Privacy.
No drama.

Lyba is operated by Ovalay Digital Limited, a company registered in England and Wales. References to “we,” “us,” or “Lyba” mean Ovalay Digital Limited. For privacy matters we are the data controller. Reach us at review@lyba.io.

Each processing purpose is tied to a lawful basis under UK GDPR and EU GDPR (Article 6):

• ■Contract. Running the service you or your agency signed up for — accounts, billing, projects, sessions, comments, approvals, integrations you connect.
• ■Legitimate interests. Capturing approval evidence (IP, user-agent, timestamp) to make sign-off legally durable; classifying comments into draft proposals so studios can act faster; logging Edge Function metadata to keep the platform up.
• ■Legal obligation. Retaining billing records for UK tax and accounting law.
• ■Consent. Optional marketing email (which we do not currently send) and any future processing that requires it. You can withdraw consent at any time.

Your primary database lives in the EU (Frankfurt). Some sub-processors — Stripe, OpenRouter, Linear, Slack, and parts of Vercel’s edge — are based in or transfer data to the United States. Where personal data leaves the UK or EEA we rely on the UK International Data Transfer Addendum, the EU Standard Contractual Clauses, or an adequacy decision, depending on the recipient.

UK and EU residents have the rights below. To exercise any of them, email review@lyba.io. We respond within one month. We may ask for proof of identity. There is no fee unless a request is manifestly unfounded or excessive.

• / Access

  Get a copy of the personal data we hold about you.

• / Rectification

  Correct anything inaccurate or incomplete.

• / Erasure

  Delete your account and associated data, subject to the retention notes below.

• / Portability

  Receive your project, session, and comment data in a structured, machine-readable format.

• / Restriction & objection

  Limit or object to certain processing, including AI classification.

• / Withdraw consent

  Where processing is based on consent, you can withdraw it without affecting prior processing.

• / Complain

  Lodge a complaint with the UK Information Commissioner's Office (ico.org.uk) or your local supervisory authority.

Erasure does not extend to approval records during their 7-year legal retention period, or to billing records required by HMRC.

• ■Passwords, API keys, and licence keys are stored as bcrypt hashes. Plaintext exists only at the moment of creation and is shown to you once.
• ■Integration tokens (Linear, Slack) are encrypted at rest with a symmetric key held inside the database. The key never crosses into application memory in plaintext.
• ■All transport is TLS. Row-Level Security is enabled on every table as defence in depth; authorisation is enforced inside Edge Functions.
• ■Review and approval JWTs are short-lived (30 minutes for redirects, 72 hours for plugin deep-links, 168 hours for approval links) and signed with secrets we rotate.
• ■We will notify you and, where required, the ICO within 72 hours of becoming aware of a personal data breach that is likely to result in risk to your rights.

We will post any material change here and update the effective date. Where the change affects you and we have your email, we will tell you directly before it takes effect.