Privacy Policy

Version 1.3 · Effective date: July 9, 2026 · Last updated: July 9, 2026

General Provisions

Lynkora DOO Beograd (hereinafter referred to as "the Company", "we", "our") respects your privacy and is committed to protecting your personal data. This Privacy Policy describes how we collect, use, disclose, and otherwise handle information within the LiKE (Lynkora intelligent Knowledge Engine) service — an AI-powered knowledge management platform for organizations and private individuals.

LiKE is a SaaS solution for organizations and private individuals who want to build an intelligent knowledge base with semantic search capabilities and an AI assistant. This policy applies to all LiKE users, including private individuals, workspace administrators, end users, and guests.

Lynkora DOO Beograd is registered in the Republic of Serbia (an EU candidate country). We operate in accordance with the requirements of the GDPR (applied extraterritorially under Art. 3(2)), the Serbian Personal Data Protection Act ("Zakon o zaštiti podataka o ličnosti", 2018), and other applicable data protection laws. If you are located in the EU or another jurisdiction with similar requirements, this policy explains your rights under applicable legislation.

Important: LiKE is a multi-tenant SaaS platform. Your data is separated and isolated from other customers' data. Your workspace — an organization or a private individual's personal workspace — and only it has access to your knowledge base content.

Data We Collect

Personal Data

When you register and use LiKE, we collect the following personal data:

Account data: email address (required for registration) and display name (optional)

Profile data: interface and answer language preferences; consent records (cookie, personal data, marketing) with timestamp and version; last sign-in time

Authentication data: hashed passwords, session tokens, account recovery data

Workspace data: the account and/or organization name provided at registration, and the workspace address (subdomain, slug) generated from it

Onboarding survey responses (optional): your role, the tasks you want to solve, your company's name, size and industry, and how you discovered us. We use these responses to tailor the product and to determine the duration of the free trial

Usage Data

We automatically collect data about how you use LiKE:

Search queries: your search queries and selected results

System actions: document uploads, article edits, annotations

Browsing history: viewed documents, viewing time, session duration

Interaction metadata: last activity time, number of logins, preferred features

Technical Data

When accessing LiKE, we collect technical information:

Device information: device type, operating system, browser version, unique device identifiers

Connection information: IP address, internet provider, connection parameters. The IP address is processed in access logs for security purposes and retained for no more than 90 days (see “Data Retention”), after which it is anonymized

Access logs: request time, request type, response status, data transfer size

Performance information: page load time, JavaScript errors, performance metrics

Country from IP (geo-resolve): to display prices in local currency, calculate taxes correctly (via our MoR provider), and provide basic fraud protection, we determine the two-letter ISO-3166-1 country code from your IP address (via the CDN header). Only the country code (e.g. "DE", "RU", "US") is stored in the billing profile — no city and no precise geolocation; the raw IP address is not stored as part of billing data (its processing in access logs is described above). Legal basis — legitimate interest (GDPR Art. 6.1.f). Self-service country change inside the account is not supported (it affects tax liability and is therefore controlled by us); if auto-detection is wrong or you have relocated, please contact our support team — we will update the country after the necessary verification.

Content and Documents

Your knowledge base content is processed as part of our service:

Uploaded documents: articles, PDFs, images and audio files you upload to LiKE

Content metadata: title, description, category, tags, creation date, author

Indexed content: textual content of documents used to build the search index and semantic database

Content interactions: search result feedback, helpfulness ratings, bookmarks

Communication Data

If you contact our support team, we collect:

Content of emails and support requests

Support correspondence (email)

Issue reports and feedback data

Contact information (email address)

Purposes of Data Processing

1. Service Delivery

We process your data to provide, maintain, and improve LiKE:

Creating and managing your account

Processing search queries and delivering results

Managing document access and user permissions

Synchronizing data across devices

Storing and backing up your content

2. AI Search Improvement

Your data is used to enhance our AI search engine:

Analyzing search patterns to improve result relevance

Improving retrieval quality, indexing and tenant-specific relevance within your tenant

Analyzing user feedback to optimize algorithms

Testing new search features

3. Analytics and Quality Metrics

We analyze usage to understand service quality:

