Privacy Policy

This Privacy Policy explains how LynosAI Inc., a corporation incorporated under the laws of the Province of Ontario, Canada, operating as "Lynos" and "Lynos.ai" ("Lynos," "we," "us," or "our"), collects, uses, discloses, and protects personal information when you visit lynos.ai, use the Lynos application, use our SMS receipt service, or otherwise interact with us (together, the "Service").

Lynos is bookkeeping software built for businesses, but the information we handle (yours and, sometimes, that of people connected to your business) is personal, financial, and sensitive. We have tried to write this policy in plain language. If anything is unclear, contact us at privacy@lynos.ai.

1. Scope

This policy applies to personal information we handle as the operator of the Service: for example, information about you as our customer, prospective customer, or website visitor.

Your business's books may also contain personal information about other people, such as your employees, contractors, customers, or vendors (names on transactions, payees on receipts). We process that information on your behalf and on your instructions in order to provide the Service. You are responsible for having the right to submit it to us. If you are an accounting firm processing client data through Lynos, contact us at privacy@lynos.ai about our data processing terms.

This policy does not cover third-party websites or services we link to or integrate with (such as QuickBooks, Xero, Plaid, or Stripe), which have their own privacy policies.

2. Information We Collect

Information you provide to us:

• Account and contact information: name, email address, password (stored hashed), phone number, company name, and role.
• Business profile information: country, province or state, industry, business structure, fiscal-year and sales-tax settings, and, if you choose to provide them, business identifiers such as a Canadian Business Number (BN) or U.S. Employer Identification Number (EIN). Do not enter a Social Insurance Number or Social Security Number into the Service.
• Receipts and documents: images and files you upload or text to us, and the information they contain (merchant names, amounts, dates, and occasionally personal details visible on a receipt).
• Business descriptions and queries: free-text descriptions of your business (for example, during onboarding) and questions you ask through Ask Lynos.
• Communications: messages you send to support or sales, form submissions, and survey responses.

Information we collect from your financial institutions via Plaid (with your authorization):

• Account details (institution, account name and type, masked account numbers), balances, and transaction history (dates, amounts, merchant descriptions, and categories).
• Lynos uses Plaid Inc. to gather your data from financial institutions. By using the Service, you grant Lynos and Plaid the right, power, and authority to act on your behalf to access and transmit your personal and financial information from the relevant financial institution. You agree to your personal and financial information being transferred, stored, and processed by Plaid in accordance with the Plaid End User Privacy Policy.
• We do not receive or store your online-banking usernames or passwords.

Information from your accounting software (with your authorization): your chart of accounts, vendors or contacts, customers, classes or tracking categories, and transaction records in the QuickBooks Online company file or Xero organization you connect, to the extent needed to categorize, match, and sync your books.

Information collected when you use SMS receipts: your mobile number, the messages and images you send, delivery metadata, and carrier information, processed through our messaging provider (Twilio).

Payment information: payments are processed by Stripe. Stripe collects your card or bank details directly; we receive limited information such as card brand, last four digits, expiry, and billing status, and we do not store full card numbers.

Information collected automatically: log and device data (IP address, browser type, operating system, pages viewed, timestamps, referring URLs), approximate location derived from IP, and product-usage events (for example, which features you use), collected through cookies, local storage, and similar technologies described in Section 11.

3. How We Use Information

We use personal information to:

• Provide and operate the Service: create and manage your account; retrieve and refresh bank and card transactions; read and match receipts; categorize transactions; compute your Books Health Score; sync with QuickBooks or Xero; answer Ask Lynos questions; and generate reports and tax packages.
• Process with AI: as described in Section 4.
• Bill and administer subscriptions: through Stripe, including renewals, invoicing, and fraud screening.
• Communicate with you: service and transactional messages (receipt confirmations, sync alerts, billing notices, security and policy updates), responses to your inquiries, and, with your consent where required by law, marketing communications, which you can opt out of at any time via the unsubscribe link or by contacting us.
• Secure and improve the Service: monitor for fraud, abuse, and security incidents; debug and fix issues; and analyze usage in aggregated or de-identified form to improve features.
• Comply with law: meet legal, regulatory, tax, and audit obligations, and establish or defend legal claims.

We do not use personal information for automated decision-making that produces legal or similarly significant effects about you without human involvement. Categorizations and scores generated by the Service are informational tools that you review and control.

