LYNX AI Privacy Policy

Version v5.5 dated 11 October 2026.

Provider: LYNX AI limited liability company (LYNX AI LLC), Tax ID (STIR) 313122838, registered address: Republic of Uzbekistan, Tashkent city, Chilanzar district, Qozirobod MFY, Choʻponota koʻchasi, 10b-uy. Website: https://lynx-ai.uz/. Platform: https://crm.lynx-ai.uz/. Contact address: contact@lynx-ai.uz. Phone: +998 33 769 69 09. Registration details are set out in the Provider Details (in Uzbek).

This document is drawn up in the Uzbek and Russian languages; both texts are equally authoritative, and the rule for discrepancies is set out in the User Agreement (section "Governing law, language and disputes"). This English text is a translation.

1. Application of this Policy

1.1. This Policy governs the processing of personal data in connection with the use of the LYNX AI websites and the Service under all plans and under Enterprise terms, within the available and connected features: text agents, Lynx Voice voice assistants, enquiry management, collaboration, tools for working with text and audio, automation, connection of other services and quality analysis. Processing is carried out in accordance with the legislation of the Republic of Uzbekistan, including the requirements on personal data and on the use of artificial intelligence. This Policy applies throughout the processing, including after access ends, where certain data is lawfully retained. It does not constitute a general irrevocable consent to any operations. Consent to processing is given in the manner set out in section 11. New purposes and types of processing are accompanied by the necessary information and by separate consent where such consent is required. Capitalised terms have the meanings given to them in the User Agreement (section "Terms and subject matter") and the Lynx Voice Supplemental Terms.

1.2. With respect to data of user accounts, website visitors, payments, support, security and its own mailings, LYNX AI LLC is the owner and the operator of the personal data database and determines the purposes of processing such data. With respect to data that the Client transfers to the Service or receives through connected channels, the Client is the owner and/or the operator of the database; the Client determines the purposes and grounds of processing, and LYNX AI processes such data as a third party on the Client's instruction. Each participant retains its own obligations. The Data Processing Agreement forms part of the contract under any plan where the Client entrusts processing. Individual Enterprise terms may specify or strengthen safeguards but do not override mandatory requirements or the rights of data subjects.

2. Data processed

2.1. Depending on the features selected, the following are processed:

(a) information about the account, the organisation, representatives, contacts and access rights;

(b) information about subscriptions, invoices, payments and refunds;

(c) customer databases, correspondence, recordings of voice dialogs and conversations, transcripts, documents, attachments and knowledge bases;

(d) tasks, responses, summaries, quality assessments and the results of actions performed by agents;

(e) audio recordings and texts for speech recognition and synthesis and generated materials;

(f) device and browser information, network address (IP address), cookies, actions in the Service, errors and security events;

(g) identifiers, messages, permissions and other necessary information provided by a connected service, including data received from Meta to the extent set out in section 6.

2.2. The scope of data is limited to the selected task. LYNX AI does not process biometric or genetic data (section 4). Special categories of personal data, information about minors and other specially regulated data may be processed only where the necessary grounds and conditions of processing are in place. Acceptance of this general Policy does not replace specific consent where such consent is required.

3. Purposes and grounds of processing

3.1. Data is processed to provide features, perform tasks, connect channels, manage access, handle payments, provide support, ensure security, prevent abuse and fulfil legal obligations. Depending on the purpose, the ground for processing is consent, the necessity of performing a contract with the data subject or of taking steps at the data subject's request before entering into a contract, the performance of an obligation under law, or the protection and exercise of rights and legitimate interests, provided that the rights of the data subject are respected. Other grounds apply only in the cases provided for by law.

3.2. Clients' data and information received through connected platforms are not sold, are not licensed and are not used for LYNX AI's own advertising profiling. Access by employees is limited to what their duties require. LYNX AI sends informational and advertising messages about its products only where separate consent has been given by ticking a box that has not been pre-ticked; such consent is not a condition of registration or of an Order. Each such message contains a means of opting out of further messages. Opting out does not affect the receipt of service messages concerning an Order, payment, security and changes to the terms.

3.3. Entrusted data is not used to train LYNX AI models. Such use is possible only under a separate written agreement with the Client and with the consent of the data subjects for that purpose. Data received through WhatsApp, Messenger and Instagram is not used to train or improve models under any circumstances. The performance of a task, speech recognition and synthesis and the operation of a knowledge base are carried out for the feature selected by the user and do not constitute model training. Depersonalised technical information about the operation of the Service, which does not include message content, audio recordings, documents or information received through WhatsApp, Messenger and Instagram, is used to ensure the operation and security of the Service and to improve it.