Measuring LiKE performance and reliability

Tracking usage and engagement metrics

Analyzing resource consumption and optimizing infrastructure

Identifying errors and operational issues

4. Security and Fraud Prevention

We process data to protect our service and users:

Detecting and preventing unauthorized access

Protecting against attacks and malware

Investigating suspicious activity

Enforcing terms of use and policies

Security auditing and vulnerability remediation

5. Communication

We use your contact information to:

Send service notifications (scheduled maintenance, updates)

Respond to your inquiries and support requests

Inform you about changes to policies or terms

Send informational content (only with your consent)

6. Legal Compliance

When required or permitted by law, we process data to:

Respond to court orders and subpoenas

Comply with tax and accounting requirements

Protect rights, property, and safety

Legal Basis (GDPR Article 6)

In accordance with the General Data Protection Regulation (GDPR), we process your personal data on the following legal grounds:

1. Performance of a Contract (Article 6(1)(b) GDPR)

We process data necessary to provide LiKE services in accordance with the terms of service:

Account management

Search query processing

Storage and protection of your content

Providing access to service features

2. Legitimate Interest (Article 6(1)(f) GDPR)

We process data to pursue our legitimate business interests, provided these interests are not overridden by your privacy rights:

Improving and developing LiKE

Analytics and understanding service usage

Testing new features

Maintaining and managing infrastructure

Marketing and business development

Fraud and abuse prevention

3. Consent (Article 6(1)(a) GDPR)

For certain types of processing that are not required for contract performance or legitimate interest, we rely on your consent:

Sending marketing communications and newsletters

Using cookies for analytics

Participation in surveys or research

4. Legal Obligation (Article 6(1)(c) GDPR)

We may process data to comply with applicable laws and regulatory requirements:

Tax and accounting obligations

Compliance with court orders and decrees

Law enforcement requirements

AI and Data Processing

How LiKE AI Search Works

LiKE uses language models and natural language processing technologies for semantic search. Here is how it works:

Indexing and Embedding

When you upload documents to LiKE, they go through the following processing stages:

Text extraction: text is extracted from your documents (PDF, DOCX, etc.)

Preprocessing: text is split into chunks, normalized, and indexed

Semantic embedding: each chunk is converted into a vector representation (embedding) for semantic similarity search

Search indexing: embeddings are stored in a specialized search database for fast access

Query Processing

When you perform a search:

Your search query is converted into a semantic representation

The AI system finds the most relevant document fragments

Results are ranked by relevance and presented to you

Additionally, the AI may generate concise answers based on the retrieved content

Tenant Data Isolation

Critically important: Your data is completely isolated from other workspaces (tenants) on our platform:

Each workspace has a separate search index

AI models operate within the context of your tenant only

There is no possibility of cross-access between workspaces

Your documents are not visible to users outside your workspace

Use of Large Language Models (LLMs)

LiKE may use external LLMs (currently OpenAI; the up-to-date list is always provided in the Sub-processors table below) for advanced features. Here is our data policy:

Important: Your data and documents are not used for training or improving external LLM models. We send only the necessary context for processing your query and explicitly instruct LLM providers not to use this data for training.

Control Over AI Features

You have control over how AI features are used:

You can use classic full-text search instead of AI answers

You control what is searchable through article visibility and access settings

You can restrict access to AI features for specific users

You can request deletion of your embedding index by contacting support

Transparency and Audit

We ensure transparency in AI usage:

Search results clearly indicate when AI is being used

You can review the history and sources of AI recommendations

AI usage logs are maintained for audit purposes

We aim to monitor and improve the quality and accuracy of AI results

Storage and Data Protection

Data Center Locations

LiKE data is stored in secure data centers located in the European Union:

Application infrastructure: Frankfurt, Germany (OVHcloud)

Database: Gravelines, France (OVHcloud)

Encrypted backups: OVHcloud object storage, EU

Lynkora operates in accordance with GDPR requirements. Customer data is processed under the protection of EU data protection law. Lynkora DOO Beograd is registered in Serbia (an EU candidate country); transfers between an EU customer and Lynkora are covered by the EU Standard Contractual Clauses (Module 2).

