Privacy Policy

1. Our two roles

LYSTNG handles personal data in two different capacities:

• As a controller, for the personal data of our own users, meaning the businesses and individuals who create a LYSTNG account.
• As a processor, for the personal data that our users collect from their own website visitors and leads. In that case our user is the controller, decides why the data is collected, and is responsible for it. LYSTNG only processes it to provide the platform, on the user's instruction, as set out in our Data Processing Agreement.

Sections 2 to 8 describe data we handle as a controller. Section 9 describes the visitor and lead data we handle as a processor.

2. Information we collect from our users

• Account data. Your name, email address, phone number, business details and login credentials.
• Content you create. The websites, listings, text, images and other content you build on LYSTNG, including images produced with our AI features.
• Payment data. When you subscribe, our payment processors collect your payment details. We do not store full card numbers.
• Support data. Information in your communications with our support team.

3. Connected platform data

When you connect an advertising or analytics account, we access what you authorize so you can run and measure campaigns from LYSTNG, and, where you instruct it, we create and manage campaigns on your behalf:

• Google Ads and Google Lead Form extensions. Account structure, campaigns, ads and performance data, and leads submitted through Google lead forms.
• Meta Ads. Ad accounts, pages, campaigns, ads and performance data, and leads submitted through Meta Lead Ads instant forms.
• Google Analytics (GA4). Report and configuration data for measurement.
• WhatsApp. Access to your WhatsApp Business Account so we can provide the WhatsApp features you use. See Section 8.

We store OAuth tokens in encrypted form and identifiers needed to route requests. We hold campaign and reporting data only as needed to provide the platform.

4. How we use information

We use information to create and secure your account, operate the website builder and listing tools, run and measure your advertising campaigns, provide the AI features you use, process payments, provide support, communicate with you, and comply with law and enforce our Terms. We do not sell your data, and we do not use the platform data we access on your behalf for our own advertising.

5. AI features

LYSTNG offers AI features powered by third-party AI model providers. These currently include image and content generation and may expand to other AI-assisted features over time. We send only what is needed to provide the feature you use. Neither we nor the providers use your inputs or outputs to train generalized AI models. You own the outputs you generate, subject to the provider's terms and applicable law, and you are responsible for reviewing them and using them lawfully. AI outputs may contain errors and should be reviewed before use.

6. Google user data and Limited Use

LYSTNG's use and transfer of information received from Google APIs to any other app will adhere to the Google API Services User Data Policy, including the Limited Use requirements.

We access your Google Account identity for authentication, your Google Ads account and campaign data, your Google Analytics (GA4) data, and leads submitted through Google Lead Form extensions. We use this data only to provide and improve the features you use in LYSTNG, and where you instruct it, to create and manage campaigns. We commit that:

• We use Google user data only to provide or improve user-facing features that are prominent in LYSTNG.
• We do not use it for serving advertising, including personalized, interest-based or retargeted advertising.
• We do not sell it, and we do not use it for creditworthiness or lending.
• We do not transfer it except to provide these features at your instruction, to comply with law, or in a merger or acquisition with notice.
• We do not let humans read it except with your agreement, for security, to comply with law, or when aggregated for internal operations.
• We do not use it to train generalized AI or machine-learning models.

You can revoke access at any time through your Google Account permissions.

7. Meta data

When you connect Meta, we access the ad accounts, pages, campaigns and performance data you authorize, and leads submitted through Meta Lead Ads instant forms, and, where you instruct it, we create and manage campaigns on your behalf. We use each advertiser's Meta data only to provide the advertising and lead features for that advertiser's own accounts, keep it separate from other advertisers, do not use it to build or augment profiles, do not use it to retarget people, and do not sell it. Leads retrieved through Meta Lead Ads are handled as described in Section 9. You can remove access at any time in your Meta settings.

