Privacy Policy

Last updated: 5 October 2026

Lyxter ("we", "us") provides an AI diagnostic assistant for heavy-vehicle companies at app.lyxter.ai. This policy explains what personal data we process, why, and what rights you have. It is written to comply with the EU General Data Protection Regulation (GDPR).

1. Who is responsible

The data controller is Lyxter ApS (CVR 46627571), Bjergegade 58, 6870 Ølgod, Denmark. Contact: hello@lyxter.ai.

One category of data is different: the records your company keeps about its own customers - under Customers, or when Service records work for one of them - the names, contact details, and vehicle information you enter about those customers are your company's data, not ours. For that data Lyxter acts only as a processor, on your instructions, and your company is the controller - see section 6 for the data processing agreement.

2. What we collect

• Account data - your name, work email, and company name. The account owner, or an admin they appoint, can also add the company's brand logo, address, VAT/CVR number, and phone number, which are printed on the service reports your company produces. The logo is stored privately to your company account and is never shown to any other Lyxter customer. Passwords are stored only as secure hashes by our authentication provider; we never see them.
• Display preferences - the interface language you choose. It is stored with your membership, used only to decide which language the interface is shown in, and never shared.
• Chat content - the fault codes, questions, messages, and screenshots you submit to the AI, and the answers you receive. Chats are private to your company account. So that the AI can pick up work your company has already done, it can search your company's own earlier chats and is shown a short extract of the few that match this one: the date, the machine as it was recorded, the fault codes, the first thing the mechanic asked, any diagnosis that chat reached, and the mechanic's last message there. A chat is matched when it is about the same vehicle you have linked from Fleet, or when it shares a fault code with this one. This covers your company's whole history of chats, not only recent ones, and it includes chats with no fault code at all - a "won't start" job or a how-to question is work your workshop did, and the point is that the AI can recall it. To find them, we keep for each chat a technical search entry holding its fault-code search keys, a numerical representation (an embedding) of what it was about, the date, and two markers saying how many messages you wrote and whether the AI reached a diagnosis. That entry holds no text from the conversation: the extract above is read from the chat itself each time, so nothing extra about what was said is stored to produce it. All of it stays inside your company account, is never shown to another company, and the search entry is deleted the moment its chat is deleted.
  
