--- title: Privacy Notice version: 2026-10-16.1 effectiveDate: null material: true summaryOfChanges: >- Complete rewrite of the Privacy Policy dated 5 July 2026. Names Lynx Group GmbH as controller and our EU representative; explains how TrueOwned processes customer content as a processor; lists every provider, country and transfer safeguard (including US processing at Cloudflare, Modal, fal and OpenRouter); states retention periods; and corrects the earlier text, which mentioned analytics cookies we do not use. --- # TrueOwned Privacy Notice This notice explains how Lynx Group GmbH processes personal data when it operates TrueOwned. It replaces the Privacy Policy dated 5 July 2026. ## 1. Who is responsible **Lynx Group GmbH**, Kaiserstuhlstrasse 2, 8154 Oberglatt, Switzerland, UID CHE-230.130.559 ("Lynx", "we", "us"), operates TrueOwned at trueowned.com and is responsible for the processing described in this notice. For privacy questions and requests, write to [hello@trueowned.com](mailto:hello@trueowned.com) or to the postal address above. **Our representative in the European Union** under Article 27 GDPR is **Cloudkasten GmbH (rep4eu)**, Seestr. 20 G, 50374 Erftstadt, Germany, . You and EU supervisory authorities can contact our representative instead of us, or in addition to us, about any matter concerning our processing of personal data. We have not appointed a data protection officer, as neither Swiss law nor the GDPR requires one for our processing. The Swiss Federal Act on Data Protection (FADP) applies to our processing. The EU General Data Protection Regulation (GDPR) also applies where we offer TrueOwned to businesses and their staff in the EU. This notice covers processing for which we decide the purposes and means: our website, customer accounts, billing, support, business contacts and the security of the Service. Section 2 explains how the Service processes content on our customers' instructions. ## 2. Business accounts and customer websites TrueOwned is a service for businesses, but the information it handles can still be personal data, for example about employees, sole traders, representatives, people shown in uploaded photographs, and visitors of published sites. When we process personal data in customer website content, prompts, images, form submissions or visitor records on a customer's instructions, the **customer is the controller** and we act as its **processor** under our [Data Processing Agreement](/dpa) (or as a subprocessor where the customer works for its own client). The operator of a published website is responsible for that site's privacy notice, lawful collection of enquiries and any visitor choices. Please contact that operator about its site or the enquiries it received; we help it respond as required. A site exported to the customer's own hosting does not send later visitor data to us unless it uses a TrueOwned function that does. ## 3. What data we process and where it comes from **Account data.** Name, work email address, business name, address, country, role, VAT and registration numbers, and sign-in details. We receive these from you, from your organisation's administrator and from Emorise Login, our sign-in service. If you sign in with Google, Microsoft or GitHub, we receive your name, email address and account identifier from that provider. **Billing data.** Plan, invoices, transaction status and billing contact. Stripe collects and holds your card and other payment method details; we never receive or store full card details. We store only the Stripe identifiers of your customer record and subscription. **Service data.** Support messages and attachments; project and website settings; prompts, text, source code, uploaded photographs and videos; generated Output; connected integrations and deployment destinations; credit and usage records. Customer content can contain personal data about people other than the account user. Where your organisation supplies information about you, your organisation is the source. **Technical data.** IP address, time stamps, browser and device information, session identifiers, access and error logs, security events and the features you use. For managed sites and forms we process visitor request data and form submissions on the site operator's instructions. **Generation records.** For AI actions we record the model and version, settings, references and hashes of inputs and outputs, the provider that served the request, credits charged and, for AI images, a provenance record of how the image was marked. We use these records to deliver the Service, for billing, for security and to prove the AI origin of content. ## 4. Purposes and legal bases | Purpose | Data | Legal basis under the GDPR | |---|---|---| | Create accounts and provide the Service you ordered | Account, business contact, project and operational data | Performance of a contract (Art. 6(1)(b)) where you are the contracting customer; otherwise our legitimate interest (Art. 6(1)(f)) in serving the business you work for and its authorised users | | Charge for the Service and keep accounting records | Billing contacts, invoices, transactions, credit ledger | Performance of a contract (Art. 6(1)(b)) or legitimate interest (Art. 6(1)(f)) in administering the account; for accounting records, our legitimate interest (Art. 6(1)(f)) in complying with the Swiss Code of Obligations, and legal obligation (Art. 6(1)(c)) where EU or Member State law imposes the duty | | Sign-in, security, abuse prevention and fault investigation | Account data, technical logs, relevant content and incident evidence | Legitimate interest (Art. 6(1)(f)) in a secure and reliable service; legal obligation (Art. 6(1)(c)) where