Privacy Policy

Last updated: February 16, 2026

Lynq Studio (“lynq.studio”, “we”, “us”, or “our”) operates a web analytics platform. This policy explains what we collect and why, both from people who use our platform (customers) and from visitors to websites that use our tracking technology (end users). It is written to match what the software actually does, including the parts that require consent.

1. Who We Are

Lynq Studio is a web analytics service operated by Lynq Studio. Our registered address is Istanbul, Turkey. For data protection inquiries, contact us at privacy@lynq.studio.

2. Data We Collect

2.1 From Our Customers (Account Holders)

When you create an account, we collect:

  • Name and email address (for account management)
  • Password, stored as a bcrypt hash. We never see it in plain text
  • Website domain (to configure tracking)
  • Payment information, processed by our payment provider. We do not store card details

Legal basis: Contract performance (GDPR Art. 6(1)(b)). We need this data to provide the service you signed up for.

2.2 From Website Visitors (End Users)

When someone visits a website that uses Lynq tracking, we collect:

  • Page information: URL path and query string, page title, referrer URL
  • Device data: Browser type and version, operating system, device type (mobile/desktop/tablet), screen resolution, browser language
  • Location: Country and city, resolved from the IP address as described below
  • Traffic source: Referrer domain, UTM parameters (if present in the URL)
  • Events: Page views, e-commerce actions (product views, cart additions, purchases), and any custom events configured by the website owner
  • Pseudonymous identifiers: A randomly generated visitor ID stored in a first-party cookie, and a session ID stored in browser session storage
  • Diagnostic logs: For six months we keep the raw request body together with the full user-agent string and a hashed IP, so that collection problems can be investigated

2.3 What Our Tracking Script Does Not Do

  • It does not read the contents of forms or input fields. What a visitor types into a page is never sent to us
  • It does not use browser fingerprinting. The visitor ID is a random value, not something derived from the device
  • It does not track visitors across different websites, and it sets no third-party cookies
  • We do not sell, rent or share data with third parties for advertising purposes, and we do not pool data across customers
  • Raw IP addresses are not written to disk. An IP is used in memory to resolve country and city, and only a salted SHA-256 hash is retained

2.4 Personal Data That Can Still Reach Us

We do not seek personal data from end users, but two paths can carry it to us and both are under the website owner's control:

  • URL parameters. The query string is recorded as it appears. A URL such as /thanks?email=someone@example.com would place an email address in our records. During implementation we identify parameters like these and remove them from what is sent
  • Custom event properties. A website owner can attach arbitrary properties to an event. If personal data is placed in those properties, it is stored. Customers are responsible for what they choose to send

The visitor ID is pseudonymous rather than anonymous. Under GDPR it is treated as personal data, and it is handled accordingly throughout this policy.

3. How We Use Data

End user data is used solely to provide analytics reports to the website owner. Specifically:

  • Generating traffic reports (visitor counts, page views, sessions)
  • Showing traffic sources and campaign performance
  • Providing device, browser, and geographic breakdowns
  • E-commerce analytics (product performance, conversion funnels, revenue tracking)
  • Real-time visitor monitoring

We do not use end user data for profiling, advertising, or any purpose other than providing analytics to the website owner.

4. Legal Basis for Processing

4.1 For Customer Data

Contract performance (GDPR Art. 6(1)(b)): Processing your account data is necessary to provide the service.

4.2 For End User Data

Consent is required before our script runs on visitors in the EU and the UK. Our tracking stores a cookie on the visitor's device, and Article 5(3) of the ePrivacy Directive requires consent for that, regardless of how little personal data the cookie contains. Tools that describe themselves as “no consent needed” achieve that by not storing anything persistent; we store a persistent identifier because cross-session attribution is the point of the product, so we do not make that claim.

The website owner is the data controller and is responsible for obtaining that consent. Lynq acts as a processor. During implementation we connect the tracker to the customer's consent management platform so that nothing is collected before permission is given.

Once consent exists, the subsequent analytics processing is carried out on the basis of the website owner's legitimate interest (GDPR Art. 6(1)(f)) in understanding how their site is used. That interest is balanced against end user rights by not building cross-site profiles, not enriching data from outside sources, not using the data for advertising, and deleting it on a fixed schedule.

5. Cookies

Our tracking script uses two first-party cookies:

  • _lynq_id. A randomly generated visitor identifier. Expires after 2 years. Used to distinguish unique visitors.
  • _lynq_attr. Campaign attribution data (traffic source). Expires after 90 days. Used to attribute conversions to the correct marketing channel.

Session data is stored in browser sessionStorage (automatically cleared when the tab is closed).

We do not set any third-party cookies. We do not use cookies for advertising, retargeting, or cross-site tracking.

6. Data Storage and Security

  • Analytics data is stored in ClickHouse (columnar database optimized for analytics)
  • Account data is stored in PostgreSQL
  • All data is hosted on EU-based infrastructure
  • All connections use TLS/HTTPS encryption in transit
  • Passwords are hashed using bcrypt with a cost factor of 12
  • IP addresses are hashed with SHA-256 and a salt that changes every day, and are never stored in raw form. Because the salt changes daily, hashes from different days cannot be linked to each other
  • Database access is restricted to application servers only

7. Data Retention

  • Analytics events: 2 years (configurable by the website owner)
  • Raw event logs: 6 months
  • Error logs: 3 months
  • Account data: Retained while the account is active, deleted within 30 days of account closure

8. Data Sharing

We do not sell data. We share data only in these limited circumstances:

  • With the website owner: Analytics data is accessible to the customer who owns the tracked website
  • Infrastructure providers: Our hosting providers (Railway, ClickHouse Cloud, Neon) process data on our behalf under data processing agreements
  • Legal requirements: If required by law, court order, or regulatory authority

We do not share data with advertising networks, data brokers, or any other third parties.

9. Your Rights

9.1 For Customers

Under GDPR, you have the right to:

  • Access your personal data
  • Correct inaccurate data
  • Delete your account and associated data
  • Export your data in a machine-readable format
  • Object to processing
  • Lodge a complaint with a supervisory authority

To exercise these rights, contact privacy@lynq.studio.

9.2 For Website Visitors

Records about a visitor are keyed to a pseudonymous ID, which means we cannot identify you from a name or an email address alone. We can act on a request when you supply the identifier itself:

  • Read the value of the _lynq_id cookie in your browser for the site in question and send it to us. With that value we can locate, export or delete the associated records
  • Withdrawing consent through the website's cookie banner stops further collection
  • Deleting the _lynq_id and _lynq_attr cookies ends the link between your browser and any past records. Later visits start as a new, unconnected visitor
  • Browser privacy settings and content blockers can be used to prevent collection entirely

Requests are usually directed to the website owner, who is the controller of the data. We act on their instruction and will support any request they pass on to us.

10. International Transfers

All data processing occurs within the European Union. We do not transfer personal data outside the EU/EEA unless required by a customer's specific configuration and with appropriate safeguards in place (Standard Contractual Clauses).

11. Children

Our service is not directed at children under 16. We do not knowingly collect data from children.

12. Changes to This Policy

We may update this policy from time to time. Material changes will be communicated via email to registered customers. The “last updated” date at the top indicates the most recent revision.

13. Contact

For privacy-related inquiries: