoice lines, amounts and KID.
Where
Norway or EU/EEA
Resend
What they do for us
Sends email: sign-in links, notifications, invitations, a message when the AI is finished, and one-time codes, receipts, gift cards and newsletters to the customers of your sites.
Which data
The recipient's email address and the content of the email.
Where
USA
Sveve or Twilio
What they do for us
Sends SMS reminders and confirmations for bookings, when the owner has turned it on.
Which data
The recipient's phone number and the content of the message.
Where
Norway (Sveve) or USA (Twilio)
The browsers' push services (Google, Apple, Mozilla and Microsoft)
What they do for us
Deliver notifications to the Office on the phones of the owner and staff.
Which data
A short message without customer details, for example "New booking today at 13:30".
Where
EU and USA
Google
What they do for us
“Continue with Google” in Lyng, and on customer sites and in apps when the owner has turned it on.
Which data
Name, email address and profile picture from the Google account. For customer sites and apps we only store name and email.
Where
Ireland (EU) and USA
Google (Places API)
What they do for us
Fetches public Google reviews of the business when the owner has turned it on. We use our own key, store the response and fetch again once a day.
Which data
We send the name of the business or the place ID. We get back the reviews: rating, text, and the name and profile picture of the person who wrote them.
Where
USA and other countries
Apple
What they do for us
“Sign in with Apple” in apps, when the owner has turned it on.
Which data
We send no information about the user to Apple. We receive a fixed user ID and the email address, which may be a hidden address from Apple. We only get the name the first time the user signs in.
Where
USA
Expo (650 Industries)
What they do for us
Builds apps and submits them to the App Store and Google Play.
Which data
The app's code and the keys you have added for the app stores.
Where
USA
Only when you connect your own account.
Fiken
What they do for us
Accounting: paid orders from the online shop are sent as sales to the owner's own Fiken account.
Which data
Order lines, amounts, VAT, date and order number. Not the buyer's name or contact details.
Where
Norway
Only when you connect your own account.
GitHub
What they do for us
Code: when the owner connects the project to GitHub, the code is sent to the owner's own repository.
Which data
The files in the project and a short message for each change.
Where
USA
Only when you connect your own account.
Domain provider (not chosen yet)
What they do for us
Registers and renews domains you buy through us, and manages DNS for them.
Which data
The owner details you fill in: name or company, org. no., address, email and phone. For .no domains owned by private persons also the Norwegian national ID number, which we delete once the domain is registered. The details are passed on to the registry for the top-level domain, for example Norid for .no.
Where
EEA (to be confirmed when the provider is chosen)
Email provider (not chosen yet)
What they do for us
Mailboxes on your own domain, when you have bought the add-on.
Which data
The addresses, aliases and the email in the mailboxes. The password is only sent to the provider.
Where
EEA (to be confirmed when the provider is chosen)

When you look up a company by organisation number, we query the Norwegian Register of Business Enterprises (Brønnøysundregistrene). When you preview fonts in the Design tab, your browser loads them from jsDelivr. Vipps MobilePay is used for your plan only when you choose to pay with Vipps. In your online shop, Vipps MobilePay and Fiken are only used with your own agreement, and they are then your providers.

7. Cookies

Lyng only uses cookies that the service needs to work. No advertising and no tracking.

authjs.session-token: keeps you signed in (up to 30 days).
authjs.csrf-token and authjs.callback-url: used while you sign in.
lyng-sprak: the language you have chosen (one year).
lyng-valuta: the currency you have chosen for prices (one year).
lyng-ref: the referral code from a referral link, until the account is created (30 days).

Stripe sets its own cookies on its payment pages. The visitor statistics on published sites use no cookies and store no IP addresses.

8. How long we keep data

Account and projects: until you delete them.
Database backups: deleted automatically after up to 7 days.
Receipts and invoices at Stripe, and charges and settlements at Vipps: as long as Norwegian bookkeeping law requires, currently up to five years.
Request counting: from a few minutes to an hour.
Waiting list: until we have opened and told you, or until you ask us to delete the address.
Abuse reports: as long as we need them to follow up the case.

9. Your rights

You have the right to access, rectification, erasure, to take your data with you (data portability), to object and to ask for restricted processing. You can do most of this yourself under Account:

“Download my data” gives you a JSON file with your account, projects (without the code), the messages you have written and the AI's replies in your projects, your comments and your credit history. It never contains keys, passwords or other people's personal data. You download the code from each project in Studio.
“Delete account” cancels the subscription in Stripe, takes your sites down, removes custom domains and deletes your projects with files, images, databases, users, orders and bookings. People you have invited lose access. Comments you have written in other people's projects remain, without your name. Receipts and invoices stay with Stripe as long as bookkeeping law requires.

If you want anything else, or have questions, write to hello@lyng.ai. We reply within 30 days. You can also complain to the Norwegian Data Protection Authority (Datatilsynet) or the authority in your country.

10. Your customers

Information collected by customer sites is stored in the EU. Each project has its own database with its own access, and customer details in orders, bookings, gift cards and newsletters are encrypted. Users of your apps and sites can delete their account themselves, and their rows are deleted with it.

In Studio you can find, download and delete what Lyng has about a person in your project. Orders are anonymised instead of deleted, because bookkeeping law requires them to be kept. Gift cards and punch cards stay with their balance, but without name and email.

If we receive a request from one of your customers, we pass it on to you, because you decide over that data. We help you answer.

With the AI customer chat add-on, your site has a chat that answers visitors. What they write is sent together with facts about the business (text from the site, opening hours, prices and what you wrote in Studio) to OpenRouter and the model provider (USA) to create the answer. The providers only use it to answer. The chats are stored encrypted with us in the EU, shown to you and your staff in Kontor, and deleted automatically 90 days after the last message. If the visitor gave an email address, you find and delete the chat with the privacy tool. The chat only sends a booking or a message when the visitor presses a button.

11. Security

We encrypt traffic and sensitive information, keep projects separate and only give access to those who need it. Read more on the security page (/sikkerhet).

12. Changes and contact

If we change anything important here, we will tell you by email before it applies.

Questions about privacy: hello@lyng.ai.