Privacy Policy

1. Controller

The controller of your data is NAKO AGENCY SRL, registration number 1020600005334, str. Mălina Mică 14, Chișinău, Republic of Moldova — the company behind Lyra. For any question about personal data, or to exercise the rights below, write to us at contact@nakoagency.com.

1-bis. Who answers for what

There are two kinds of data, with different roles. Your account and business data — email, organisation, team, sessions — we process as controller: we decide what we need in order to deliver the service, and you hold us to account for it. Your customers' data that reaches Lyra — the conversations they have with you, their contact details — is different: there you are the controller, and we process it as a processor, only on your instructions and only to make work what you asked for. In practice: if one of your customers asks for their data to be deleted or corrected, you decide and we carry it out. If a customer does not know who to ask, point them to you; if they write to us, we send them to you and let you know.

2. What we process

Account: email address and password (stored only as a hash). Business: organisation name, identifier (slug), your role in the team. Security: active sessions (browser and operating system, last activity), audit log (sign-ins, sign-outs, session revocations, invitations, suspensions), connection country code, 2FA factor and recovery codes (stored as hashes). Invitations: invited person's email and proposed role.

3. What we process from conversations, and what we do not

The AI agent reads the conversations with your customers in order to answer on your behalf — that is the service itself. We process them as a processor, on your instructions. To generate the reply, the text of the conversation reaches the language-model provider we name in section 5-bis. Beyond that it goes nowhere: we do not use conversation content to train any model, we do not send it to other third parties, and we do not use it for our own purposes. What we do not process: card data — payments are not active. We keep the IP address only in security logs: in the audit log, for 12 months, and in the authentication system's log (section 5). Otherwise we keep only the country code and a cryptographic fingerprint of the browser.

If you are the customer writing to the business: when the agent does not know the answer, your question may be passed on to the business (the owner or their team) so that they can answer you; the business decides how your data is used and is not a third party with respect to it. Apart from the language-model provider (section 5-bis) and the business you are writing to, the content of conversations goes nowhere: we do not use it to train any model, we do not send it to other third parties, and we do not use it for our own purposes.

4. Why we process it (legal bases)

Performance of a contract (Art. 6(1)(b)): account creation, authentication, running the app. Legitimate interest (Art. 6(1)(f)): platform security, abuse prevention, audit logging, fixing errors, keeping proof of your acceptance of the Terms and Conditions for defence in case of a dispute. Legal obligation (Art. 6(1)(c)): records required by law. Consent (Art. 6(1)(a)): only where we ask for it explicitly.

5. Who else has access

Providers that help us deliver the service, each under a data processing agreement: Hetzner Online GmbH (Germany, EU) hosts the database and authentication, as well as the application and background processes; Supabase Inc. (data in the EU, Frankfurt) keeps a copy until the migration is complete; Vercel (web app hosting: the functions run in the EU, in Frankfurt; the first check of a request may be done on a Vercel server outside the EU, the one closest to the visitor), Resend (email delivery), Sentry (error monitoring), GitLab (source code and continuous integration, United States; does not receive customer data), Langfuse (observability of calls to the language model — receives only data about the call: the model, token usage, duration, error type and technical identifiers of your account and of the conversation, never the text of conversations), PostHog (measuring the pages you visit, only if you accept; hosted in the European Union). We do not sell personal data to anyone. Separately, only on the public pages and only if you accept session recording: Microsoft Corporation (Microsoft Clarity, United States) receives browsing data and also uses it for its own purposes, including advertising.

For abuse prevention and network security, our hosting providers (Vercel and the Hetzner server) temporarily process visitors' IP addresses on the basis of legitimate interest (Art. 6(1)(f) GDPR, Recital 49). We do not store IP addresses for this purpose. Separately, the authentication system records the IP address when you sign in, in its log in the database on the Hetzner server; we keep it there until you ask us to delete it.

5-bis. The language-model provider

So that the agent can compose its reply, the text of the conversation reaches Anthropic. When the business owner answers a question the agent did not know, their answer also reaches Anthropic so that it can be generalized — turned into a general answer, without your personal data, which the business can save in the agent's knowledge so that it can answer other customers too. Anthropic receives only what is needed to generate and generalize the answer; we do not use it for anything else, we do not send it to other third parties, and we do not train models with it. Anthropic is located in the United States, so this data is transferred outside the European Union. The text of the documents the business uploads to suggest frequently asked questions also reaches Anthropic.

5-ter. Telegram

If you write to the business through Telegram, your messages first pass through Telegram — it is the messaging service you use, with your own account, on its own terms. We receive there what you send us. Telegram does not process your messages at our request and does not act on our behalf: it has its own relationship with you and its own privacy policy.

6. Transfers outside the EU

Data is hosted in the European Union. Some processing takes place outside the European Union, including the language-model provider (section “The language-model provider”), Vercel, GitLab and Microsoft Clarity (section “Who else has access”).

7. How long we keep it

Account data: for the life of the account plus up to 30 days after deletion (accidental recovery). Proof that you accepted the Terms and Conditions (the version you accepted, the language, the date and the way you accepted) is kept for the life of the account and for 3 more years after it is deleted, so that we can prove the agreement if a dispute arises. The proof does not contain your name or email address, only a code cryptographically derived from the account identifier. After these 3 years it is deleted automatically. Security audit log: 12 months. Sessions: until expiry or revocation. Unaccepted invitations: 7 days.

8. Your rights

You have the right of access, rectification, erasure, restriction, portability and objection. You can export your data directly in the app. To request erasure, or for any other request, write to our contact address. You have the right to lodge a complaint with a data protection authority. If you live in the European Union, you may address the authority of your country of residence. If you live in the Republic of Moldova, the competent authority is the National Center for Personal Data Protection (datepersonale.md).

9. Security

Encryption in transit (HTTPS), passwords stored only as hashes, optional two-step verification (TOTP), strict isolation between organisations at database level (row level security), audit logging for sensitive actions, sessions revocable from the app.

10. Minors

The service is aimed at businesses and people over 18. We do not knowingly collect minors' data. If you learn that a minor gave us data, write to us and we will delete it.

11. Usage analytics

For usage analytics and consent, see the Cookie Policy.