Privacy

This page explains what LynchPine (Pvt) Ltd collects through lynchpine.io, who else sees it, how long we keep it, and what you can ask us to do with it. It is written to be read rather than to be defensible. If anything here is unclear, write to support@lynchpine.io and we will explain it.

Two different things, kept separate

This site. For anything you do here, LynchPine is the controller. We decide what is collected and why, and this page is the full account of it.

Client engagements. When we build a system for a client, the documents, tickets, records and other material that system runs on belong to the client. They decide what happens to it and we act on their instructions, which makes them the controller and us the processor. That material is governed by the contract and the data processing agreement for that engagement, not by this page. If you are a client looking for how your own data is handled, that is the document you want, and our security page describes the practice behind it.

What we collect

When you send an enquiry. The name, email address and message you type into the contact form, plus company name, budget range and area of interest if you choose to give them. We need these to reply. There is no other way for us to answer an enquiry.

When you email or call. Whatever is in your message, and your email address or phone number, held in our ordinary mail and phone records.

When you browse. Our host records standard server request information: IP address, browser type, the page requested and the time. That is used to keep the site up and to investigate abuse. We run no advertising trackers and build no profiles of visitors.

Audience and performance measurement. We use Vercel Web Analytics and Vercel Speed Insights, which are run by the same company that hosts the site. Between them they record the page you asked for, where you arrived from, your approximate location from your IP address, your browser, operating system and device type, your connection speed, and how quickly the page loaded and became usable. They set no cookies and they store no IP address. Vercel Web Analytics identifies a visit by a hash computed from the request, which is discarded after twenty-four hours, so a visit cannot be followed from one day to the next or across any other site. We see counts and averages, not people.

When you sign an onboarding agreement. If we share a signing link with you, the onboarding portal collects your full name, job title, and email address as they should appear on the executed document, together with the name of the company you are signing on behalf of, the time of signing, your IP address, and your browser’s user-agent string. The IP address and user-agent form part of the signature certificate that is appended to each executed document and provides a verifiable record of who signed it and when. We need this to make the signature worth anything; without it an electronic agreement is just a checkbox.

When you use the assistant. The questions you type and the answers it gives. This one has consequences worth reading in full, below.

We do not ask for, and have no use for, special category data: health, biometrics, political opinions, religious beliefs, or anything similar. Please do not put any of it in the contact form or the assistant.

The assistant, and what happens to what you type

The assistant answers from published copy on this site. To generate an answer, your question and the recent turns of the conversation are sent to Google's Gemini API. We hold the key so that your browser never talks to Google directly, but the text itself does reach Google.

It runs on Google's unpaid tier. Under the terms of that tier Google uses submitted content and generated responses to provide, improve and develop its products, and human reviewers may read, annotate and process it. That is materially different from the enterprise arrangements we set up for client systems, where submitted data is excluded from training by default. We are telling you this here because the difference is real and you should decide accordingly.

So: treat the assistant as a public conversation. Do not put confidential information, personal details about other people, or anything you would not want reviewed into it. If your question needs any of that, email support@lynchpine.io instead and a person will answer it.

We keep no record of assistant conversations ourselves. The transcript lives in your browser for the length of the session and we do not log it. Your IP address is held in memory on the server for up to an hour, purely to count requests and stop one visitor exhausting the quota. It is not written to disk and not linked to anything else.

Why we are allowed to hold it

• To answer you. Where you have asked us to do something, handling your enquiry is necessary to take steps at your request before entering a contract.
• Legitimate interests. Keeping the site up, investigating abuse, and running a rate limit on the assistant. We have weighed these against your interests and consider them proportionate, since none of it involves profiling or advertising.
• Consent. Where you choose to use the assistant, knowing what the section above says about it. You can simply not use it.
• Legal obligation. Where we have to keep records, for example for tax.