8. WhatsApp data

When you connect WhatsApp, we access and manage your WhatsApp Business Account to provide the WhatsApp features you use. These currently include running Click-to-WhatsApp ads and sending and displaying messages with your customers, and may expand over time to related features such as syncing your website products to your WhatsApp catalogue. We use WhatsApp data only to provide these features, do not sell it, and do not use it to build profiles or for our own advertising. Where you send or receive messages, the message content and the contact details of the people you converse with are personal data we process on your behalf, as described in Section 9. You are responsible for obtaining any opt-in required before messaging people and for complying with the WhatsApp Business Messaging Policy and applicable law. You can revoke access at any time in your Meta and WhatsApp settings.

9. Visitor and lead data we process for you

Most of the personal data flowing through LYSTNG is not about you — it is about your website visitors, your leads and your WhatsApp contacts. We process this data as a processor, on your instruction and for the sole purpose of providing the platform. You are the controller and are responsible for the lawful basis, notices and consents required to collect and use it. This data includes:

• Details submitted through lead forms on the websites you build on LYSTNG subdomains.
• Leads submitted through Meta Lead Ads instant forms and Google Lead Form extensions.
• WhatsApp messages and contact details where you use WhatsApp messaging.

We do not sell this data, do not use it for our own marketing, and process it only to provide the features you enable. Our full obligations for this data are set out in our Data Processing Agreement. When you or your visitor requests deletion, we delete it as described in Section 12.

10. Websites built on LYSTNG subdomains

Websites built on LYSTNG subdomains are operated by our users, not by LYSTNG. The user is responsible for the content of their site and for their relationship with their visitors. As a convenience, LYSTNG provides a default privacy notice and cookie behavior for these sites, but the user remains responsible for ensuring the notice is accurate for their business and for meeting their own legal obligations to their visitors. These sites use analytics cookies, including Google Analytics, to measure traffic.

11. Cookies, analytics and sharing

The LYSTNG website and application use cookies and Google Analytics to operate and improve the service. Where required by law we ask for consent before setting non-essential cookies. For how Google uses this data, see How Google uses information from sites that use our services.

We rely on a small number of trusted service providers, by category: cloud hosting and database infrastructure; a third-party AI model provider for image and content generation; payment processing; email delivery; logging and monitoring; and customer support. Each is bound by confidentiality and data-protection obligations and may use data only to perform services for us. We maintain a current list of the specific providers and will provide it on request at support@lystng.com and to customers under our Data Processing Agreement. We may also disclose information to comply with law, to protect our rights and users, and in a merger or acquisition, in which case we require the recipient to honor this policy. We do not sell personal data.

12. Storage, security, transfers, retention and deletion

We store data on cloud infrastructure currently located in India (Amazon Web Services), and protect it with encryption in transit and at rest, access controls and monitoring. If you or your data subjects are in the European Economic Area, the United Kingdom or Switzerland, your data is processed in India under appropriate safeguards, including Standard Contractual Clauses, as detailed in our Data Processing Agreement.

We keep account and content data while your account is active and delete it on account closure or request. We keep leads and visitor data for as long as you need it in the platform and delete it on your instruction or on a verified deletion request. We keep billing records as long as tax and accounting law requires. To request deletion, email support@lystng.com. You can also revoke platform connections at any time through your Google, Meta and WhatsApp settings.

13. Your rights

Depending on where you live, you may have rights of access, correction, deletion, restriction, objection and portability, and the right to complain to a regulator, under the GDPR and UK GDPR, US state privacy laws such as the CCPA, and India's Digital Personal Data Protection Act, 2023. Where we rely on consent, you can withdraw it at any time. If you are a website visitor or lead of one of our users and want to exercise rights over your data, please contact that user, who is the controller; we will assist them as their processor. To exercise rights or raise a concern, contact support@lystng.com.

14. Grievance redressal

For users in India, you may contact our Grievance Officer at support@lystng.com with any complaint about how your personal data is handled. We will acknowledge promptly and respond within the time required by applicable law.

15. Children

LYSTNG is not intended for anyone under 18 and we do not knowingly collect data from anyone under 18.

16. Changes

We may update this policy from time to time. We will post the updated version and, where changes are material, notify you by email or in the product.

17. Contact us