EU or Member State law requires it | | Answer support and business enquiries | Contact details and correspondence | Steps at your request before or under a contract (Art. 6(1)(b)); otherwise legitimate interest (Art. 6(1)(f)) in answering business correspondence | | Mark AI Output and prove its origin | Generation records, provenance records | Legal obligation (Art. 6(1)(c)) under Article 50 of the EU AI Act; legitimate interest (Art. 6(1)(f)) in transparent AI content | | Inform you about changes to the Service, prices or these documents | Contact details | Performance of a contract (Art. 6(1)(b)) | | Establish, exercise or defend legal claims and meet lawful disclosure requests | Relevant account, transaction and incident records | Legitimate interest (Art. 6(1)(f)); legal obligation (Art. 6(1)(c)) where a binding duty applies | We do not send marketing emails, and we do not use analytics or advertising tracking. Where we rely on legitimate interests, we have weighed them against your rights; you can ask us for details. Under Swiss law, we process personal data lawfully, in good faith, proportionately, for the purposes stated here and transparently. Personal data in customer content that we process only on a customer's instructions is governed by that customer's legal basis and our DPA; we do not reuse it for our own purposes. ## 5. AI features When you use an AI feature, we send the prompt, the selected project context and the content needed for that feature to the AI provider that runs it: - **Text, code and design** (including image analysis): Anthropic Claude 5.5 models, reached through **OpenRouter, Inc.** (USA) and served only by **Amazon Bedrock** (Amazon Web Services) or **Google Cloud Vertex AI** (Google). Every request is restricted to zero-data-retention endpoints with data collection denied, and OpenRouter does not log prompts. Requests can be processed in the United States or the EU. - **Images**: FLUX.1 [schnell], run by **fal – Features & Labels, Inc.** (USA). fal receives only the text prompt. Payload storage at fal is switched off, and fal deletes its copy of the generated image after one hour. - **Scroll videos**: LTX-2.5 (with Wan 2.2 as fallback), which we run on GPU servers of **Modal Labs, Inc.** (USA). Modal receives your keyframe photographs and video instructions and keeps function inputs and outputs for up to 7 days. The model authors (Lightricks, Alibaba, Google) receive nothing. None of these providers may use your content to train their models. **We do not use customer content or personal data we process for customers to train AI models.** AI requests may pass automated safety checks at the provider. Do not submit special categories of personal data (for example health data), criminal-record data, identity documents, passwords or payment secrets to AI features. This does not reduce our duties for data we actually receive. ## 6. Who receives data We share personal data only as needed with: - the **service providers** listed in our [provider register](/subprocessors), which names each provider, what it does, the data it receives, its countries, its retention and the transfer safeguard; - **independent providers** you choose or use directly: Stripe for its own fraud-prevention and legal duties, GitHub when you connect your repository, Google, Microsoft or GitHub when you sign in with them, and Unsplash for stock photographs (Section 9); - **professional advisers, authorities and courts** where we have a legal reason; and - a **buyer or successor** in a business transaction, under appropriate safeguards and with notice to you. **Emorise Login** (login.emorise.com) is our own sign-in service, operated by Lynx Group GmbH on our server in Germany. It is not a separate recipient. Your Emorise Login account also lets you sign in to other Lynx (Emorise) products with the same credentials; we use it for single sign-on and account security only. The Logto software we use for it is self-hosted, and its vendor receives no personal data. ## 7. International transfers We process data in **Switzerland** (Lynx, remote administration) and **Germany** (our server at Hetzner in Falkenstein and Amazon email in Frankfurt). Switzerland and the EU recognise each other's data protection as adequate. Some providers process data in the **United States**: Cloudflare (storage of uploads, generated media and backups; hosting and delivery of published sites), OpenRouter with Amazon Bedrock and Google Vertex AI (AI text), fal (AI images), Modal (scroll videos) and Stripe (payments). Stripe and Cloudflare also process data in their global networks, and Unsplash in Canada. For each transfer we use one of these safeguards, as stated per provider in the [provider register](/subprocessors): - **adequacy**: Canada for Unsplash; certification under the **EU-US and Swiss-US Data Privacy Framework** for Cloudflare, Amazon Web Services, Google, Microsoft, Stripe and GitHub (checked 16 October 2026); - **standard contractual clauses** of the European Commission with the adaptations required for Swiss transfers, included in the provider's data processing agreement, for OpenRouter, fal and Modal, which are not certified under the Data Privacy Framework. We add further protection by sending only the data a feature needs, by encrypting data in transit, by using zero-data-retention AI endpoints and by keeping provider retention short. You can ask for a copy of the safeguards at hello@trueowned.com; we may redact unrelated confidential terms. ## 8. How long we keep data We keep personal data only as long as the purpose requires, and we delete it within the following maximum periods. Deletions follow a documented internal procedure and are passed on to the providers concerned. | Data | How long | |---|---| | Account and business contact data | While your account is open; after closure, deleted together with your projects (next row) | | Projects, sites, uploads and generated content | While your account is open. After closure: a 30-day export window, then deleted from our active systems within a further 30 days. Individual deletion requests: within 30 days | | Scroll-video inputs (keyframe photographs, uploaded videos used for a render) | 30 days, unless you keep them as project assets | | Form submissions on managed sites | Deleted with the site or the account, or earlier on the site operator's request | | Generation and provenance records | As long as the related content exists, then deleted with it; records needed as accounting records are kept as such | | Credit ledger, invoices and other accounting records | 10 years from the end of the financial year (Swiss Code of Obligations, Art. 958f) | | Support correspondence | 24 months after the enquiry is closed | | Security and access logs | 90 days at most, longer only for a specific security incident while it is investigated | | Backups | Overwritten or deleted within 90 days; restored data is subject to the same deletions again | | Emorise Login account | Until you ask us to delete it, as you may still use it for other Lynx products; your TrueOwned membership ends when your TrueOwned account is closed | If a legal hold applies, we keep only the records it covers, only for as long as it lasts. Retention at our providers is shown in the [provider register](/subprocessors). ## 9. Cookies and similar technologies TrueOwned uses only technologies needed to sign you in, keep you signed in, protect forms and payments, and remember your editor state. **We use no analytics, advertising or other optional tracking**, so we do not ask for cookie consent. | Name | Set by | Purpose | Duration | |---|---|---|---| | `__Secure-trueowned.session-token` | trueowned.com | Keeps you signed in | 30 days | | `__Host-trueowned.csrf-token` | trueowned.com | Protects sign-in against cross-site request forgery | Browser session | | `__Secure-trueowned.callback-url` | trueowned.com | Returns you to the right page after sign-in | Browser session | | `__Secure-trueowned.state`, `__Secure-trueowned.pkce.code_verifier`, `__Secure-trueowned.nonce` | trueowned.com | Secure the sign-in exchange with Emorise Login | 15 minutes or browser session | | `gh_app_csrf` and the GitHub connection state cookie | trueowned.com | Protect the connection of your GitHub account | Minutes | | Emorise Login session cookies | login.emorise.com | Keep your Emorise Login session | Session, or as long as you choose to stay signed in | | Stripe cookies (for example `__stripe_mid`, `__stripe_sid`) | Stripe | Fraud prevention when you enter payment details | Up to 1 year | | Browser local storage | trueowned.com | Remembers editor and interface state on your device | Until you clear it | You can delete or block cookies in your browser; blocking the essential ones prevents sign-in. **Published customer sites** are the customer's responsibility. They use self-hosted fonts and no tracking added by TrueOwned. Pages that show Unsplash photographs load them from Unsplash, which receives the visitor's IP address, browser details and the page address. Forms on managed sites use Cloudflare Turnstile to block spam. Customers who add further embeds or analytics must inform their visitors and obtain any required consent. ## 10. Security We protect personal data with measures appropriate to the risk, including encrypted connections (TLS), encryption at rest in our object storage and backups, private storage with short-lived signed links for unpublished uploads, encrypted storage of access tokens and secrets, tenant-scoped access checks, restricted staff access, multi-factor authentication for administrative accounts, and controlled deletion. Our [DPA](/dpa) (Schedule 2) describes these measures in detail. No system is perfectly secure; please report a suspected incident to hello@trueowned.com. ## 11. Your rights Subject to the legal conditions, you can ask for access to your personal data, correction, deletion, and receiving or transferring your data. Under the GDPR you can also ask us to restrict processing, and you can object at any time to processing based on our legitimate interests, on grounds relating to your particular situation. Where we rely on consent, you can withdraw it for the future. We may ask you to verify your identity or authority. Write to hello@trueowned.com or to our EU representative. You can complain to a supervisory authority: in Switzerland the Federal Data Protection and Information Commissioner (FDPIC, ), and in the EU the authority of your habitual residence, your place of work or the place of the alleged infringement. You do not have to contact us first. We need account and transaction data to provide the Service and meet our legal duties; without it we cannot open an account, take a payment or run the feature you choose. ## 12. Automated decisions We do not take decisions based solely on automated processing that have legal or similarly significant effects on you. Generating website content in response to your instructions is not such a decision. Automated checks may block a single request, for example when your credit balance is insufficient or a request breaks our usage limits; you can contact us to have any such block reviewed by a person. ## 13. Changes We update this notice when our processing changes and will tell account holders about material changes by email or in the app. Earlier versions remain available from this page.