With respect to personal data you upload, import, or export into LiKE (including data of your employees, customers, and other third parties), you act as the Data Controller and Lynkora acts as the Processor acting on your instructions. You are responsible for having a legal basis and all necessary consents to process such data. See the User Agreement for details on user responsibility.

Two roles. With respect to your account data (registration, billing, logs), Lynkora is the data controller. With respect to the content uploaded by you or your organization, Lynkora is the processor; the controller is you (where you use the Service as an individual) or your organization. For organization content, please direct rights requests concerning such data to your organization's administrator (we will assist them); if you use the Service as an individual, you exercise these rights directly.

Pricing terms, price changes, and annual inflation indexation (including cases of sharp inflation) are governed by the User Agreement (section "Plans and Payment"), not by this Privacy Policy.

Retention Periods

We retain your data for the following periods:

| Data Type | Retention Period | Reason |
|---|---|---|
| Active account and content | Until account deletion | Service delivery |
| Deleted content (Trash) | According to your pricing plan (see the "Trash retention period" row on the pricing page /pricing.html) | Permanently deleted after the period expires |
| Access logs | 90 days | Security and audit |
| Data backups | About 30 days (rotation: 7 daily + 4 weekly copies) | Disaster recovery |
| Analytics data | 12 months | Service analysis and improvement |
| Marketing contacts | Until consent is withdrawn; inactive leads — 6 months (legitimate interest) | Marketing communications |

Data Encryption

We use modern encryption standards to protect your data:

The technical and organizational measures listed reflect our approach as of the effective date of this Policy; certain controls may be rolled out in phases and evolve. The current set of measures is described in the TOMs (annex to the DPA).

Encryption in Transit

TLS: All connections between your device and LiKE are encrypted using TLS 1.2+ (TLS 1.3 for modern clients)

Perfect Forward Secrecy: Session keys are refreshed for each connection

HSTS: Browsers are instructed to use only secure connections

Inter-service encryption: Communication between our servers is also encrypted

Encryption at Rest

Encryption at rest: Backups are encrypted; data is hosted on secured OVHcloud EU infrastructure (measures described in the TOMs annex to the DPA)

Key management: Encryption keys are managed at the application level (Fernet symmetric encryption)

Storage encryption: Additional storage-level encryption where provided by the infrastructure provider (OVHcloud)

Backup and Recovery

We maintain regular backups of your content:

Frequency: Regular automated backups

Distribution: Backups are stored separately from production systems and encrypted

Testing: Periodic testing of recovery from backups

RTO/RPO: Internal RTO/RPO targets; contractual recovery commitments are subject to a separate agreement (Enterprise)

Access Control

We restrict access to your data:

Principle of least privilege: Employees have access only to data necessary for their work

Strong authentication: Key-based production access (SSH keys) under the least-privilege principle

Permission management: Role-based access with regular audits

Monitoring and logging: All access is logged and monitored

Confidentiality agreements: All employees have signed confidentiality agreements

Data Transfers to Third Parties

Data Processors (Sub-processors)

LiKE uses the following primary sub-processors to operate our platform:

We update this list when it changes and give at least 30 days' notice before adding a new sub-processor. The list is provided in the table below; you can also request it at [email protected].

| Provider | Function | Data | Agreement |
|---|---|---|---|
| OVHcloud (EU) | Cloud infrastructure, databases, storage | All user data | DPA, within the EU/EEA (no third-country transfer) |
| OpenAI (US) | LLM and AI features (optional) | Query context (API tier — not used for model training; retained by OpenAI for up to 30 days for abuse monitoring) | DPA, EU SCCs Module 3 |
| Resend (US) | Email delivery | Email address, notification content | DPA, EU SCCs Module 3 |
| Google Ireland Ltd / Google LLC (US) | Web analytics (Google Analytics 4, only with your consent via the cookie banner) | Website usage data (events, pseudonymous identifiers) | DPA + EU-US Data Privacy Framework |
| Payment provider (Merchant of Record) | Payment processing as Merchant of Record (payment acceptance, taxes, PCI DSS). The specific provider is designated when paid billing launches after the beta | Payment data (card data handled by the provider, not stored by Lynkora), email, billing country | Independent controller (Merchant of Record, own privacy policy), within EU/EEA — listed for transparency |

International Data Transfers

Lynkora DOO Beograd is registered in Serbia (an EU candidate country without a GDPR adequacy decision). Customer data is physically stored on OVHcloud EU infrastructure. Transfers between an EU customer (controller) and Lynkora (processor in Serbia) are covered by the EU Standard Contractual Clauses, Module 2.