  Voice input. You can speak a message instead of typing it. The recording is sent to our AI provider to be turned into text, and that text is placed in your message box for you to read, edit and send yourself - nothing is sent automatically, and no audio file is ever attached to the chat or stored with it. Lyxter does not keep the recording: it is held in memory only for as long as the conversion takes, is never written to our database or file storage, and is discarded as soon as the text comes back. Only the message you choose to send is kept, exactly as a typed one is. One thing we will not overstate: our AI provider's standard terms let it keep material sent to its interface for a short period for abuse monitoring, so while Lyxter keeps nothing, we cannot yet say the recording is kept nowhere at all. To turn your speech into text accurately, the app also sends the make, model and model year of the machine the chat is about, when it knows them. Nothing else about you, your company or a customer is sent with a recording, and the words you have typed in the chat are not sent with it either. The microphone is used only while you are recording, and only after your browser has asked you.
• Machine details - the make, model, model year and vehicle type of the machine a chat is about, whether you type them into the chat's "Which machine?" panel, they come from a vehicle you linked from Fleet, the AI reads them off a photo you send, or Lyxter picks the make, model and model year out of what you write in the chat yourself: it looks for which machine you are working on and nothing else in what you wrote, it works the vehicle type out from that make and model rather than reading it from your words, and anything it fills in that way you can correct or clear in that same "Which machine?" panel. They describe the machine only: we do not ask who owns it. They are stored with the chat, are what let the AI scope its answers to that machine, and are deleted when the chat is deleted. Because a make, model and year describe a machine and not a person, they may also be recorded against a fault code in the shared knowledge base described in section 4, where they never appear beside anything identifying you, your company, or a customer.
• Your company's own case records - when a chat is a real diagnostic case (it carries a fault code, or the AI assessed it as critical or a warning), Lyxter records what that case turned out to be: the fault codes, the machine as it was described, a one-line diagnosed cause, the reported symptom, and the fix. All of it is written by the AI from the conversation, and the cause, symptom and fix text passes the same automatic scrubbing step in our software described in section 4 before it is stored. The fault codes themselves are not scrubbed: a fault code is a technical code, and long codes look like phone numbers to an automatic scrubber. The AI searches these records in later chats at your company, so it can tell you when your workshop has seen the same fault before, whether or not the chat is linked to one of your vehicles. This record is private to your company account, is never shown to another company, is never placed in the shared knowledge base described in section 4, and there is no route by which it can become shared. If you delete a chat, its case record is deleted with it.
• Fleet vehicle records - if you use Fleet, we store one record for each machine you add, including the name you give it, its make, model, model year, its registration plate, and any free-text specification note you add on the same form. You decide which of those to fill in. The record also holds the odometer and engine hour readings you log, whether you enter them directly or they are recorded when a service is completed, the status colour your team sets, and a short profile of the machine that the AI writes from the make, model, year and your specification note and keeps on the record. In chats linked to that vehicle, the AI reads the record back - the identity fields, the odometer and engine hour readings, the status, that profile, and whether the machine is your workshop's own or belongs to one of your customers (that last as a flag only: which customer it belongs to is never shown to the AI) - so its answers fit that exact machine. The record is private to your company account and is never shown to another company. It is what your vehicle page, its history and its service plans are built from, and the registration plate is printed on the service report your company hands its own customer. If you delete the vehicle, the record is deleted with it.
• Vehicle service history - when a chat is linked to one of your vehicles and raises an issue, Lyxter records what that case turned out to be on the vehicle's own history: the fault codes it carried, a one-line diagnosed cause, and the fix. All three are written by the AI from the conversation, and the AI reads them back in later chats about the same machine, which is how it can tell you what has happened to that vehicle before. This record is private to your company, is never placed in the shared knowledge base described in section 4, and the cause and fix text passes the same automatic scrubbing step in our software described there before it is stored. The fault codes themselves are not scrubbed: a fault code is a technical code, and long codes look like phone numbers to an automatic scrubber.
• Service checklists - if you use Service, we store each service or inspection job your team carries out: the checklist copied from its template, and for every point the result your team records - a tick, a measurement with its limit, or a note - together with who recorded it and when, the machine's odometer and engine hour reading at the time, and the job's title and dates. It is what the vehicle's service history and the printed service report are built from. In chats linked to the machine a job was done on, the AI reads the finished jobs back - what was checked, what failed or sat at a limit, and the measurements and notes recorded - so it can use your workshop's own inspection results as evidence instead of asking you to check the same things again. This record is private to your company account, is never shown to any other Lyxter customer, and is never placed in the shared knowledge base described in section 4. Deleting the service deletes its checklist and report.
• Uploaded manuals - documents your company chooses to upload. If your company's owner shares one with other workshops (section 4), we also record their answer to who wrote it, and when and by which user it was shared.
• Customer records - the customer name, contact person, phone, email, address, VAT/CVR number and notes your team enters under Customers, or on a Service job for a customer's vehicle rather than your own fleet. A machine in your fleet can be marked as belonging to one of those customers. This data belongs to your company; we process it as a processor, not a controller (section 1). It is never shared with any other Lyxter customer and never used to train or improve our AI.
• Priced work documents and invoices - the hours, parts and extras your team records for one machine, each with its description, quantity, unit price and any discount, plus the VAT rate and the totals our software works out from them. A document can be linked to one of your customer records and to a service job. It stays private to your company account, is never shown to any other Lyxter customer, and is never placed in the shared knowledge base described in section 4 or used to train any AI model. In chats linked to the machine a document is about, once it has been turned into an invoice or posted to the machine's costs, the AI reads back the descriptions and quantities of its lines - what was fitted or done, and when - and never the prices, the discounts or the totals, and never a draft.
  When your team turns a document into an invoice, we additionally store the invoice number, its date and due date, and a copy of your company's own details and your customer's name, address, contact details and VAT/CVR number as they stood at that moment - so the invoice still reads correctly years later, and still reads correctly if the customer record is edited or deleted afterwards. Your team can then email that invoice to the customer. We send it only when someone in your company asks us to and confirms the recipient's address first; we never send one automatically. The mail goes out in your company's name with the invoice PDF attached, through the email provider in section 6, and replies go to your company rather than to us.
• Billing data - the plan, whether it is billed monthly or yearly, subscription status, seat count, and invoices, handled by Stripe. Card numbers never touch our systems.
• Diagnostics count - a plan can include a monthly allowance of diagnostics (Terms of Service, section 4), so we count them. For each chat that counts as a diagnostic we keep one record: the company, the chat, the time, which reply in the chat counted and for which of four fixed reasons (a fault was answered, a cause was named, a fault code was answered, or a search was run), and which user sent the message that reply answered. The record holds no text from the conversation. We keep these records for every company, whether or not its plan has an allowance, because they are also how we measure how the service is used. Our staff can see them (section 5).
  
