Privacy notice
1. Who we are
This notice is given by Byron Advisory Limited, trading as LINATL (company number 13184834, 27 Southwood Avenue, London N6 5SA, United Kingdom), the publisher of LINATL lightsurface (the software) and the operator of lightsurface.app. We are the controller of the personal data described here. For anything about privacy, email support@linatl.com.
2. The short version
- The software runs on your own device, and your documents stay there. We do not have a copy of them.
- Document text leaves your device in only two cases: when you run a cloud sort on your subscription's included allowance, it passes through our relay to our AI provider, Anthropic; and when you use your own AI key, it goes directly from your device to the provider you chose.
- We do not sell personal data, show advertising, or train AI models on your documents.
- The software keeps a record on your device of each transmission it makes, without the document text itself, which you can read under dashboard › audit.
3. What we handle, and why
a. When you buy. Our reseller Paddle sells you the subscription and handles your payment as an independent controller, under its own privacy notice. Paddle passes us your name, email address, billing country, plan and the status of your subscription. We do not receive your card details. We use this data to issue and email your licence, to answer support requests, to process cancellations and refunds, and to keep accounts. Basis: performance of our contract with you; legal obligation (accounting records).
b. Licence activation. When you activate the software and at each launch, it sends our relay server your licence's seat identifier, a one-way (salted and hashed) fingerprint of your device, the software version and the type of operating system. We use these to check the licence, enforce the device limit and allow one free trial per device. Our relay keeps your seat's plan, status, billing country and the device fingerprints. Basis: performance of our contract; our legitimate interest in preventing licence misuse.
c. Cloud sorting. When you run a cloud sort, the text of the documents in that run passes through our relay to our AI provider, Anthropic, which returns the result. Our relay does not store the text. It records only how much compute each call used, so the monthly allowance can be counted. Anthropic processes the text on our behalf under its commercial terms and data processing addendum. Those terms do not allow it to train models on the text. It deletes the text within the periods its terms set (currently 30 days, or up to two years if its safety systems flag it under its Usage Policy). You can avoid cloud sorting altogether by using a local model or the software's non-AI features. Basis: performance of our contract, at your request. If your documents contain other people's personal data, you decide whether to send them, and you are responsible for having a basis to do so.
d. Your own AI key. If you enter your own key for an AI provider, prompts and documents you send with it go directly from your device to that provider, under your own agreement with it. They do not pass through us. The key is stored in your operating system's secure store (macOS Keychain or Windows DPAPI) and is never sent to us. The software counts these calls and tokens on your device and, if usage sharing is on (e), includes the counts in the weekly report.
e. Usage sharing. To find and fix problems in the software, it can send a weekly report containing measurements, never content: the class of device, the size of your library in broad bands, how much of it has searchable text, timings, where in the software faults occurred, whether it closed cleanly, and the number of calls and tokens used on your own AI keys, by provider and model. The same report may be sent when the software flags one of its own performance measures as needing attention. You can preview the exact report and switch it off under models › privacy.
- In the UK and outside the EEA, usage sharing is on unless you switch it off. Basis: our legitimate interest in keeping the software working and improving it (UK GDPR Article 6(1)(f)); the report is collected for statistical purposes, to improve the software, with a simple free means of objecting (the switch), under paragraph 5 of Schedule A1 to the Privacy and Electronic Communications Regulations.
- In the EEA, or where your region is not yet known, it is off until you tick the box on the start page. Basis: consent, which you can withdraw at any time.
f. Fault reports. After the software closes unexpectedly, it asks whether to send a report of where it failed, with the device class. You can send it once, always, or not at all. Basis: consent.
g. Support. If you email us, we keep your email and our reply. If we ask for a diagnostics package, you create it yourself and attach it: it holds the software's log for the last day (with file paths and names removed), a week of its performance measures, the device class and your seat. If you choose, it also holds the record of files moved to the software's trash, and from it to your system trash, in the last 90 days, with their names. It does not include document contents. Basis: our legitimate interest in answering you, and performance of our contract.
h. Security logs. Our relay logs each request it receives: IP address, country, seat identifier, the service requested, the result, timing and user agent. We use this for security monitoring and to investigate incidents. Basis: our legitimate interest in keeping the service secure.
i. This website. lightsurface.app is delivered by Cloudflare, which processes visitors' IP addresses to deliver the site and protect it from attack.
4. Who receives data
| recipient | role | what | where |
|---|---|---|---|
| Paddle | reseller, independent controller | your purchase and payment | UK, Ireland, US |
| Anthropic | our processor | document text of a cloud sort | United States |
| Render | our processor (hosts the relay) | licence, usage and log data (b, c, e, f, h) | Frankfurt, Germany |
| Cloudflare | our processor | network traffic, including IP addresses | global network |
| Fastmail | our processor | support email | Australia (company); servers in the United States |
We may also disclose data where the law requires it, or to a buyer of our business, who would be bound by this notice.
5. International transfers
Where personal data leaves the UK or the EEA, it is protected as follows:
- Anthropic (United States): the EU Standard Contractual Clauses with the UK Addendum, in Anthropic's data processing addendum.
- Render and Cloudflare (United States companies): their certification under the EU–US Data Privacy Framework and its UK Extension (the UK–US data bridge), with the Standard Contractual Clauses as a fallback.
- Fastmail (Australia, with servers in the United States): the Standard Contractual Clauses in Fastmail's data processing agreement.
6. How long we keep it
| data | kept for |
|---|---|
| relay security log (h) | 90 days, then deleted |
| usage and fault reports (e, f) | 90 days as received, then only as monthly totals that do not identify you |
| seat record on the relay (b) | while the subscription runs, then 12 months (to cover refunds, chargebacks and a permanent licence's records) |
| purchase and licence records (a) | 6 years after the end of the financial year in which the subscription ends (tax records and the limitation period for claims) |
| support emails and packages (g) | diagnostics packages: deleted when the request is closed; emails: 3 years after the last message |
| document text of a cloud sort (c) | not stored by us; Anthropic, as in 3c |
7. Your rights
You have the right to ask for a copy of your personal data, to have it corrected or erased, to restrict or object to how we use it, to receive it in a portable form, and to withdraw consent at any time where we rely on consent. These rights have limits. For example, we cannot erase data we need to provide your subscription while it runs, or records the law requires us to keep. To use these rights, email support@linatl.com from the address you bought with. We reply within one month.
You can complain to the UK Information Commissioner's Office (ico.org.uk), or to the data protection authority where you live. We would be grateful for the chance to put things right first.
8. Security
We protect personal data with appropriate technical and organisational measures, including encryption in transit and signed licences. If a breach is likely to put your rights at risk, we will tell you and the regulator as the law requires.
9. Children
The software and this website are not directed at children, and we do not knowingly collect personal data from anyone under 16.
10. Changes
We will update this notice when what we do changes, and tell you in the software or by email before a material change takes effect. The date at the top shows when it last changed.