Privacy Policy

This privacy policy describes how Lynxio collects, uses, and protects your personal data when using our open-source intelligence (OSINT) platform.

Identification Data

• Email address (required for account creation)
• Username
• Password (encrypted)

Usage Data

• OSINT search history
• Types of analyses requested (email, domain, phone, etc.)
• Application usage frequency
• Preferences and settings

Payment Data

• Billing information (via secure third-party processors)
• Subscription and payment history
• Subscription status (lite, standard, premium)

Technical Data

• Device type and operating system
• Application version
• IP address (for security)
• Error and performance logs

Service Operation — Provide OSINT analyses, manage your account, process your queries. Legal basis: Contract execution

Payment Management — Process subscriptions, issue invoices, manage billing. Legal basis: Contract execution

Security — Prevent fraud, detect abuse, ensure platform security. Legal basis: Legitimate interest

Service Improvement — Analyze usage, fix bugs, develop new features. Legal basis: Legitimate interest

We share your data only with:

• Payment processors: Stripe, Apple Pay, Google Pay
• Infrastructure: Hetzner Online GmbH, Helsinki, Finland (EU) — ISO 27001:2022 certified
• Object storage: Cloudflare R2, European jurisdiction
• Email service: Brevo (Sendinblue SAS), Paris, France
• Authorities: Only if required by law

We never sell your data to data brokers, advertisers, social networks, or marketing companies.

• Account data: While active + 3 years after deletion
• Search history: According to your subscription (7 days to unlimited)
• Payment data: 10 years (legal obligations)
• Technical logs: 6 months maximum
• Analytics data: 2 years in anonymized form

• AES-256 encryption of sensitive data
• Mandatory HTTPS/TLS connections
• Two-factor authentication available
• Firewall and DDoS protection
• 24/7 security monitoring

• Right to Access: Request a copy of all your personal data
• Right to Rectification: Correct or update your information
• Right to Erasure: Delete your personal data
• Right to Portability: Export your data in a readable format
• Right to Object: Object to data processing
• Right to Restriction: Limit data usage

Response time: 30 days maximum. Contact: contact@just4work.com

• Essential cookies: Authentication, security, basic operation
• Analytics: Anonymized audience measurement (with your consent)
• No advertising cookies

Lynxio is intended for users aged 16 and over. We do not knowingly collect personal data from children under 16.

When you use Lynxio to search for information about a third party (a person other than yourself), we process publicly available data about that individual. The legal basis for this processing is our legitimate interest (Article 6(1)(f) GDPR) in providing security research and investigation tools.

We implement the following safeguards:

• (a) all sensitive data is masked before display (passwords, full emails, etc.)
• (b) raw breach data is never stored after your session
• (c) we process only publicly available information

Third parties whose data appears in search results may contact us at contact@just4work.com to request information about processing or to exercise their rights.

You have the right to lodge a complaint with the supervisory authority in your country of residence. In France, this is the Commission Nationale de l'Informatique et des Libertés (CNIL):

• Website: cnil.fr
• Address: 3 Place de Fontenoy, TSA 80715, 75334 PARIS CEDEX 07
• Tel: +33 1 53 73 22 22

Some of our service providers may process data outside the European Union. When this occurs, we ensure appropriate safeguards are in place: Standard Contractual Clauses (SCC) approved by the European Commission, or adequacy decisions.

Our current data processors and their locations:

• Hetzner Online GmbH (Finland, EU) — server hosting
• Cloudflare R2 (European jurisdiction) — object storage
• Brevo / Sendinblue SAS (France, EU) — transactional emails
• RevenueCat Inc. (USA) — subscription management — Standard Contractual Clauses apply
• Apple Inc. (USA) — App Store / Apple Pay — Standard Contractual Clauses apply
• Google LLC (USA) — Google Play / Google Pay — Standard Contractual Clauses apply

Lynxio uses artificial intelligence to generate search summaries. AI processing is performed by a European or SCC-covered provider. Search queries and OSINT results may be sent to this service to generate analytical summaries. We do not use your data to train AI models.

When a phone number search returns a profile photo (e.g., from messaging applications), this image may be temporarily stored to display your result. Profile photos are stored for a maximum of 30 days and then automatically deleted. They are never shared with third parties.

When searching for breach exposure, Lynxio queries third-party breach intelligence databases. Sensitive data returned (passwords, full email addresses, financial data) is masked before being displayed and is never stored in our systems. We retain only the name of the breach source (e.g., "LinkedIn 2021") and the count of records found, for your search history.

Lynxio uses the following cookies:

• (a) Essential cookies: authentication token (session management, security) — no consent required
• (b) Analytics cookies: anonymized usage statistics — consent required

We do not use advertising, tracking, or third-party marketing cookies.

Search queries and their targets (the identifiers you searched for) are automatically deleted from our systems after 90 days. You may request earlier deletion at any time by contacting contact@just4work.com or using the account deletion feature.

We use the following sub-processors to operate Lynxio:

• Hetzner Online GmbH (Germany/Finland) — server hosting — DPA signed
• Cloudflare Inc. (EU jurisdiction) — object storage — DPA signed
• Brevo / Sendinblue SAS (France) — transactional emails — DPA signed
• RevenueCat Inc. (USA) — subscription management — SCC applied
• Apple Inc. (USA) — App Store / Apple Pay — SCC applied
• Google LLC (USA) — Google Play / Google Pay — SCC applied

In the event of a personal data breach likely to result in a risk to your rights and freedoms, we will notify the CNIL within 72 hours of becoming aware of it (Article 33 GDPR). If the breach is likely to result in a high risk, we will also notify you directly without undue delay (Article 34 GDPR).

We do not sell, rent, or share your personal information with third parties for commercial purposes. California residents have the right to request disclosure of any sale of personal information — our answer is: we do not sell personal information.

Just4Work, as the data controller, is established in France (EU) and acts as its own EU representative. For UK residents: Lynxio processes UK personal data in compliance with the UK GDPR and the Data Protection Act 2018. Complaints may be lodged with the Information Commissioner's Office (ico.org.uk).

Email: contact@just4work.com

Website: https://lynxio.io