4. Voice and actions of assistants

4.1. LYNX AI does not process biometric personal data. The Service does not create voice copies or voice profiles and does not accept voice samples for that purpose. Only the standard voices of the Service are used for speech synthesis.

4.2. The Service is not used to establish the identity of a person by voice or by other biometric features.

4.3. Recordings of dialogs and conversations are processed for speech recognition and for the preparation of text, summaries and quality assessments. Where the utterances of different participants are separated during speech recognition, this is done within a single recording: voice characteristics are not stored and are not used to establish the identity of a person.

4.4. Assistants obtain access to connected sources and to permitted actions. An Integration or a scenario can be disabled. Legally significant decisions affecting the rights and freedoms of a person must not be based solely on the conclusions of artificial intelligence. Limits of authority are set for material actions; human confirmation is required in the cases provided for by law and in accordance with the agreed procedure for performing actions.

5. Recipients of data

5.1. To operate the Service, LYNX AI entrusts the processing of data to persons in the following categories: hosting and storage of data in the Republic of Uzbekistan; computing operations for text and speech processing on the terms of section 7; delivery of messages and email; ensuring security; provision of software components; support; acceptance of payments. They receive only the data necessary for the relevant task, on terms providing for permitted purposes, confidentiality, protection and destruction.

5.2. When personal data is included in a database, the data subject is notified in writing of the purposes of processing and of the data subject's rights, save for the exceptions provided for by law. This Policy, as provided to the user at registration, constitutes written notice of the transfer of the user's data to persons in the categories specified in clause 5.1. The user is notified of the appearance of a new category of recipients by email or in the account dashboard before the transfer begins. Information about the persons who have received the data subject's data and about cross-border transfer is provided at the data subject's request sent to contact@lynx-ai.uz, to the extent and within the periods provided for by legislation. The data subject is notified in writing of a transfer of personal data to a third party within three days where such notice is mandatory; only the exceptions provided for by law apply.

5.3. Connected messengers, social networks, payment services and communication services may process data independently under their own rules. When an Integration is disconnected, further access through it ceases; data previously received by LYNX AI is destroyed or retained only within the limits of applicable requirements. Data may be transferred to competent authorities upon a lawful demand. Where the business is transferred, mandatory safeguards and notices continue to apply.

6. Data from WhatsApp, Messenger and Instagram

6.1. Where the Client connects WhatsApp, Messenger or Instagram through Meta's official application programming interfaces, LYNX AI, on the Client's instruction, receives from Meta and processes: the user's platform identifier (for WhatsApp, the phone number and the WhatsApp identifier; for Messenger and Instagram, the user identifier specific to the Client's Page or account), the name or username and other profile information where the platform provides it, message content, attachments and voice messages, time of sending, delivery and read information, as well as information about the Client's Page, account, phone number and permissions, and access keys.

6.2. This data is used only to receive and send messages on behalf of the Client, to enable the Client's agents and employees to work in the dialog, to display correspondence and enquiry details in the Client's workspace, to prepare, on the Client's instruction, summaries and enquiry assessments based on the content of the correspondence, and to ensure security and compliance with platform rules. LYNX AI does not sell or license this data, does not transfer it for advertising, does not use it to create, train or improve artificial intelligence models, and does not use information about users received from Meta for purposes unrelated to communicating with them on behalf of the Client.

6.3. This data is made available to the Client, to persons engaged by LYNX AI to perform the instruction on the terms of clause 5.1, to persons to whom the Client has instructed that it be transferred, and in the cases provided for by law. The place of its storage and processing is governed by section 7. Meta processes messages and related information on its own infrastructure under its own terms and privacy policy, including outside the Republic of Uzbekistan.

6.4. The data is retained for the period necessary to perform the Client's instruction and is destroyed after the channel is disconnected, after the Client's access ends, at the request of the Client or the user, at Meta's demand and in other cases provided for by law, in accordance with section 8 and the Data Deletion Instructions.

6.5. A person who has corresponded with the Client may request deletion of their data received by LYNX AI through a Meta platform in accordance with the Data Deletion Instructions, including without a LYNX AI account. LYNX AI notifies the Client of such a request.

6.6. At Meta's request, LYNX AI may provide Meta with information about the Client and its contact person that is necessary to verify compliance with Meta's terms, and LYNX AI notifies Meta of security incidents affecting data received from Meta.

7. Place of storage and processing

7.1. Service data processed by LYNX AI is stored on servers located in the Republic of Uzbekistan. This applies to databases, files, messages, documents, recordings of voice dialogs and conversations, processing results, logs and backups.

