LYNX AI Security Policy

Version v5.5 dated 11 October 2026.

Provider: LYNX AI limited liability company (LYNX AI LLC), Tax ID (STIR) 313122838, registered address: Republic of Uzbekistan, Tashkent city, Chilanzar district, Qozirobod MFY, Choʻponota koʻchasi, 10b-uy. Website: https://lynx-ai.uz/. Platform: https://crm.lynx-ai.uz/. Contact address: contact@lynx-ai.uz. Phone: +998 33 769 69 09. Registration details are set out in the Provider Details (in Uzbek).

This document is drawn up in the Uzbek and Russian languages; both texts are equally authoritative, and the rule for discrepancies is set out in the User Agreement (section "Governing law, language and disputes"). This English text is a translation.

1. Scope

1.1. This Policy establishes general requirements for the protection of the Service, including text agents, Lynx Voice voice assistants, enquiry management, collaboration, tools for working with text and audio, and Integrations. It applies to all users, plans and Enterprise terms within the features used and supplements the contract and the Data Processing Agreement. No separate agreement is required for the general security rules to apply. Individual levels of availability, redundancy, recovery and support may be agreed only in Enterprise terms. They do not override mandatory statutory requirements or the data protection obligations established by the contract. Obligations relating to lawfully retained data continue to apply after access ends.

2. Protection of the Service

2.1. The Provider applies technical and organisational measures taking into account the nature of the data and the risks: verification of authority, segregation of access, protection of data in transmission and storage, protection of credentials and connections, logging of significant events, prevention of abuse, updating of components and remediation of identified vulnerabilities.

2.2. Users receive access within the authority assigned to them. The Provider's employees and engaged persons are given access to data only to the extent necessary for their task, on a lawful ground and subject to confidentiality. The Provider takes measures to limit the excessive inclusion of sensitive information in technical logs.

2.3. When materials are uploaded, requests are processed and external systems are connected, checks and restrictions appropriate to the function and the risk are applied. A dangerous action may be rejected and the affected access restricted. The checks do not guarantee the detection of every threat or error. The set of measures depends on the category of data, the feature of the Service, the processing mode, mandatory requirements and the contract.

2.4. The authority of automation is determined by the permitted access and the available controls. The content of a received file or message does not confer a right to extend the authority of an agent. The Client sets limits on the actions of agents and checks a scenario before launch.

3. Obligations of the Client

3.1. The Client protects its devices, credentials and access keys, allows only authorised persons to access the account, revokes access rights in a timely manner and uses the available additional security tools. Secret keys must not be published or shared through publicly accessible accounts.

3.2. The Client checks connections, sets justified retention periods and limits on the actions of agents, keeps the lawful copies of materials that it needs and reports suspicious activity to the Provider. The Provider retains its own obligations to protect its systems.

3.3. Application programming interface (API) keys are the Client's credentials. The Client does not place them in program code executed on end users' devices, in publicly accessible code repositories or in messages, limits the rights of each key to the necessary functions, replaces keys when the responsible persons change and, if compromise is suspected, revokes the key in the account dashboard without delay or, if revocation is not possible, informs the Provider accordingly. The Client protects the addresses used to receive event notifications and verifies the authenticity of incoming notifications. The Provider may revoke or restrict a key that is found to be publicly accessible or is being used with signs of compromise, and notifies the Client accordingly.

4. Incidents

4.1. A report of suspected unauthorised access, a leak, misdirected sending of data or loss of control over an access key is sent to contact@lynx-ai.uz with the subject "Security". The report states the account, the time, the circumstances of the event and evidence that can be shared safely. Active passwords, access keys, full bank details and excessive personal data are not included in the report.

4.2. The Provider assesses the event, takes measures to limit the damage, preserves the necessary evidence and takes reasonable measures to eliminate the confirmed cause and to prevent recurrence. For protection, the affected connection may be temporarily disabled or access restricted.

4.3. Mandatory notifications are sent to Clients, affected persons and competent authorities in the cases and within the periods provided for by legislation and the contract. The Provider reports a leak detected in the course of a transfer of data outside the Republic of Uzbekistan to the authorised state body within 24 hours of its detection and, within 72 hours, provides information on its causes and the measures taken. If the incident affects data received through a connected platform, the Provider also notifies the owner of that platform in the manner and within the periods established by the owner's terms.

4.4. Missing information is supplemented as it is ascertained; its absence does not delay a mandatory notification. Disclosure of technical details may be limited to protect data and the investigation. Giving a notice does not constitute an admission of breach of contract, fault or liability.

5. Vulnerability reports

5.1. Reports of discovered vulnerabilities are sent to contact@lynx-ai.uz with the subject "Vulnerability". Testing beyond the normal permitted use of the Service is allowed only with the prior written agreement of the Provider. Testing of other persons' accounts, extraction of other persons' data, creation of a substantial load and interference with systems without permission are prohibited.

5.2. A vulnerability report contains the minimum information necessary for verification, without active secrets or data of third parties. A person who has accidentally gained access to other persons' information ceases such access and reports the event to the Provider. Distribution of protected data is not permitted. A reward for a vulnerability report is paid only under the terms of a reward programme, if the Provider has separately announced such a programme.

6. Place of storage, security information and changes

6.1. Service data, including backups and logs, is stored on servers in the Republic of Uzbekistan. Outside the Republic of Uzbekistan, only certain computing operations for text and speech processing features are performed, without storage facilities or backups of Service data being placed outside the Republic of Uzbekistan, on the terms of the Privacy Policy and the Data Processing Agreement. Messengers, social networks, communications operators, payment organisations and other external services connected by the Client or a user process the data passing through them independently, under their own rules, including outside the Republic of Uzbekistan.

6.2. Internal diagrams, settings, assessment results and information the disclosure of which would threaten the systems or the data of other persons are not published. Such information is provided to authorised persons to the extent provided for by legislation and the contract, under confidentiality conditions permitted by law. The mandatory rights of data subjects and the powers of state bodies are preserved.

6.3. The Provider may update protective measures within the accepted obligations and statutory requirements without separate agreement on each technical change. Such changes do not cancel agreed safeguards, do not change commercial terms and do not authorise new purposes of processing. A new version of this Policy is published with a number and a date; material changes to contractual obligations apply in the manner established by the User Agreement (section "Changes and notices"). Urgent lawful protective measures are taken in the manner provided for by the contract in force.