  Where the app shows your company a diagnostics count - on the billing page, under Settings, in the menu of the web app, and in the iPhone and iPad app - everyone in the company sees the same figures: how many diagnostics have been used, out of how many, and when the count resets. Your company's owner, and nobody else in your company, can also see on the billing page how many diagnostics each person started in the current period, and a list of the chats that were counted: each with its date, the chat's title, the reason it counted and the name of the person. This is there so the owner can understand how the company uses its plan. It is a count and never a limit on any one person, and it shows nothing of what a chat said. A person who has left the company or deleted their account is shown as a former member, without a name. If you are the owner and an employer, telling your staff that you can see this is your responsibility. When the owner marks a counted chat as not a diagnostic, or our staff do so for your company, we record that it was done, when, and by which user.
  
  Where the allowance is enforced and your company has used it up, a message that would start a new diagnostic is checked before it is answered, so that only a new fault is declined and recording work or looking something up still works. Our own software first looks for a fault code in the message. If it finds none, that one message - at most its first 2,000 characters, and nothing else: not the rest of the conversation, not the machine, not your name or your company - is sent to the AI provider that already receives your messages (section 6), which answers with a single word. Nothing is stored from this check beyond the technical metadata described under Usage data below, and if the check cannot run your message is answered as usual. Chats in which a fault has already been answered are not checked. Where the allowance is enforced we also email the company's owner, once when 80% of it is used and once when all of it is: the mail carries the company name, the counts and the reset date, no chat content and no colleague's name, and goes through the email provider in section 6.
• Usage data - message counts per company (used for fair-use limits), technical metadata about each AI request (which model was used and how many tokens it processed, kept so we can monitor our own costs - never the content of the request), and standard technical logs (IP address, browser type) kept by our hosting provider for security.
• Contact data - if you request a demo or join the launch list, we store the details you submit (name, email, company, message). If you ask us for a price offer, we also keep the offer we prepared for your company - the company name, the contact name and email address you gave us, the plan, the number of seats, the price and how long the offer is valid - and email that offer to the contact you named. We send it only when a member of our staff asks us to and confirms the recipient's address first; we never send one automatically. The mail goes out in our name with the offer PDF attached, through the email provider in section 6, and replies go to the staff member who made the offer. The offer is also recorded on your company's record in the CRM listed in section 6. Every offer carries a link to accept it online. Opening that link shows you the offer, and nothing about it is sent anywhere until you accept. When you accept, we record the name and job title you give, the time, and the IP address you accepted from, as the record that your company agreed to the offer, together with the invoicing details you confirm: the company's legal name, address, country and VAT number, the email address invoices should go to, and a purchase-order number or an EAN number if you give one. If you choose to pay by card or by invoice, those invoicing details, the purchase-order number and the offer reference are handed to our payment provider in section 6, which registers your company as its customer, takes the card payment or issues the invoices and emails them to that address. Card numbers never touch our systems. If you choose an e-invoice to an EAN number, nothing is handed to the payment provider: a member of our staff confirms the acceptance and the e-invoice is issued separately. We keep a copy of each invoice's number, amounts, due date and payment status as the payment provider reports them, so our staff can see what has been paid; a payment by bank transfer is marked paid by a member of our staff. We also send our staff one notice when an offer is accepted online.

