Privacy Policy

1. Introduction

LynxPrompt is operated by GeiserCloud. We respect your privacy and are committed to protecting your personal data. This policy explains how we collect, use, and safeguard your information in compliance with the General Data Protection Regulation (GDPR) and other applicable privacy laws.

LynxPrompt is open-source software licensed under AGPL v3. This privacy policy governs data processing on lynxprompt.com. Self-hosted LynxPrompt instances are independently operated. This privacy policy applies only to the official instance at lynxprompt.com. Self-hosted instance operators are responsible for their own privacy policies.

2. Data Controller

GeiserCloud is the data controller responsible for your personal data:

• Email: privacy@lynxprompt.com

We have not appointed a Data Protection Officer (DPO). For all privacy inquiries, please contact us at the email above.

3. Data We Collect

We collect and process the following categories of personal data:

4. Legal Basis for Processing

Under GDPR, we process your personal data based on the following legal grounds:

We do not send marketing emails and therefore do not rely on consent for email communications.

5. How We Use Your Data

• To provide and maintain our service
• To authenticate your account via OAuth providers
• To save your preferences, blueprints, and configurations
• To analyze anonymized usage patterns for service improvement
• To send essential service communications

6. Third-Party Services & Data Sharing

We share data with the following third parties to provide our service:

7. International Data Transfers

Your data is primarily stored in the European Union. When data is transferred to third parties outside the EU (GitHub, Google, Anthropic), we ensure appropriate safeguards are in place:

• Standard Contractual Clauses (SCCs): Our third-party providers use EU-approved SCCs for international transfers
• Adequacy decisions: Where applicable, we rely on EU adequacy decisions
• Supplementary measures: Encryption and access controls protect data in transit

8. Data Storage & Security

We implement appropriate technical and organizational measures to protect your data:

• Location: All primary data is stored on servers located in the European Union
• Encryption: All data in transit is encrypted via TLS/HTTPS
• Authentication: Secure OAuth 2.0 authentication via trusted providers
• Access control: Database access is restricted and password-protected

9. Your Rights Under GDPR

If you are in the European Economic Area, you have the following rights:

• Access: Request a copy of your personal data
• Rectification: Request correction of inaccurate data
• Erasure: Delete your account yourself in Settings (Security, Delete account), or ask us to delete your data ("right to be forgotten"). Section 12 says what deletion removes
• Restriction: Request limited processing of your data
• Portability: Request your data in a machine-readable format
• Objection: Object to processing based on legitimate interest

To exercise these rights, contact us at privacy@lynxprompt.com. We will respond within one month of receiving your request.

You also have the right to lodge a complaint with your local supervisory authority. In Spain, this is the Agencia Española de Protección de Datos (AEPD).

10. Information for US Residents

If you are a US resident, you may have additional rights under state privacy laws. While we do not currently meet the thresholds that trigger full CCPA/CPRA compliance, we extend the following rights to all users:

• Right to Know: Request information about data we collect
• Right to Delete: Delete your account in Settings, or ask us to delete your personal data
• Non-Discrimination: We will not discriminate against you for exercising your rights

Note: We do not sell personal information to third parties.

11. Automated Decision-Making

We do not use automated decision-making or profiling that produces legal or similarly significant effects on you. All significant decisions regarding your account are made by humans.

12. Data Retention

We keep your personal data while your account is active. You can delete your account at any time in Settings (Security, Delete account). Deletion takes effect at once and removes:

• Your account, linked sign-in methods, sessions, passkeys, trusted devices and API tokens
• Your profile, preferences, wizard drafts, hierarchies and uploaded profile pictures
• Your blueprints, including the ones you shared with a team, with their version history, and the favorites and download records other people left on them
• Your favorites, and teams where you were the only member
• Pending team invitations and sign-in links sent to your email

Some content stays, without anything that identifies you: support forum posts and comments keep their text but lose your name, picture and account link (your votes are removed), blog posts you wrote keep their text without your name, and your downloads of other people's blueprints stay as anonymous download counts. If you are the only admin of a team that has other members, make another member an admin first.

You can also ask us to delete your account at privacy@lynxprompt.com; we will do so within one month. We keep certain records only where the law requires it (for example, account records for legal purposes, which may be retained for up to 7 years).

13. Cookies

We use only essential cookies required for authentication, session management, and security. This includes:

• Authentication cookies – To keep you logged in and protect against CSRF attacks
• Security cookies – Cloudflare Turnstile sets cookies to protect against bots and automated attacks

We do not use advertising, tracking, or third-party marketing cookies. Our analytics provider (Umami) is cookieless and privacy-focused.

For a detailed breakdown of all cookies used, see our Cookie Policy.

14. Age Requirement

LynxPrompt is intended for users aged 16 and older (or the applicable age of digital consent in your country, which ranges from 13 to 16 within the EU). We do not knowingly collect data from users below this age. If you believe we have collected data from a minor, please contact us immediately.

15. Changes to This Policy

We may update this privacy policy from time to time. Significant changes will be communicated via our website or email. We encourage you to review this policy periodically.

16. Contact Us

For privacy-related questions, data requests, or to exercise your rights: