Privacy Policy

1. Who we are

The data controller for the personal data described in this policy is Lyto (“Lyto”, “we”, “our”, “us”), a company registered in the Netherlands.

• Registered address: Francois Maelsonstraat 2, 2582 KC, Den Haag, Netherlands
• KvK (Chamber of Commerce) number: 99898624
• VAT number: NL005417321B70
• Privacy contact: lytoapp@gmail.com

We have not formally appointed a Data Protection Officer, as we are not legally required to do so at our current scale. The privacy contact above is the right address for any data-protection question.

2. Scope

This policy covers personal data we process when you:

• Visit our marketing website at lytoapp.com
• Create or hold an account on any Lyto product (including Workspace, Pipeline, Solve, Sum, Workstream, Tally and Pulse)
• Sign in via our authentication service at auth.lytoapp.com
• Contact us by email or by submitting a form on our website

When you use a Lyto product inside an organisation that has its own Lyto account, that organisation is the controller of the business data you contribute (timesheets, invoices, project records, etc.). Lyto is the processor of that data on their behalf. This policy applies to data Lyto controls directly — such as your account credentials, billing details, support correspondence, and product-usage telemetry.

3. What we collect and why

3.1 Account data

When you create an account, we collect your name, email address, and (if you set one) a hashed password. If you sign in with Google, we receive your Google account email, name, profile picture and a unique Google identifier. We never receive your Google password.

Lawful basis: performance of a contract (Art. 6(1)(b) GDPR) — we need this to give you access to the service you’ve signed up for.

3.2 Product data

To deliver the features you use — timesheets, invoices, sales pipeline records, AI-assisted suggestions, dashboards, and so on — we store the information you and your colleagues enter into the apps, plus metadata about how that information is created and changed (timestamps, the user who made each change).

Lawful basis: performance of a contract (Art. 6(1)(b)) for the customer organisation; legitimate interest (Art. 6(1)(f)) in maintaining accurate audit trails.

3.3 Billing data

For paid plans, we store your billing email, billing address, VAT number (where applicable) and the records of invoices and payments. Card or bank details, where you provide them, are handled by our payment processor and never stored on Lyto’s own servers.

Lawful basis: performance of a contract (Art. 6(1)(b)); legal obligation (Art. 6(1)(c)) for tax and accounting record-keeping under Dutch law.

3.4 Technical and usage data

When you use Lyto, our servers automatically receive standard request information: IP address, user-agent string, the page or API endpoint requested, the response status, and the time of the request. We log a subset of this for security, abuse-prevention, and debugging.

We also record a small set of product-usage events (for example: “user signed in”, “invoice created”) so we can understand which parts of the product are used and detect failures. These events are tied to your user ID but do not include the content of your business records.

Lawful basis: legitimate interest (Art. 6(1)(f)) in keeping the service secure, reliable and improving over time.

3.5 Support and communication data

When you email us, fill out a form, or otherwise contact us, we keep the contents of that correspondence so we can respond and so we have a record of the question if it comes up again.

Lawful basis: legitimate interest (Art. 6(1)(f)) in providing support.

4. Bank connections in Sum

Sum, our invoicing and bookkeeping app, can connect to your business bank account so that transactions arrive automatically for reconciliation instead of being imported by hand. This section describes exactly what that connection does. It applies only if you choose to make one — everything else in Sum works without it, and a bank statement file (CAMT.053 or MT940) can be imported instead.

4.1 The connection is read-only

The connection gives Sum account information access only. Sum can read your account details, balance and transaction history. It cannot initiate a payment, move money, or change anything at your bank, and it never asks for the ability to.

You authenticate at your own bank, on your bank’s own screens, using your bank’s own strong customer authentication. Lyto never sees, receives or stores your bank login credentials. What Sum receives back is a session reference, which is encrypted at rest in our database and decrypted only to fetch transactions or to revoke the consent.

Only the organisation’s owner can connect or disconnect a bank account.

4.2 Who the connection runs through

The connection is made through Enable Banking Oy, an account information service provider established and regulated in Finland (EU) under PSD2. Enable Banking holds the regulated relationship with your bank and passes the account data to Sum; it acts as our sub-processor for this purpose and is listed in the table in section 6.

4.3 What Sum stores

For each connection, Sum stores:

• The name and identifier of your bank, and its logo.
• For each connected account: the account name, account type, currency, a masked account identifier, and the most recent balance.
• For each transaction: the booking date, the amount and currency, the description your bank supplies, the counterparty or merchant name where your bank supplies one, any category your bank supplies, whether the transaction is still pending, and the reconciliation status Sum itself assigns (unmatched, suggested, matched or ignored).

The first sync after you connect fetches up to 90 days of transaction history. After that, each sync only asks for what is new or changed since the last one. Sum stores no other information from your bank.

Lawful basis: your explicit consent (Art. 6(1)(a) GDPR), given at your bank under PSD2, which you can withdraw at any time as described below.

4.4 How long the consent lasts

We ask your bank for a consent lasting up to 180 days, which is the maximum PSD2 allows for account information access. Your bank may grant a shorter period. When the consent expires the feed simply stops: no further transactions are fetched until you re-authenticate at your bank. Sum tells you in the Banking settings when a connection needs renewing.

4.5 How to withdraw it

In Sum, go to Settings → Bank connections and choose Disconnect. That does two things: it asks Enable Banking to delete the session, which revokes the consent at your bank, and it deletes the connection from Sum — taking the stored accounts and every transaction fetched through them with it. Bookkeeping entries you had already created from those transactions stay in your books, because they are now part of your accounting record rather than bank data.

You can also revoke the consent from your own bank’s consent screen at any time, without going through Sum. Doing so stops the feed immediately; disconnect in Sum afterwards to remove the data Sum has already stored.

5. Connected mailboxes in Pipeline

Pipeline, our CRM, can connect to a member’s own Microsoft mailbox (Microsoft 365, or Outlook.com and Hotmail) so that mail and meetings with clients appear on the client’s record without being forwarded by hand. This section describes exactly what that connection reads, keeps and deletes. It applies only once Lyto has switched the feature on for your organisation and you connect your mailbox. The organisation you work for is the controller of this data and Lyto its processor; the organisation relies on its legitimate interest in keeping a record of its business relationships (Art. 6(1)(f) GDPR), not on your consent.

5.1 What Pipeline reads, and the permissions it asks for

Pipeline reads your mailbox through Microsoft Graph, Microsoft’s own interface to your mailbox, with these permissions: openid, profile, offline_access and User.Read (who you are, and staying connected), Mail.Read (reading mail), Mail.Send (sending the email you write in Pipeline) and Calendars.ReadBasic (your calendar, without the content or attachments of meetings). Pipeline cannot change, move or delete anything in your mailbox.

• It reads your Inbox, Sent items and primary calendar. No other folders or calendars, and no shared mailboxes.
• When you first connect, it reads the last 12 months of mail and calendar. The calendar is also read 90 days ahead.
• After that it reads new mail every 5 minutes and your calendar every 15 minutes.

Microsoft is not one of our sub-processors. Microsoft Graph is the source of this data: your organisation’s (or your own) Microsoft service, under its own agreement with Microsoft.

5.2 What is kept, and what is discarded

Pipeline reads the headers of each message first (sender, recipients, date, subject) and keeps only what qualifies as business correspondence with an outside company:

• Kept in full (sender, recipients, date, subject, content, attachments): mail with a company you have written to, or with a person or company already in Pipeline. Mail with free-mail providers, your own organisation’s domains, blocked domains and companies marked Not a lead is excluded.
• Headers only, as a suggestion: mail from an unknown company you have never written to. Its content is fetched only if someone accepts the suggestion. In the first 12 months read on connecting, only such mail from the last 90 days makes a suggestion; older one-way mail is not kept. From a personal Outlook.com or Hotmail mailbox, every new company is a suggestion.
• Meetings: title, time, place, organiser and the attendees with their replies, for meetings with a person or company in Pipeline, or with an attendee whose unknown company becomes a suggestion, that have at least one attendee outside your organisation and no more than 25 attendees. Never the meeting’s content.
• Never stored: everything else, including mail between colleagues, newsletters and mail that matches no company. Pipeline does not even keep a message identifier; only its reading position in the mailbox remains.
• Skipped: mail marked Private in Outlook, meetings marked private, personal or confidential, meetings you declined, and internal meetings.

Deleting or archiving a message in Outlook does not remove it from Pipeline: what Pipeline keeps is your organisation’s record of the relationship, not a copy of your mailbox. To delete it, use Remove from Pipeline on the thread or meeting. You also choose who in your organisation sees the content of your mail, and can mark any thread private.

5.3 How long it is kept

• Kept mail and meetings: for as long as the person or company they belong to is in Pipeline, or until they are removed. The raw message file is deleted after 30 days.
• Suggestion headers: until the suggestion is accepted or dismissed, or the message leaves the synced folder, and at most 30 days. A dismissed company’s domain stays blocked, and only the domain is kept.
• The connection itself (your mailbox address, Microsoft account identifiers and an encrypted refresh token): until you disconnect.

5.4 No advertising, no AI training

Lyto never uses data from your mailbox for advertising or marketing, never sells or shares it, and never uses it, or anything derived from it, to train AI models. When you use an AI feature in Pipeline that reads a record, such as drafting a follow-up, that record is processed by Anthropic to answer you and is not used for training.

5.5 Disconnecting, and what it deletes

In Pipeline, go to Email capture and choose Disconnect. Disconnecting deletes at once Pipeline’s access to your mailbox (the tokens), its position in your mailbox, and every suggestion’s headers. Mail and meetings already kept stay on your organisation’s records, unless you choose Remove what only my mailbox brought in, which also deletes the mail and meetings that no colleague captured too. Your capture address keeps working.

