Privacy Policy
Effective October 4, 2026. This policy explains what personal information the lyrion.io website collects, why, who processes it and the choices you have.
Who we are
This website, lyrion.io, is operated by Lyrion FZ-LLC ("Lyrion", "we", "us"), a company registered in the United Arab Emirates. Our team works from San Francisco, California. For anything about privacy, write to contact@lyrion.io.
This policy covers the website only. When we design, build or operate a system for a client, the personal information in that work is handled under the client's own signed agreement with us, not under this policy.
What we collect
Information you send us
When you use the contact form, we receive your name, email address, company (if you give it), the topic you choose, your message and the page you sent it from. If you write to us directly by email, we receive what you put in that email. If the form cannot be sent, the site opens a pre-filled email in your own email app instead, and nothing is sent until you send it.
Information collected automatically
- Server logs. Our hosting provider, Vercel, records technical details of each request to deliver the site and keep it secure: IP address, the page requested, the time, the browser's user agent and the referring page.
- Rate limiting. When you submit the contact form, the code that handles it keeps a salted, one-way hash of your IP address only in the server's working memory, to limit repeated requests. It is not included in the message, not sent to anyone and never written to storage.
- Analytics, only if you accept. If you click Accept in the cookie banner, Google Analytics 4 runs through Google Tag Manager and collects information about your visit, such as the pages you view, how you arrived, your device and browser, and an approximate location derived from your IP address. If you do not accept, none of this runs.
- Your cookie choice. Your browser stores your Accept or Reject choice so we do not ask again on every page. See the Cookie Policy.
We do not ask for, and ask you not to send, sensitive personal information such as health, financial account or government identification details through the contact form.
How we use it
- To answer your enquiry and follow up on it, including arranging a scoping session or an engagement you ask about.
- To deliver the website, keep it secure and prevent abuse of the contact form.
- To understand how the site is used and improve it, only with your consent.
- To comply with the law and to establish, exercise or defend legal claims.
We do not use the site for advertising. We do not sell your personal information, and we do not share it for cross-context behavioral advertising. Advertising storage, advertising user data and ad personalization are switched off in our analytics setup.
Who processes it
We use a small number of service providers, who process personal information on our behalf and only for the purposes above:
- Vercel Inc. (United States) hosts the website and runs the contact form, and keeps server logs for security and delivery.
- Resend (United States) delivers contact form messages by email to contact@lyrion.io.
- Google provides Google Tag Manager and Google Analytics 4, which load only after you accept analytics.
- The provider that hosts our business email, where your enquiry is received and answered.
We may also disclose information where the law requires it, to protect our rights or the safety of others, or as part of a merger, acquisition or sale of our business, in which case this policy continues to apply to it.
Analytics and cookies
No analytics or advertising code runs until you choose. The cookie banner asks once; if you click Accept, Google Analytics sets its cookies (_ga and _ga_<ID>) and measures your visits. If you click Reject, nothing is loaded. Your choice is kept in your browser for 12 months, and you can change it at any time with Cookie settings, also linked in the footer of every page. The details are in the Cookie Policy.
How long we keep it
- Enquiries are kept for as long as we need them to answer you and follow up, and then deleted. If your enquiry leads to an engagement, the related correspondence is kept for the life of that engagement and as the law requires afterwards.
- Analytics data is kept for the data retention period set in our Google Analytics account, after which Google deletes it.
- Server logs are kept for a limited period under Vercel's standard log retention.
- Your cookie choice stays in your browser for 12 months, or until you clear it.
Your California privacy rights
This section applies to residents of California under the California Consumer Privacy Act, as amended by the California Privacy Rights Act (CCPA).