7.2. For the operation of the features of text processing by artificial intelligence models, speech recognition and speech synthesis, LYNX AI may entrust certain computing operations to persons who perform them outside the Republic of Uzbekistan. Such persons receive only the data necessary to perform the specific operation, over secure communication channels. The result of the operation is returned to the Service and stored in the Republic of Uzbekistan. LYNX AI does not place storage facilities, databases or backups of Service data outside the Republic of Uzbekistan.

7.3. LYNX AI engages for computing operations only persons whose terms of engagement do not permit the use of the transferred data for those persons' own purposes, including for model training, and provide for the destruction of such data after the operation has been performed and the technically necessary period has expired.

7.4. Computing operations outside the Republic of Uzbekistan are performed in states ensuring equal protection of the rights of data subjects. Data for such operations is transferred to other states only after the conditions established by legislation for transfer to such states have been met and where the consent of the data subject has been obtained by LYNX AI under section 11 or, for data processed on the Client's instruction, by the Client; consent does not replace those conditions. If the necessary conditions are not ensured, the operation is not performed.

7.5. Information about the states in which computing operations are performed, the categories of recipients and the scope of the data transferred is provided to the data subject and to the Client upon a request sent to contact@lynx-ai.uz, in the manner and within the periods established by legislation.

7.6. Messengers, social networks, communications operators, payment organisations and other external services connected by the Client or a user store and process the data passing through them independently, under their own rules and on their own infrastructure, including outside the Republic of Uzbekistan. Clauses 7.1-7.5 relate to the systems of LYNX AI and do not apply to such services.

8. Retention and destruction

8.1. Data is retained for no longer than is necessary for the stated purpose of processing, unless a different period is established by law or by a contract with the data subject. The period is determined taking into account the duration of the account and of the Order, the features selected, the content of the instruction, and the need to complete settlements and to handle requests. The applicable period or the method of determining it is specified in the terms of the feature, in the settings or in the information provided to the data subject. Where processing is based on consent, this information is also specified in the consent. Changing a setting does not override mandatory periods and does not permit retention after the lawful ground has ceased to exist.

8.2. Unless a different period is established by legislation or by a contract with the data subject, the following periods apply:

(a) account data and the user's materials are retained for as long as the account exists and are destroyed within the periods set out in clause 8.3 after the account is deleted;

(b) data processed on the Client's instruction is retained for the period set by the Client in the settings, but for no longer than the term of the contract with the Client, unless the Client has given an instruction for earlier destruction; after the contract terminates, such data is destroyed within the periods set out in clause 8.3;

(c) documents relating to Orders and payments, and records of the acceptance of contractual documents, of recurring charge authorisations, of usage volume and of notices sent under the contract, are retained for the periods established by accounting and tax legislation, but for not less than the term of the contract and three years after its termination;

(d) security logs and technical logs are retained for no more than twelve months;

(e) backups are retained within the cycle specified in clause 8.4;

(f) information necessary for handling a claim or dispute that has been raised is retained until the claim or dispute is finally resolved.

8.3. Personal data is destroyed:

(a) no later than the next working day after receipt of a withdrawal of consent, if there is no other ground for processing;

(b) within three days after the purpose of processing has been achieved, the consent has expired or a court decision has entered into legal force;

(c) within one working day after receipt of a demand from the data subject, a court or the authorised state body, where the processing has been found unlawful.

Destruction means actions after which the data cannot be restored. Depersonalisation instead of destruction is applied only in the cases provided for by legislation. Information that must be retained by law is retained to the corresponding extent, with restricted access and use.

8.4. Mandatory destruction is not postponed for the duration of a period for cancelling account deletion or for obtaining a data export. Backups created to restore data after failures are stored in the Republic of Uzbekistan in encrypted form, are not available for ordinary use and are overwritten according to an established cycle, the length of which does not exceed thirty days. Data subject to destruction is not restored from backups; when a backup is restored, previously completed destructions are reapplied before processing resumes.

8.5. Data is corrected or supplemented at the data subject's demand within three days; any inaccuracy identified is corrected without delay. The data subject is notified in writing, including by email or in the account dashboard, of the correction, destruction or restriction of access.

9. Data protection

9.1. LYNX AI applies legal, organisational and technical measures taking into account the nature of the data and the risk: restriction of access, protection of transmission and storage, recording of significant events and response to breaches. The user protects their credentials, grants the necessary permissions and reports unauthorised access.

9.2. LYNX AI notifies the affected persons, Clients and the authorised state body of a security incident affecting personal data in the cases and within the periods provided for by legislation and the contract. LYNX AI reports a leak detected in the course of a transfer of data outside the Republic of Uzbekistan to the authorised state body within 24 hours of its detection and, within 72 hours, provides information on its causes and the measures taken.