Cookies and local storage. We do not use advertising, analytics, or tracking cookies of any kind. Everything we store in your browser or in the iPhone and iPad app is strictly necessary for features you ask for, which is why Lyxter shows no cookie consent banner. The complete list:

• Login cookies - two cookies (sb-access-token, about 1 hour, and sb-refresh-token, up to 30 days) keep you signed in. They are httpOnly, are never readable by page scripts, and are deleted when you log out.
• Session marker - one readable cookie (lx-session-mark, up to 30 days) and one value in your browser's local storage (lx-session-epoch) let a page tell that the session it was drawn for has ended, so pressing Back after signing out cannot bring a previous user's screen back from the browser's history cache. The marker is a one-way hash: it carries no name, email, or account identifier, and it grants no access on its own. The cookie is deleted when you log out.
• Sign-in on iPhone and iPad - in the iPhone and iPad app, your sign-in is kept as a token in the device's own Keychain, readable only after the device has been unlocked once, and removed when you log out.
• Sign-out note on iPhone and iPad - if logging out in the app cleared your sign-in from the device but could not reach our servers to end the session there, the app keeps one yes/no value in its own settings storage so the sign-in screen can tell you. It carries no name, email, or token, and it is removed at your next successful sign-in.
• Preferences - your chosen theme (light/dark), price currency (EUR/DKK), the plan you were looking at before you signed up and, where yearly billing is offered, the billing period you picked (monthly or yearly) are kept in your browser's local storage so the choice survives a reload and the billing page opens on the plan and period you picked. They are display preferences only: not an account identifier and not a record that you bought anything. In the iPhone and iPad app, the appearance you choose (follow the device, light or dark) is kept in the app's own settings storage for the same reason. They stay on your device and are not sent to us or anyone else.
• In-app hand-offs - navigating from the fleet page to a chat briefly stores the vehicle reference in local storage; it is removed as soon as the chat opens.

Our pages load no third-party scripts; fonts are hosted by us. There is one third-party request, and only inside a chat: where an answer drew on a web source, your browser loads that source site's small icon from the site itself. It is described in section 4. Content served by our own providers (section 6), such as your uploaded photos, is not a third-party request: those providers act only on our instructions.

3. Why we process it (legal bases)

• To provide the service (contract, art. 6(1)(b)) - accounts, chats, AI answers, manuals, billing, support.
• To keep the service secure and improve it (legitimate interest, art. 6(1)(f)) - security logs, abuse prevention, aggregated usage statistics.
• To contact you about the launch or a demo (consent, art. 6(1)(a)) - you can withdraw at any time by emailing us.

4. AI processing and the shared knowledge base

Your messages are processed by AI models (see subprocessors below) to generate answers. Lyxter learns from chats, but we never train the AI model itself on your data: your chats are not used to train or fine-tune any AI model.