4. How AI Processing Works

Lynos uses artificial intelligence, including large language models operated by Anthropic (Claude), OpenAI (GPT models), and Google (Gemini), to read receipts, categorize transactions, cross-check results between models, and answer your questions.

To do this, we send the relevant data (for example, a transaction description, a receipt image, or your Ask Lynos question, along with business context you have provided) to one or more of these providers through their business APIs, and receive the model's output back.

• We use these providers under their business/API terms, under which customer content submitted through the API is not used to train their models. Provider API logs are retained only for limited periods for abuse monitoring under their respective policies.
• We send only the data needed for the task.
• AI output is probabilistic and may contain errors; the Service is designed for you to review results, and our Terms of Service explain that output is not professional advice.

5. How We Share Information

We share personal information only as described below. We do not sell personal information, and we do not share it with third parties or affiliates for their marketing or promotional purposes. Mobile numbers and SMS opt-in and consent information are never shared with or sold to third parties or affiliates for marketing or promotional purposes; text-messaging originator opt-in data and consent are not shared with any third parties, except with service providers acting on our behalf to deliver the messaging service.

Service providers (subprocessors). We share information with vendors who process it on our behalf, under contracts limiting their use to providing services to us:

We will update this list as our vendors change.

At your direction. When you connect an integration (for example, QuickBooks or Xero) or use export or sharing features, we disclose the relevant data as you instruct.

Legal and safety. We may disclose information if we believe in good faith it is required by law, subpoena, or other legal process; to enforce our Terms; or to protect the rights, property, or safety of Lynos, our users, or others. Where permitted, we will attempt to notify you of legal demands for your data.

Business transfers. If Lynos is involved in a merger, acquisition, financing, reorganization, or sale of assets, personal information may be transferred as part of that transaction, subject to this policy's commitments.

Professional advisors. We may share information with our lawyers, accountants, auditors, and insurers under confidentiality obligations.

6. Cross-Border Transfers (Important for Canadian Users)

Lynos is a Canadian company, but we store and process information on servers located in the United States, and our service providers listed above process information in the United States. Your personal information will be transferred to, stored, and processed in the United States.

While in the United States, your information is subject to U.S. law and may be accessible to U.S. courts, law enforcement, and government authorities under lawful process. We use contractual and technical safeguards with our providers designed to protect your information to a standard comparable to what applies in Canada, but we cannot override the laws of the jurisdictions in which the information is held.

For users in Quebec: personal information communicated to Lynos will be transferred outside Quebec (to the United States) as described in this policy. By using the Service, you acknowledge and consent to these transfers.

7. Legal Frameworks We Follow

• Canada (PIPEDA). For personal information handled in the course of commercial activity, we follow the ten fair-information principles of the Personal Information Protection and Electronic Documents Act, including accountability, identifying purposes, consent, limiting collection, limiting use and retention, accuracy, safeguards, openness, individual access, and challenging compliance. Alberta, British Columbia, and Quebec private-sector laws apply as relevant.
• Quebec (Law 25). For individuals in Quebec, we honor Law 25's requirements, including publication of this policy, designation of a person in charge of the protection of personal information (Section 14), notice of transfers outside Quebec (Section 6), confidentiality-incident handling (Section 10), and your rights under that law.
• Canada's Anti-Spam Legislation (CASL). We send commercial electronic messages only with consent or as otherwise permitted, we identify ourselves in our messages, and every marketing message includes a working unsubscribe mechanism.
• United States. For U.S. users, we honor applicable state privacy laws. We do not sell or "share" personal information as those terms are defined under such laws.

8. Retention

We retain personal information for as long as your account is active and as needed for the purposes described above. Because the Service exists to maintain financial records, we retain your books data while your subscription is active so that your records remain intact and auditable.

When your subscription ends (you cancel, a trial ends without a plan, or a failed renewal is not resolved):

• we stop importing transactions, disconnect your linked financial accounts, and close your access to the Service;
• we retain your account data, without giving you access to it, for twelve (12) months so you can reactivate, and we email you thirty (30) days before the deletion date;
• we then permanently delete or de-identify it, except where we must retain it to comply with legal, tax, accounting, or audit obligations, to resolve disputes, to enforce agreements, or to maintain security logs; and
• residual copies in encrypted backups are purged thereafter in the ordinary course of our backup rotation cycle.