10. Rights and requests

10.1. The data subject has the right to obtain the information provided for by law about the processing, the scope and sources of the data, the methods of processing, the recipients, the grounds and the periods; to demand correction, suspension or cessation of processing, or destruction, in the cases provided for; to withdraw consent; and to apply to the authorised state body or a court. In the cases of automated processing provided for by law, the data subject has the right to obtain an explanation of its procedure and consequences and to lodge an objection. The requirements for human participation in legally significant decisions continue to apply. Available export features are used in the account dashboard or upon request.

10.2. Requests are accepted at contact@lynx-ai.uz. Proportionate verification of identity or authority may be required to protect the data. A request is considered and fulfilled within the periods established for the relevant demand. A refusal to provide information is sent to the data subject in writing, stating the reasons, within ten days from the date of receipt of the request. A reply to an objection against a decision based solely on automated processing is sent in writing within ten days from the date of receipt of the objection. Notices of changes, destruction, restriction of access, refusal and other mandatory actions are sent in the form provided for by law. If part of the processing continues on an independent lawful ground, that ground is communicated to the data subject to the extent permitted by law. For data processed on the Client's instruction, the request is forwarded to the Client no later than the next working day, unless LYNX AI is obliged to fulfil it itself; forwarding does not extend the mandatory period.

10.3. The procedure for deleting an account and data, including data received through connected platforms, is set out in the Data Deletion Instructions. Requests concerning the processing and protection of personal data are sent to contact@lynx-ai.uz with the subject "Personal data".

11. Consent to the processing of personal data

11.1. A user who, at registration, has ticked the consent box or has performed another expressly designated action that is recorded gives LYNX AI LLC (Tax ID (STIR) 313122838, registered address stated at the beginning of this Policy) consent to the processing of their personal data on the terms of this section. The user is identified by the surname, first name, email address and/or phone number provided at registration and by the account data; information about the date, time and version of the consent is retained.

11.2. Purposes of processing: registration and maintenance of the account, provision of the selected features of the Service, payments, support, ensuring security, prevention of abuse and fulfilment of obligations established by legislation.

11.3. List of data: surname and first name, email address, phone number, information about the organisation and position, data of the account, settings and access rights, information about Orders and payments, materials that the user uploads to the Service or creates in it, including texts and audio recordings, and information about the device, browser, network address and actions in the Service.

11.4. Actions performed with the data: collection, systematisation, storage, modification, supplementation, use, provision, transfer, depersonalisation, blocking and destruction.

11.5. The user agrees that LYNX AI entrusts the processing of data to persons providing hosting and storage of data in the Republic of Uzbekistan, computing operations, message delivery, security, software components, payments and support, to the extent necessary for the purposes set out in clause 11.2.

11.6. The user agrees to the cross-border transfer of texts, audio recordings and other materials necessary for text processing, speech recognition and speech synthesis to persons performing computing operations outside the Republic of Uzbekistan on the terms of section 7, including to states not included in the list of states ensuring equal protection of the rights of data subjects, provided that the conditions established by legislation for transfer to such states have been met. Information about such states is provided at the user's request.

11.7. The consent remains valid for as long as the account exists and until the data is destroyed within the periods set out in section 8. The consent does not extend to the publication of data in publicly available sources.

11.8. The consent may be withdrawn by a request sent to contact@lynx-ai.uz or by the method provided in the account dashboard. Withdrawal does not affect the lawfulness of processing carried out before it was received. Processing necessary for the performance of a contract with the user or of obligations under law continues on the corresponding ground. Features that cannot be provided without the withdrawn part of the consent cease; the other features remain available.

11.9. Separate consent is required for advertising messages and for other purposes expressly specified in this Policy.

12. Minors, cookies and changes

12.1. The Service is not intended for persons under 18 years of age. LYNX AI does not open accounts for persons known not to have reached that age and terminates their access in the manner established by the User Agreement (section "Conclusion of the contract"). Processing of data of minors who are Interlocutors of the Client or who are mentioned in its materials is permitted only where the Client has a lawful ground, including the consent of a legal representative where such consent is required. The use of cookies is described in the Cookie Policy.

12.2. LYNX AI updates the description of processing, its contact details and information about protective measures. Correction or clarification of such description within the existing purposes, legal grounds and contractual safeguards does not require new acceptance upon each publication. Material changes must be communicated to the affected persons.

12.3. Changes to contractual rights and obligations are governed by the User Agreement (section "Changes and notices"); publication of this Policy does not cancel previously agreed safeguards.

12.4. A new version does not retroactively extend consent previously given. Where required, separate consent for a new purpose or operation is obtained before processing begins. The right to withdraw consent is retained. If a requested feature cannot be provided without the relevant processing and there is no other lawful ground, provision of that feature ceases; refusal of optional processing does not restrict the other features.