What the system learns goes into a shared knowledge base of fault codes and repair guidance that improves answers for every company. It holds structured data only, never your raw conversation text:

• Fault codes - when the AI answers a fault code it has not seen before, we may store the code, the vehicle brand, model and model year, and a short AI-generated description.
• Fixes and technical lessons - after a completed diagnosis, the AI may write a short fix summary, and a general technical lesson (for example how a system behaves or a diagnostic-tool procedure). These are AI-written to contain no customer-specific details, and each new summary and lesson learned from a chat also passes an automatic scrubbing step in our software before it is stored: it strips out the emails, phone numbers, number plates, vehicle identification numbers, and other long identification numbers it finds, and runs an automated check for names, companies, and locations. This step runs in code, independent of the AI. Technical lessons are additionally reviewed by Lyxter staff before the AI can use them at all; fix summaries follow the sharing rule at the end of this list before any other company sees them.
• Fix outcomes - when a mechanic reports whether a suggested fix worked (worked, did not work, or partly), we store that answer as a simple report with no free text. Only the resulting counts ("worked for 4 of 5 reports") are shared with other companies.
• When it reaches other companies - a fault-code description or fix summary learned from your chat is used in your own company's diagnoses straight away, but it is shared with other companies only once Lyxter staff have reviewed and approved it, or when it restates knowledge Lyxter had already approved (an approved manual, or an approved fix for the same fault code and brand). An entry staff reject is used nowhere, including for your own company.
• Keeping it in your company - your company's owner can switch sharing off in Settings, under Company (Lyxter staff can also set it for you, for example under an Enterprise agreement). From then on nothing learned from your company's chats reaches another company: fault-code descriptions and fix summaries stay in your own company's diagnoses and are never shared, no technical lesson is proposed from your chats, and your mechanics' reports on whether a fix worked count only toward your own company's unshared entries, never toward the counts other companies see. Your own company's AI keeps learning from your chats exactly as before. Anything shared before the switch was turned off stays shared, and the switch does not change how manuals you upload are handled (below).

Your own words, chat text, and images are never placed in the shared knowledge base, and neither is anything that identifies you, your colleagues, or your company.

Your company's own earlier chats, its own case records, and the chat search entries that find them (all described in section 2) are not part of this shared knowledge base and there is no route by which they can become part of it. They are used only in your own company's chats. What an earlier chat of yours said is also never treated as a checked answer: the AI is told plainly that nothing said in an earlier chat was reviewed, that it may have been wrong, and that it may never be used as the source of what a fault code means or of a torque, pressure, clearance, capacity or service interval. Recalling one also never stops the AI from looking a fault code up properly.

When Lyxter cannot answer from its own reviewed knowledge base, your company's manuals or the machine's own history, it may look the machine up on the public web. The search runs through the same AI provider that already answers your questions (listed in section 6), which searches the web on Lyxter's behalf using its own search partner. An entry learned from your own chats that Lyxter staff have not reviewed yet does not count as an answer here: it is still used in your own company's chats, and where Lyxter reads its review state it tells the AI the entry is unreviewed, but it does not hold the lookup back, so an unchecked note in your own account is not left standing as the meaning of a fault code. When your chat carries a fault code that no reviewed Lyxter source describes, this lookup normally runs automatically as the chat starts, or when the machine is first identified, before the AI writes anything, so that its answer rests on a source rather than on what it happens to remember. Nothing about what may be sent changes when it runs that way: it is the same wording, built the same way, described below. Your message is never sent. The search wording is built by the software itself, out of a fixed, short list of technical fields and nothing else: the machine brand (only when it is one of the brands Lyxter knows by name), the model (when it is a model name on Lyxter's own list of known models, such as "Sprinter", "Actros" or "MiTo", when it is the model the app already holds for that machine, or when it has the shape of a designation, such as "WA380" or "TCD 7.8"), the engine designation (on that list or of that shape), the model year from your fleet record, the fault code recorded on the case (only when it has the shape of a diagnostic code - and where the code was typed inside a longer line, only the part of that line that has the shape of a diagnostic code, taken word for word and never rewritten), a few plain English technical words naming the part or system, and one of four fixed phrases saying what kind of answer is wanted. Anything that fails one of those tests is left out, and the words naming the part are additionally checked in software for personal details and rejected if any are found. A model name that meets none of those three tests can still be sent, but only after a separate check by the AI provider already named in section 6 - which is shown that name and the brand above and nothing else - has confirmed it is a model designation and not a person's name, a place or a plain number; that check runs inside the app, before any search, and reaches no search provider.