You can also remove Pipeline’s access at Microsoft, without going through Pipeline: at myapps.microsoft.com for a work mailbox, or at account.live.com/consent/Manage for a personal one. Pipeline stops reading at once. Disconnect in Pipeline afterwards to delete what it holds; if you don’t, Pipeline disconnects the mailbox itself after 90 days.

Pipeline also disconnects a mailbox when an administrator disconnects it, when its member leaves the organisation, and when the feature is switched off for the organisation. Each time, the mail already kept stays as the organisation’s record. When an organisation closes its Lyto account, everything is deleted (section 8).

6. Sub-processors

Lyto uses a small number of trusted infrastructure providers to deliver the service. Each is bound by a written data-processing agreement, and we’ve chosen providers that process EU personal data within the EU or under appropriate safeguards.

Lemon Squeezy is Lyto’s merchant of record. It sells you the Lyto subscription and takes the payment as an independent controller, under its own privacy policy. It is not a sub-processor, so it is not in the table.

Microsoft is not in the table either. When you connect a mailbox to Pipeline (section 5), Microsoft Graph is the source of the data, on your organisation’s own Microsoft service, not a provider Lyto engages.

We update this list as it changes. Customers hear of a new or replaced sub-processor by email at least 30 days before it is engaged, under section 6.2 of the processor agreement.

7. International transfers

Where personal data is transferred outside the European Economic Area (currently to Google, Twilio SendGrid and Anthropic, for the specific purposes described above), we rely on the European Commission’s Standard Contractual Clauses and, where applicable, on adequacy decisions. We do not transfer personal data to jurisdictions without an appropriate safeguard in place. Bank connection data is not transferred outside the EEA. Data from a connected mailbox is stored in the EU and leaves the EEA only when a Pipeline AI feature reads it (Anthropic).

8. How long we keep it

• Active accounts: for as long as the account remains active.
• Closed accounts: personal data linked to a closed account is deleted within 90 days, except where we are legally required to retain it (for example, billing records under Dutch tax law — 7 years).
• Connected mailbox data: as set out in section 5.3. Disconnecting deletes the connection and every suggestion’s headers at once.
• Bank connection data: for as long as the connection exists. It is deleted as soon as you disconnect the bank in Sum, or when the organisation is closed.
• Backups: backups containing your data are rotated out within 30 days after deletion from the live system.
• Security and abuse logs: up to 12 months.
• Support correspondence: up to 24 months after the conversation ends.

9. Your rights

Under the GDPR, you have the right to:

• Request a copy of the personal data we hold about you (right of access).
• Ask us to correct inaccurate or incomplete data (right to rectification).
• Ask us to delete your data, subject to the retention rules above (right to erasure).
• Ask us to restrict how we use your data while a dispute is resolved (right to restriction).
• Receive your data in a portable, machine-readable format (right to data portability).
• Object to processing we carry out under legitimate interest (right to object).
• Withdraw consent at any time, where we rely on consent — including the consent behind a bank connection (section 4.5).

To exercise any of these rights, email lytoapp@gmail.com. We will respond within 30 days. If you are not satisfied with our response, you have the right to lodge a complaint with the Dutch Data Protection Authority (Autoriteit Persoonsgegevens) at autoriteitpersoonsgegevens.nl.

10. Cookies and similar technologies

lytoapp.com sets no cookies. Signing in on auth.lytoapp.com uses one session cookie, needed to keep you signed in. We do not use third-party advertising or cross-site tracking cookies. Site analytics on lytoapp.com are provided by Vercel Web Analytics, which is served from our own domain and sets no cookies and no cross-site identifier — which is why this site has no cookie banner.

11. Security

We take security seriously and apply industry-standard practices: encryption in transit (TLS 1.2+), encryption at rest for all customer databases, hashed passwords (bcrypt or stronger), least-privilege access for our team, row-level authorisation policies on the database, multi-factor authentication for administrative access, and continuous monitoring. Bank session references and the Microsoft refresh tokens behind a connected mailbox carry an additional layer of application-level encryption. No system is perfectly secure; if you believe you have discovered a vulnerability, please report it to lytoapp@gmail.com.

12. Children

Lyto is built for business use and is not directed at children under the age of 16. We do not knowingly collect personal data from children. If you believe a child has provided us with personal data, please contact us and we will delete it.

13. Changes to this policy

We may update this policy from time to time. The “Last updated” date at the top of the page reflects the most recent change. For material changes that affect how we use existing personal data, we will give account-holders notice by email at least 30 days before the change takes effect.

14. Contact

Questions, requests, or complaints about this policy or how we handle your data:

• Email: lytoapp@gmail.com
• Post: Lyto, Francois Maelsonstraat 2, 2582 KC, Den Haag, Netherlands