What we collected in the last 12 months
| Category | Examples | Source |
|---|---|---|
| Identifiers | Name, email address, IP address | You, and your device |
| Professional information | Company name, and anything about your role you include in a message | You |
| Internet or network activity | Pages viewed, referring page, browser and device details, from server logs and, with your consent, Google Analytics | Your device |
| Approximate location | Country or city derived from your IP address, with your consent | Your device |
We collect this information for the purposes described in How we use it and disclose it only to the service providers listed in Who processes it, for those purposes. We do not collect sensitive personal information as defined by the CCPA, and we do not use any personal information to infer characteristics about you.
No sale or sharing
We do not sell personal information and we do not share it for cross-context behavioral advertising. We have no actual knowledge of selling or sharing the personal information of anyone under 16.
Your rights
- Right to know and access the categories and specific pieces of personal information we hold about you, where it came from, why we use it and who we disclose it to.
- Right to delete personal information we collected from you, subject to the exceptions the law allows.
- Right to correct inaccurate personal information.
- Right to opt out of sale or sharing. We do neither, but you may still send the request, and a Global Privacy Control signal is treated as one.
- Right to limit the use of sensitive personal information. We do not collect it, so there is nothing to limit.
- Right to non-discrimination. We will not treat you differently for using any of these rights.
How to make a request
Email contact@lyrion.io with the subject "Privacy request", or see Privacy requests. To protect you, we verify a request by matching it to information we already hold, usually by replying to the email address you used with us, and we may ask for more if a request concerns specific pieces of information. We confirm receipt within 10 business days and answer within 45 days. If we need more time, up to a further 45 days, we will tell you why.
Authorized agents. You may ask someone to make a request for you. We will ask the agent for your signed permission and may ask you to confirm your identity with us directly, unless the agent holds a valid power of attorney.
Global Privacy Control and Do Not Track
If your browser sends a Global Privacy Control or Do Not Track signal and you have not made a choice in the cookie banner, we treat it as a refusal: analytics stays off and the banner does not appear. You can still opt in through Cookie settings if you want to.
Visitors from the EU and UK
Our services are aimed at businesses in the United States, but the site can be visited from anywhere. If you are in the European Union or the United Kingdom, the General Data Protection Regulation (GDPR) or the UK GDPR gives you the following.
- Controller. Lyrion FZ-LLC is the controller of the personal information described in this policy. Contact: contact@lyrion.io.
- Legal bases. We rely on your consent for analytics cookies, and on our legitimate interests to answer enquiries you send us, and to keep the site secure and working. You can withdraw consent at any time through Cookie settings, without affecting what happened before.
- Your rights. You can ask for access to your personal information, its correction or deletion, restriction of its use, a copy in a portable format, and you can object to processing based on our legitimate interests.
- Complaints. You have the right to complain to the data protection supervisory authority in the country where you live or work, or, in the UK, to the Information Commissioner's Office. We would appreciate the chance to resolve your concern first.
We answer EU and UK requests within one month, which can be extended by up to two further months for complex requests, in which case we will tell you.
Where your information is processed
Lyrion is registered in the United Arab Emirates, our team is in the United States, and our service providers process information in the United States and other countries. If you are in the EU or UK, your information is therefore transferred outside it. Where that happens, we rely on the safeguards our providers offer, such as the European Commission's Standard Contractual Clauses (and the UK addendum), or an adequacy decision such as the EU-US Data Privacy Framework where a provider is certified under it.
Security
The site is served only over encrypted connections (HTTPS), loads no third-party code before you consent, and the contact form does not store your message on our web servers: it passes it to our email delivery provider, and nothing else. No method of transmission or storage is completely secure, but we take reasonable measures to protect the information we hold.
Children
The site is meant for businesses and is not directed at children under 16. We do not knowingly collect their personal information. If you believe a child has sent us personal information, write to us and we will delete it.
Changes to this policy
We will update this policy when what the site does with personal information changes, and change the date at the top. If a change is significant, we will say so on the site.
Contact
Lyrion FZ-LLC, registered in the United Arab Emirates. Email: contact@lyrion.io.