So your message, a description of a symptom, your photos, your files, and anything naming you, your company, your customer, a place or a registration number are never sent to a search provider. The one thing that can overlap with what you wrote is an ordinary technical word: if you write that an injector is leaking, the word "injector" can be part of what is looked up. Lyxter states this precisely rather than promising more than the software checks.

This is enforced by how the search is made, not only by what is put into it. The lookup runs as a separate request whose entire content is that one built search wording: the part of the AI that does the searching is never given your conversation, your photos, your vehicle record or your customer record at all, so it cannot pass on something it was never shown.

The search may read any site the search provider reaches - a manufacturer's own site, a technical reference, a forum, a manual-hosting or document-sharing site - including pages nobody at Lyxter has read. Lyxter keeps a short list of manufacturer and technical reference sites its staff have read; it uses that list to put those sites first when it orders what came back, and it can limit a search to that list, but it makes no promise that any search was limited that way. Treat every page as unverified whichever site it came from, as described next.

No account, no name and no address goes with the search, and it is not told who is asking: the request is made by Lyxter's own servers, so your device never contacts the search provider and your IP address is never sent to it. Lyxter treats what comes back as unverified: the answer itself does not name the site it drew on, because the app attaches the sources to the answer for you - a small chip under the reply that opens each source's site and page title. A chip on a reply means one of the sources found named what the case is about - the fault code, where the lookup ran automatically off the code, or the machine itself, where the AI asked for the lookup while answering; the app holds the chip back where it can tell that none of them does. No chip means only that no source was shown on that reply: it is not a statement that nothing was looked up, nor that no page behind the answer could have been about another machine. The AI must never state a torque figure, a pressure, a clearance or a service interval on the strength of a web result.

That chip is the one place your own device does reach out: to show each source's site icon, your browser loads that icon from the source site itself, so those sites can see your IP address and browser type at that moment, the way they would if you opened the page. Nothing else goes with it - no account, no name, nothing from your chat, and the request deliberately carries no referrer, so the site is not told which app or page the icon was shown in. When an icon cannot be loaded, a plain letter is shown instead. Opening a source from the chip is an ordinary visit to that site, under that site's own privacy terms.

Manuals uploaded by your company stay private to your company: once a manual's pages have been read, the AI uses it in your company's own chats, without waiting for Lyxter staff to review it, and the AI is told when a manual has not been checked by Lyxter. A document goes further only if your company's owner chooses to share it with other workshops from the Manuals page, and only after answering who wrote it - your company, its maker (who publishes it for anyone to share), or someone whose licence lets your company share it. A document whose author is not known cannot be shared. Lyxter staff never share a document for your company. A shared document reaches other companies only after Lyxter staff have reviewed and approved it: the AI then reads its text in other companies' chats, but no other company can open or search the file itself, and your owner can stop sharing it at any time. When a shared document reaches other companies, the AI may write a small number of short technical lessons from it for the shared knowledge base described above; each lesson is reviewed before the AI can use it, is written in the AI's own words rather than copied from the document, and passes the same automatic scrubbing step in our software as a lesson learned from a chat before it is stored, so it contains nothing identifying you or your company. Lessons already written stay in the shared knowledge base if the document is later taken back. See the Terms of Service for what may be shared.

5. Staff access and quality assurance

A small number of Lyxter staff can view customer chats and account data when needed to provide support, review the quality and safety of AI answers, and investigate problems. Staff access to customer data is read-only, and every access is recorded in an internal log: who looked at what, and when. While a learned knowledge entry is still waiting for that review it also shows those staff which user and which chat it came from - staff-only, logged like any other access, private to your company until the entry is approved, and cleared from the entry once it is approved and shared.

To test the AI before changes go live, we may turn a real diagnostic case into an internal test scenario. Before that happens, identifying details (names, company names, email addresses, phone numbers, number plates and similar) are removed, the cleaned text is reviewed by staff, and images are never included. Internal usage and cost figures are aggregated counts and contain no chat content.

6. Service providers

We use a small number of carefully selected service providers (processors) to run Lyxter. Where a provider processes data outside the EU/EEA, the transfer is protected by the EU Standard Contractual Clauses and, where applicable, the EU-US Data Privacy Framework.

Category	Purpose	Location
Database and authentication	Storing accounts, chats, and documents	EU (Ireland)
Application hosting	Running the service	EU
AI model providers	Generating answers, reading images, turning a voice message you record into text, checking whether a message starts a new fault once a company has used its diagnostics allowance (section 2), and - when the wider web lookup in section 4 is switched on for your account - searching the public web on Lyxter's behalf	USA
Payment processor	Subscriptions and invoicing, including - when a company accepts a price offer by card or by invoice - the company's legal name, address, country, VAT number, invoice email address, purchase-order number and the offer reference	EU/USA
Email delivery	Transactional email (confirmations, invites, service reminders, a notice to a company's owner about its diagnostics allowance), an invoice your company chooses to send to one of its own customers - which carries that customer's name and address and the priced lines of the work - and a price offer we send to a prospective customer's contact at their request, which carries that contact's name and email address and the plan, seats and price offered	USA
Customer relationship management (CRM)	Managing customer and prospect accounts: company name, plan and billing status, the name and work email of the people on the account, any price offer we have made (plan, seats, price and validity), and simple activity counts such as how many diagnoses a user has run, when they were last active, and how many diagnostics the company has used in the month. No chat content, no photos, no vehicle or service records.	EU/USA
Network and DNS security	Traffic routing and protection	EU/global

The wider web lookup described in section 4 adds no new provider to this list. It runs through the AI model provider already named in it, which uses its own search partner to fetch the pages; that partner receives only the built technical search wording described in section 4, and never your message, your photos or anything naming you or your customer.

Business customers can request the named list of providers as part of a data processing agreement by writing to hello@lyxter.ai. If your company records customer data (section 2), that agreement is what makes the controller/processor relationship in section 1 formal - write to us before you enter your first customer record if you need it in place first.

7. How long we keep data

• Account and chat data: for as long as your company has an account, then deleted on request or after account deletion. A single chat can also be deleted at any time from inside the app, by anyone in your company: the conversation and the photos and files attached to it are removed straight away and cannot be restored. The case record described in section 2 goes with it. Three things deliberately survive it: the vehicle's own service history entry, which keeps that case's fault codes, its one-line diagnosis and the recorded fix so the machine's record stays complete, which stays private to your company, and whose diagnosis and fix text has already passed the scrubbing step described in section 2; the knowledge-base entries described in section 4, which are stripped of identifying details before they are stored; and anything you chose to save to Manuals from the chat, which stays in your company's library. Nothing else from the conversation is kept. The diagnostics record below also stays, without its link to the chat; it holds nothing from the conversation.
• Your company's own case records: for as long as your company has an account, then deleted on request or after account deletion. A single case record is also deleted the moment the chat it was written from is deleted, as above.
• The chat search entries described in section 2: for as long as the chat itself exists. Each one is deleted with its chat, automatically and at the same moment, and they hold no text from the conversation - so a deleted chat leaves no searchable trace of what was said in it.
• Customer records: for as long as your company has an account, then deleted on request or after account deletion. Your company can also delete one at any time under Customers; that removes the customer record only - the machines stay in the fleet with their history, and a service report already produced keeps the details it was printed with. Because your company is the controller for this data (section 1), how long it is kept beyond that is your company's decision, not ours.
• Priced work documents: for as long as your company has an account, then deleted on request or after account deletion. Anyone in your company can delete a DRAFT from inside the app; it and its lines go for the whole company and cannot be restored. Deleting a customer, a machine or a service job does NOT delete a document raised against it: the document keeps its own figures and simply stops naming the record that is gone. Once a document has been turned into an invoice it can no longer be edited or deleted in the app - it is a bookkeeping record, and the copy of your customer's details described in section 2 is part of what makes it one. Because your company is the controller for that customer data (section 1), how long the invoice is kept is your company's decision and your company's bookkeeping obligation, not ours; account deletion removes it with everything else.
• The diagnostics count described in section 2: for as long as your company has an account, and deleted with it when the company account is deleted. A record outlives the chat it counted: deleting a chat removes the record's link to the chat but not the record, because the diagnostic was used and deleting a chat does not give it back. When one person deletes their own account, the records of the diagnostics they started stay with the company as a count, with the link to the person removed.
• Billing records: as required by Danish bookkeeping law (5 years). This is the one thing an account deletion does not remove.
• Fixes reviewed into the shared knowledge base: kept after account deletion. Names, companies, contact details and locations are stripped before anything is shared (section 4), so what remains identifies neither you nor your company.
• A departed team member's chats: when one person deletes their own account (section 8), the chats, service records and documents they wrote stay in their company's account, because they are the company's own service history and the company is the controller for it (section 1) - with the link to the person removed, so nothing in them says who wrote them. Their sign-in, name and email address are deleted with the account.
• Deletion audit record: when an account is deleted we keep a minimal record that it was - which kind of deletion (a whole company, or one person), the date, the company name, our internal reference ids and, for a company account, counts of how much was removed; and when our staff carry one out by hand, which staff member did. We keep it for security and accountability. It holds none of the erased content and no name or email address: the address a deletion was confirmed from is removed from the record the moment the confirmation email has been sent.
• Launch-list and demo-request contacts: until launch communication is done or you ask us to remove you.

8. Your rights

You can ask us to access, correct, export, or delete your personal data, and to restrict or object to processing. Write to hello@lyxter.ai - we respond within 30 days.

You can delete your account yourself, from inside the app, without contacting anyone: under Settings, You, Delete account, or on our public account deletion page, which works whether or not you still have the app installed. You confirm by typing the name of what is being deleted, the deletion is scheduled for 7 days later and carried out automatically on that day, and you can withdraw it from the same page at any time until then. We email you when it is done. Whatever happens, it is completed within 30 days. Two kinds:

• A team member deletes their own account: their sign-in, name and email address go, and the invitation that brought them into the company. The company's own records they wrote - chats, service records, documents - stay with the company, without their name (section 7).
• The company owner deletes the company account: every user account in it, its chats, vehicles, service history, uploaded manuals, customer records, documents and the Stripe customer record. There is one owner per company and no way to hand ownership on, so the owner deleting their own account is the company deletion, and the app says so before they confirm.

The deletion page lists exactly what is deleted and the little we have to keep (section 7). One of those things is a minimal record of the deletion itself - the kind, the date, the company name, reference ids and counts of what was removed - kept so the erasure can be accounted for afterwards; it names nobody. If you can no longer log in, write to hello@lyxter.ai from the address on your account and we will carry it out by hand.

Customer records are the exception: if you are a workshop's customer and want to access, correct, or delete what that workshop has recorded about you, ask the workshop directly. They are the controller for that data, not us (section 1); we only act on their instructions and will pass such a request on to them.

If you are unhappy with how we handle your data, you can complain to the Danish Data Protection Agency (Datatilsynet, datatilsynet.dk).

9. Changes

We will update this policy as the service evolves and note the date above. Significant changes will be announced to account owners by email.

Terms of Service · Log in · lyxter.ai