This Privacy Policy explains how Digital Studio USA LLC (“Lylu”) collects, uses, and shares personal data. It covers two distinct categories: (a) data about our customers (account holders who use Lylu), and (b) lead data — business-contact information that Lylu aggregates from publicly available sources and makes available through the Service. Our roles differ for each (see “Our roles”).
Our roles (controller)
We act as a controller for the personal data we process: both customer account data and the business-contact lead data we aggregate from publicly available sources and make available through the Service. We determine the purposes and means of that processing. Where you upload your own contacts or instruct us to process data solely on your behalf, we act as your processor for that data.
Data we collect
- Account data: name, email, company, and authentication data (via Clerk).
- Billing data: subscription and payment metadata (processed by Stripe; we do not store full card numbers).
- Usage data: log data, device/browser data, and feature usage.
- Lead data (our aggregated dataset): business names, addresses, phone numbers, websites, ratings, social profiles, job titles, and business email addresses, aggregated from publicly available business listings and third-party enrichment and verification providers.
How we use data
- To provide, operate, secure, and improve the Service.
- To process payments and manage subscriptions.
- To generate outreach drafts using AI providers (OpenAI, Anthropic) based on customer instructions.
- To communicate with customers about their account and the Service.
- Where the GDPR/UK GDPR applies, we rely on the following lawful bases (Art. 6): performance of a contract (operating accounts and processing payments); legitimate interests(securing, maintaining, and improving the Service, and processing business-contact lead data for B2B outreach, balanced against data-subject rights); consent (where required, e.g. for non-essential cookies); and compliance with legal obligations (e.g. tax and accounting records).
Sharing & subprocessors
We share data with the third-party providers listed on our Subprocessors page, who process it on our behalf under contract. We do not sell or share personal information as those terms are defined under the CCPA/CPRA, and we do not disclose personal data to third parties for their own marketing or cross-context behavioral advertising.
International transfers
Data may be processed in the United States and other countries where we or our subprocessors operate. Where we transfer personal data of individuals in the EEA, UK, or Switzerland to a country without an adequacy decision, we rely on the European Commission’s Standard Contractual Clauses (and the UK International Data Transfer Addendum where applicable), together with supplementary measures as needed.
Retention
We retain account data for the life of the account and, after account closure, for up to 7 years to the extent needed to meet tax, accounting, and other legal obligations and to resolve disputes. Lead data that forms part of our aggregated dataset is retained by Lylu as part of that dataset; data you upload yourself is deleted within 30 days of account deletion. Usage and log data is retained for up to 12 months. We may retain limited records longer where required by law or to enforce our agreements.
Your rights
Depending on your location, you may have rights to access, correct, delete, or port your data, and to object to or restrict processing (GDPR), or to opt out of sale/sharing and limit use of sensitive data (CCPA/CPRA). Individuals whose business-contact data appears in our aggregated lead dataset may contact us at support@lylu.ai to request access, correction, or removal, and we will respond within 30 days. For data uploaded by a customer, contact that customer, who controls it.
Cookies
See our Cookie Policy for details on cookies and similar technologies.
Contact
Controller: Digital Studio USA LLC (a limited liability company registered in the United States). Privacy contact: support@lylu.ai. We have not appointed an EU/UK Article 27 representative; if and when our processing requires one, we will appoint a representative and update this policy.