Standard Contractual Clauses (SCCs)

We use the EU Standard Contractual Clauses (adopted by the European Commission, Implementing Decision (EU) 2021/914) to protect data transfers to third countries, including the United States: Module 2 (Controller → Processor) for EU customer → Lynkora transfers, and Module 3 (Processor → Processor) for onward transfers to US sub-processors.

EU-US Data Privacy Framework

For transfers to the US, some providers additionally rely on the EU-US Data Privacy Framework where certified (e.g., Resend, including the UK Extension). OpenAI is not DPF-certified; transfers to OpenAI rely solely on Standard Contractual Clauses.

Additional Security Measures

In addition, we use:

TLS encryption of all data in transit to providers

Data localization in EU processing centers where possible

Minimization of data transferred to third parties

Compliance audits of providers against GDPR requirements

Disclosure Under Lawful Requirements

We may disclose your data to third parties only in the following cases:

Response to a court order, subpoena, or similar legal process

Compliance with applicable law or regulatory requirements

Protection of the rights, property, or safety of Lynkora, our users, or the public

Prevention or investigation of potential violations of our terms of use

If we are asked to disclose your data, we will:

Request the most specific request possible

Delay our response, if not prohibited by law, to notify you

Publish aggregate data-request reports if and when such a practice is introduced

Challenge overly broad or unlawful requests

Data Subject Rights

Under the GDPR and other data protection laws, you have the following rights regarding your personal data. The rights below apply to data for which Lynkora is the controller; for organization content, please contact its administrator; if you use the Service as an individual, you exercise these rights directly:

1. Right of Access (Article 15 GDPR)

You have the right to request access to your personal data.

You can export your knowledge base content (articles and media) using the built-in export functions. For a copy of your account and personal data, contact us at [email protected].

2. Right to Rectification (Article 16 GDPR)

You have the right to correct inaccurate or incomplete data.

You can change your profile, email address, and other information directly in your account settings. To correct other data, please contact our support team.

3. Right to Erasure (Article 17 GDPR)

You have the right to request the deletion of your personal data under certain circumstances.

You can delete your account entirely, which will result in:

Deletion of your profile and credentials

Anonymization of your associated search data and analytics

Deletion of your content (with a recovery period according to your pricing plan)

The recovery period for deleted content is determined by your pricing plan and is listed on the pricing page (/pricing.html) and in the plan card in the interface; after this period expires, all your data will be permanently deleted, except for:

Data required by law (tax records)

Data necessary to protect our rights

Backups (which will be deleted after the retention period expires)

4. Right to Data Portability (Article 20 GDPR)

You have the right to receive your data in a structured, standard, machine-readable format.

We provide export in the following formats:

Markdown / HTML — article content export

JSON — structured batch export of articles and metadata

PDF / DOCX — document export; media files in their original formats

5. Right to Restriction of Processing (Article 18 GDPR)

You have the right to restrict the processing of your data under certain circumstances.

You can:

Decline analytics cookies via the cookie banner

Opt out of marketing communications

Ask your administrator to restrict AI features for your account (per-user permissions)

6. Right to Object (Article 21 GDPR)

You have the right to object to the processing of your data based on legitimate interest.

You may object to:

Marketing communications (unsubscribe links are always included)

Data processing for analytics and service improvement

Profiling and automated decision-making

7. Right to Be Informed

You have the right to be informed about your rights.

This Privacy Policy provides you with all information about your rights.

8. Right to Withdraw Consent (Article 7(3) GDPR)

If processing is based on consent, you have the right to withdraw it at any time; this does not affect the lawfulness of processing carried out before the withdrawal.