When you close your account yourself from the Service, deletion happens thirty (30) days after you close it unless you sign in and restore the account before then.

Remember that deleting your Lynos account does not delete anything in your own QuickBooks or Xero file or at your financial institution, and it does not satisfy your own legal record-keeping duties (for example, CRA's general six-year retention requirement). Export your records first.

9. Your Rights and Choices

Subject to applicable law, you may:

• Access the personal information we hold about you and receive an accounting of how it has been used and disclosed;
• Correct inaccurate or incomplete information (much of your information can be edited directly in the app);
• Export your data at no charge using the Service's built-in export tools (transaction exports, reports, and tax packages), during your subscription and for 30 days after cancellation or termination. If you would like a compiled archive of your entire account (all data, including all receipt images and attachments), we offer that as an optional service for a one-time fee of US$500. This fee applies to the optional archive service only; it does not apply to, and does not limit, your statutory right of access to your personal information described in this Section;
• Delete your account and request deletion of your personal information, subject to the retention limits in Section 8;
• Withdraw consent to collection, use, or disclosure, subject to legal or contractual restrictions and reasonable notice. Withdrawing consent for core processing (for example, bank connectivity) means we can no longer provide the Service;
• Opt out of marketing at any time via the unsubscribe link in any marketing email or by contacting us. You will still receive essential service and billing messages;
• Stop SMS at any time by replying STOP to any Lynos text (reply HELP for help); and
• Disconnect integrations (bank connections via Plaid, QuickBooks, Xero) at any time in your settings.

To exercise any of these rights, contact privacy@lynos.ai. We will respond within the time required by applicable law (generally 30 days in Canada) and may need to verify your identity first. We will not discriminate against you for exercising your rights. If you are dissatisfied with our response, you may complain to the person identified in Section 14, and you also have the right to complain to your privacy regulator, including the Office of the Privacy Commissioner of Canada (priv.gc.ca) or, in Quebec, the Commission d'accès à l'information (cai.gouv.qc.ca).

10. Security

We take the sensitivity of financial data seriously. Our safeguards include encryption of data in transit (TLS) and at rest, tokenized bank connectivity (we never hold your banking credentials; connections use Plaid's token-based system), restriction of production access to authorized personnel, environment isolation, and logging and monitoring.

No method of transmission or storage is completely secure, and we cannot guarantee absolute security. If a breach of security safeguards involving your personal information creates a real risk of significant harm, we will notify you and the applicable regulator(s) as required by law (including PIPEDA's breach-reporting rules and Law 25's confidentiality-incident rules), and we maintain an internal register of such incidents.

Please protect your own account: use a strong, unique password, and contact support@lynos.ai immediately if you suspect unauthorized access.

11. Cookies and Similar Technologies

We use a small number of cookies and browser local-storage entries:

• Essential: session and authentication cookies that keep you signed in and secure, and local-storage entries that remember in-progress setup information (for example, your company name during signup). These are necessary for the Service to function.

We do not currently use third-party analytics or advertising cookies on the Service, and we do not permit third parties to track our users across other sites for advertising. If we introduce analytics tools, we will update this policy and, where required by law (including for users in Quebec), obtain consent first. Because we do not engage in cross-site tracking, we do not respond to browser "Do Not Track" signals, though we honor applicable opt-out preference signals where required by law. You can control cookies through your browser settings; disabling essential cookies will prevent sign-in.

12. Children

The Service is intended for business use by adults. It is not directed to anyone under 18, and we do not knowingly collect personal information from anyone under 18. If you believe a minor has provided us personal information, contact privacy@lynos.ai and we will delete it.

13. Changes to This Policy

We may update this policy from time to time. We will post the updated version at lynos.ai with a revised "Last updated" date and, for material changes, will notify you by email or in-app before the changes take effect. Your continued use of the Service after the effective date constitutes acceptance of the updated policy, where permitted by law; where law requires fresh consent, we will seek it.

14. Contact Us / Privacy Officer

Questions, requests, and complaints about privacy should go to our Privacy Officer (for Quebec purposes, the person in charge of the protection of personal information):

Martin Gagliardi, Co-Founder and Privacy Officer
LynosAI Inc. (Ontario, Canada)
Email: privacy@lynos.ai
Website: lynos.ai

If you prefer to write to us by mail, email privacy@lynos.ai and we will provide a current mailing address for your request.