Privacy notice
1. Who we are
Lynctera is a product of Yellow Be Ltd ("Yellow Be", "we"), a company registered in England and Wales, company number 12807589, registered office Dns House, 382 Kenton Road, Harrow, Middlesex HA3 8DP, United Kingdom. We are registered with the Information Commissioner's Office (ICO), the UK regulator for data protection, under number ZB413637. For this website and for our own business correspondence we are the data controller.
Our data protection officer is Andre Gerakis, dpo@yellowbe.io. For anything about Lynctera specifically you can also write to privacy@lynctera.com; both addresses reach the same team.
This notice is the Lynctera-specific version of the Yellow Be privacy notice, which covers yellowbe.io and our consulting and technical services. Where the two differ, this notice governs lynctera.com, the Lynctera platform and the Outlook add-in.
2. Two different roles
We handle personal data in two capacities, and your rights run to a different party in each.
| Where | Our role | Who to contact |
|---|---|---|
| This website, email and meetings with us, sales and marketing | Controller | Yellow Be Ltd: privacy@lynctera.com or dpo@yellowbe.io |
| The Lynctera platform and the Outlook add-in, used by a client firm | Processor, acting on the client's documented instructions under a data processing agreement | The client firm that gave you access. It decides what is processed and for how long; we act on its instructions |
3. This website
lynctera.com sets no cookies and runs no analytics, advertising or tracking scripts. Fonts load from Google Fonts, which receives your IP address to serve the font file. The site is hosted on Microsoft Azure, whose edge servers keep standard access logs (IP address, user agent, requested page, time) for a short period for security and operations. We do not build profiles from them.
4. Correspondence and sales
If you email us, book a workflow review or meet us, we hold your name, work contact details, employer, and the content of our exchange. We use it to respond, to run the engagement, and to keep a record of the relationship. Legal basis: performance of a contract with you or steps toward one, our legitimate interest in running the business, and consent where we ask for it. We keep identity and contact data and our exchanges with you for up to seven years after the end of the relationship, for contractual, accounting and tax records. We do not sell personal data.
Marketing. We market to prospective and existing business customers and may contact their staff through work contact details. You can opt out at any time by writing to unsubscribe@yellowbe.io or replying to any message. Opting out does not affect processing needed to deliver a service you have bought.
Legal requests. If we are asked to disclose personal data under a court order or other legal request, we take legal advice before responding and weigh the effect on your rights.
5. The Lynctera platform and the Outlook add-in
Client firms use Lynctera to process their own business data, which can include personal data about their staff, clients and correspondents: email content and metadata, documents, calendar and directory information, and the identity of the signed-in user. We process it only to deliver the service the firm has configured, on its instructions, under a written agreement. In outline:
- Isolation. Each client firm's data is held in its own database with its own secrets. Data is never combined across firms.
- Where. Platform data is stored and processed in Microsoft Azure, UK South. AI inference runs in Microsoft Azure AI Foundry in Sweden Central, inside the EU, using Azure OpenAI and Anthropic models hosted by Microsoft. Prompts and outputs are not used by us or by Microsoft to train models.
- Who else sees it. Our own staff, who are bound by confidentiality and data protection obligations, and Microsoft Ireland Operations Ltd (Azure) as our infrastructure and AI sub-processor, under contract terms that carry the same obligations. We notify client firms of any change to the sub-processor list under the agreement.
- Human sign-off. AI outputs such as drafts, summaries and classifications are proposals. A person in the client firm reviews them and decides; the platform does not send email, move money or make decisions about people on its own.
- Learned writing style. Where a firm enables it, Lynctera derives a description of a user's writing style from that user's own sent mail to draft replies in their voice. The user can view it, correct it, or turn it off in the portal.
- Retention and deletion. Retention follows the client's configuration and agreement. Firms can purge stored mail by tenant and erase an individual's data on request; we act on such requests as processor.
If you are a member of staff or a correspondent of a client firm and want to exercise your rights over data in Lynctera, contact that firm. We will help it respond.
6. Security
We operate under SOC 2 controls: access controls and multi-factor authentication, encryption in transit and at rest, managed identities rather than shared credentials, tenant-level isolation, a full audit trail of AI and tool actions, staff policies and training, incident and breach reporting, and business continuity and disaster recovery processes. Our ISO/IEC 27001 and ISO/IEC 42001 (AI management) programmes are under way. Where we are the controller of data affected by an incident we notify the ICO and keep you informed where the law requires; where we are the processor we notify the controller without undue delay and support its investigation and response. If you notice unusual activity on this site or in Lynctera, contact support@lynctera.com.
7. International transfers
Data is held in the United Kingdom and, for AI inference, in the European Union, which the UK recognises as providing adequate protection. Where a client firm asks us to process data elsewhere, the agreement with that firm governs the safeguards.
8. Your rights
Under UK data protection law you can ask for access to your personal data, correction, erasure, restriction, portability, and you can object to processing based on legitimate interests. For data we control, write to privacy@lynctera.com or dpo@yellowbe.io. We may ask you to confirm your identity first. We respond within one month of the request or of confirming your identity, whichever is later, and may extend that by two months for complex or multiple requests, telling you why. Requests are normally free; we may charge, or decline to act, on requests that are unfounded or excessive, and will say so in writing. Where we hold data as a processor we do not act on the request directly: we forward it to the controller and await its instruction. You can also complain to the Information Commissioner's Office at ico.org.uk, though we would rather hear from you first.
9. Changes
We will update this notice as the service changes and show the date of the last change at the top. Material changes affecting client firms are notified under the agreement.
This notice describes the website and our processor role in plain terms. The controlling document for a client firm's data is its agreement with Yellow Be Ltd, including the data processing terms.