How to Exercise Your Rights

To exercise any of the above rights:

Use the built-in functions in your account settings (content export, profile editing, account deletion), or

Send your request to [email protected], specifying the right you wish to exercise

We will confirm receipt and process your request within 30 days

If you encounter any difficulties, contact us at [email protected].

Non-Discrimination

We will not discriminate against you for exercising your rights. If we deny you service solely because you asserted your rights, it is a violation of the law.

US State Privacy Rights

If you are a resident of California or another US state with a comprehensive consumer privacy law (for example, Virginia, Colorado, Connecticut, or Utah), the following applies in addition to the rights described above.

The categories of personal information we collect, and the purposes for which we use them, are described in "Data We Collect" and "Purposes of Data Processing" (identifiers such as your email; account and profile data; usage and technical data, including approximate location by country; content you provide; and communications).

We do not "sell" your personal information, and we do not "share" it for cross-context behavioral advertising, as those terms are defined under the California Consumer Privacy Act (CCPA/CPRA) and similar state laws. We do not use personal information for targeted advertising, and we do not knowingly process the personal information of individuals under 18 (see "Children"). We do not use or disclose sensitive personal information for purposes that would trigger a right to limit under the CCPA.

Subject to identity verification and legal exceptions, you may: know and access the personal information we hold about you; delete it; correct inaccuracies; and obtain a portable copy. You will not be discriminated against for exercising these rights.

To exercise these rights, submit a request to [email protected]. We will verify your identity before responding and will respond within the timeframes required by applicable law. You may use an authorized agent, subject to proof of authorization.

If we ever introduce a "sale" or "share" of personal information as defined by these laws, we will first update this policy, provide a "Do Not Sell or Share My Personal Information" mechanism, and honor opt-out preference signals (such as the Global Privacy Control) where required.

Cookies

What Are Cookies?

Cookies are small text files that websites and applications store on your device. They are used to store information about your preferences, sessions, and behavior.

Types of Cookies We Use

Strictly Necessary

These cookies are essential for LiKE to function and do not require consent:

Authentication is performed using a token (JWT) stored in your browser's localStorage rather than in cookies. Strictly necessary cookies are used for anonymous sessions (abuse protection) and to remember your choice in the cookie banner.

Language and region: Stores your selected language and time zone

Accessibility preferences: Stores your chosen font size or high contrast mode

Functional

These preferences are stored as part of your account settings rather than as tracking cookies:

Recent documents: Track recently viewed documents

Interface settings: Remember layout and panel order

Analytical

These cookies help us understand how you use LiKE (consent required):

Google Analytics: Anonymous usage and behavior statistics

Custom events: Tracking specific actions in LiKE

Marketing

Marketing cookies are not currently used. If we introduce them, they will be loaded only with your prior consent.

Managing Cookies

You can manage cookies in the following ways:

Through LiKE

Use the cookie consent banner shown on your first visit to accept or decline non-essential cookies

To change your choice, clear this site's cookies in your browser — the banner will appear again

Through Your Browser

Use your browser's built-in privacy settings

Block cookies from specific domains

Delete cookies when closing the browser

Security

Our Security Approach

The security of your data is our highest priority. We use a multi-layered approach to protection:

Compliance Standards

We strive to meet or exceed the following standards:

SOC 2 Type II: Planned

ISO 27001: In planning

GDPR: Processing conducted in accordance with GDPR requirements

Secure Development Practices

Secure coding: Developer training on OWASP Top 10

Code reviews: Mandatory code review for all changes

Static analysis: Automated code scanning for vulnerabilities

Dependency scanning: Regular checking for known vulnerabilities in dependencies

Security testing: Responsible vulnerability disclosure program (VDP); independent penetration testing is planned ahead of the enterprise release

Infrastructure Security

Firewalls: Multi-layer firewalls between network segments

VPC and isolation: Private network with isolated subnets for databases

WAF: Web Application Firewall for attack protection

DDoS protection: Protection against denial-of-service attacks

Network monitoring: continuous automated monitoring and alerting for threat detection