Who else sees it

We sell nothing and share nothing for advertising. These are the only third parties involved, each doing one job:

• Vercel hosts the site, processes server request logs, and receives the audience and performance measurements described above.
• Resend delivers enquiry emails from the contact form to our inbox.
• Google generates assistant answers, on the terms described above.
• Google Drive stores executed copies of onboarding agreements. When you sign through our onboarding portal, the completed document (with its embedded signature certificate) is filed in a restricted folder accessible only to LynchPine. Google processes that data under their standard terms; the file lives in our account and is not used by Google for any other purpose beyond storage. Google Drive is only involved when a signing link has been sent to you.
• dev.to serves the article cover images on our reading page. Loading that page means your browser requests images from dev.to, which necessarily reveals your IP address to them. It is the only company other than Vercel that your browser contacts anywhere on this site.

Our own email and business records are held on standard business software. We will also disclose information where the law requires it, and we will tell you when we are permitted to.

Where it goes

We are based in Sri Lanka and work with clients in Australia, Canada, India, Norway, Sri Lanka, United Kingdom. The providers above operate internationally, so information about you may be processed outside your own country, including in the United States. Where information moves out of the UK or the EEA, we rely on the transfer mechanisms those providers put in place, which for each of them is the European Commission's standard contractual clauses and the UK addendum to them.

How long we keep it

• Enquiries that go nowhere: deleted within twelve months.
• Enquiries that become work: kept for the engagement and then for as long as tax and contract records require.
• Signed agreements: retained for the engagement and as long as contract records require, typically seven years. The executed PDFs are filed in Google Drive; the name, job title, email, IP address, and user-agent embedded in each certificate are part of that record and kept for the same period.
• Server logs: kept on our host's ordinary schedule, which is a matter of weeks rather than years.
• Assistant rate-limit counters: at most one hour, in memory only.
• Assistant conversations: not kept by us at all.

What you can ask for

Whatever country you are in, you can ask us for a copy of what we hold about you, ask us to correct it, or ask us to delete it. Write to support@lynchpine.io and we will answer within thirty days. We will not charge you and we will not make it difficult.

Depending on where you live you may also have the right to object to processing, to ask us to restrict it, to receive your data in a portable form, and to withdraw consent at any time. These rights come from the UK and EU GDPR, Sri Lanka's Personal Data Protection Act, the Australian Privacy Principles, Canada's PIPEDA, and India's Digital Personal Data Protection Act respectively. We apply the same process to every request rather than asking you to prove which regime you fall under.

If you think we have got this wrong, tell us first and we will try to put it right. You also have the right to complain to your data protection authority: the Information Commissioner's Office in the UK, your national supervisory authority in the EEA, the Office of the Australian Information Commissioner, the Office of the Privacy Commissioner of Canada, or the Data Protection Authority in Sri Lanka.

Cookies and what is stored in your browser

This site sets no cookies at all, of any kind, and shows no cookie banner. That includes the measurement described above: Vercel Web Analytics and Speed Insights are cookieless by design and store nothing in your browser. The one thing this site does store there is your choice of light or dark theme, under the key lp-theme. It never reaches our server, it identifies nothing about you, and clearing your browser data removes it.

Keeping it safe

The site is served over HTTPS with a strict transport policy. Form submissions are validated on the server. API keys are held as environment variables and never reach your browser. Access to our mail and records is limited to the people who need it, on named accounts.

No system is perfect. If personal data is lost or exposed in a way that is likely to put you at risk, we will notify the relevant authority within seventy-two hours where the law requires it, and we will tell you directly.

Children

This is a business-to-business site and is not directed at children. We do not knowingly collect information from anyone under sixteen. If you believe a child has sent us something, write to us and we will delete it.

Changes

If this page changes materially we will change the date at the top and, where the change affects information you have already given us, tell you directly.

Who we are

LynchPine (Pvt) Ltd, Colombo, Sri Lanka. Questions, requests and complaints all go to support@lynchpine.io.