Access Management

Sign-in: Email and password, or Google (OAuth); enterprise SSO (OIDC) on eligible plans. One-time email codes are used to verify your address at registration and to reset your password

RBAC: Role-Based Access Control

Audit logs: Logging of all actions for auditing

Session management: Automatic timeout of inactive sessions

API keys: API key rotation and permission management

Incident Response

In case of a data breach, we have a response procedure:

Detection: Continuous automated monitoring and alerting

Containment: Immediate isolation of affected systems

Investigation: Conducting forensic analysis

Notification: Assisting the Data Controller in notifying data subjects in accordance with the GDPR

Recovery: System restoration and final incident closure

Physical Security

Our OVHcloud data centers provide:

Biometric access control scanners

24/7 security and video surveillance

Protection against fire, flood, and other natural disasters

Backup power and cooling systems

Employee Training

Security training: security briefing for people with data access at onboarding and periodically

Social engineering: Regular phishing vulnerability testing

Incident reporting: Training on notification procedures

Policy compliance: Training on privacy and security policies

Vulnerability Disclosure

If you discover a security vulnerability, please send a report to [email protected] . We welcome responsible disclosure and:

Will endeavor to respond to your report

Will not pursue researchers acting in good faith

Will keep you informed about the progress of the fix

Children

The Service is intended for users who are at least 18 years old (see the User Agreement). It is not directed to children, and we do not knowingly collect personal data from anyone under 18. If you believe someone under 18 has provided us with personal data, contact [email protected] and we will delete it.

This does not concern personal data about third parties (which may include minors) that a customer, acting as controller, chooses to include in its own content — for which the customer is responsible.

Policy Changes

How We Notify About Changes

We may update this Privacy Policy from time to time. When we make material changes, we will notify you:

Email notification: Sending a notification to your account email address

In-app notification: A pop-up notification when you log in to LiKE

Date update: The last updated date will be changed at the top of this page

Change highlighting: New versions will provide a comparison (diff) of key changes

Your Consent

Continued use of LiKE after changes are published constitutes your acceptance of the updated Privacy Policy. If you do not agree with any changes, you may delete your account.

Significant Changes

We give at least 30 days' notice of new sub-processors, and advance notice of new processing purposes together with the applicable legal basis. The objection procedure for organizations is set out in the DPA.

Version History

Previous versions of this policy are available upon request at [email protected].

Contact Information

Data Controller

Lynkora DOO Beograd Kneza Miloša 15, 11000 Belgrade, Serbia Reg. No.: 22195689 · VAT (PIB): 115706177 Email: [email protected] Website: www.lynkora.pro

Data Protection Inquiries

For any questions regarding the processing of your personal data, please contact: Email: [email protected]

Data Requests

To exercise your rights regarding personal data (access, rectification, erasure, etc.), you can:

Send an email to [email protected] specifying the request type and necessary details

Send a postal letter to: Lynkora DOO Beograd, Kneza Miloša 15, 11000 Belgrade, Serbia

We will respond within one month; for complex or numerous requests, this period may be extended by up to two further months, in which case we will inform you — in accordance with GDPR Art. 12(3).

Complaints to a Supervisory Authority

If you believe your data protection rights have been violated, you have the right to file a complaint with the data protection supervisory authority in your country. Below are the authorities for a number of European countries (non-exhaustive):

Germany: the data protection authority of the competent federal state (Land)

France: Commission Nationale de l'Informatique et des Libertés (CNIL)

Spain: Agencia Española de Protección de Datos (AEPD)

Italy: Garante per la Protezione dei Dati Personali

Czech Republic: Úřad na ochranu osobních údajů (ÚOOÚ)

Serbia (our registered seat): Commissioner for Information of Public Importance and Personal Data Protection (Poverenik)

Other EU/EEA countries: the data protection supervisory authority of your country of residence, place of work, or place of the alleged infringement (GDPR Art. 77)

Residents of countries outside the EU/EEA may have rights under their local laws and may contact the competent authority in their jurisdiction.

Additional Information and Support

For any questions about this Privacy Policy or about how we process your data:

Write to [email protected]

See our Security page for additional technical details

Review our User Agreement