1Who we are

Leyn AI AB ("Leyn", "we", "us") is the controller for the personal data described in this notice. That means we decide why and how it is processed.

We have not appointed a Data Protection Officer. We are not required to under Article 37 GDPR: our core activities do not consist of large-scale regular and systematic monitoring of individuals, nor large-scale processing of special-category data. Privacy questions go to trust@leyn.ai and are answered by a named person at Leyn.

Leyn is established in Sweden, so no Article 27 representative is required.

2What we collect, why, and on what basis

2.1 Visiting this website

This website does not use analytics, advertising, tracking pixels, or non-essential cookies. We set no cookies that require your consent, and there is no cookie banner because there is nothing to consent to.

The site is served through Cloudflare, Inc., which acts as our processor for content delivery and protection against attacks and abuse. To do that, Cloudflare processes technical connection data — including your IP address, the page requested, timestamp, and browser user-agent string — and may set a strictly necessary security cookie (__cf_bm and/or cf_clearance) to distinguish human visitors from automated traffic.

• Purpose: delivering the site and keeping it available and secure.
• Legal basis: Article 6(1)(f) GDPR — our legitimate interest in operating a secure, functioning website. We rely on legitimate interest rather than consent here because this processing is limited to what is strictly necessary to serve the page you asked for; you can object under section 7.
• Retention: Cloudflare's security logs, typically retained for a short period under Cloudflare's own schedule. Leyn does not receive, store, or analyze visitor-level logs.

2.2 The research form and interview

We run a product-research program with people working at organizations that deploy AI agents. It has two parts: a multiple-choice form sent ahead of time, and a short conversation.

What we collect

Purpose. To understand how organizations govern AI agents, so that we can decide what to build and how to describe it. Answers are analyzed alongside those of other participants.

Legal basis. Article 6(1)(a) GDPR — your consent, given when you submit the form and, separately, before any recording. Consent is our basis for the form, the interview, the analysis, and any follow-up contact about the research or about Leyn's product.

You can withdraw your consent at any time, for any part of it, by emailing trust@leyn.ai. Withdrawal does not affect the lawfulness of processing carried out before you withdrew. On withdrawal we delete your responses, notes, and any recording, unless you ask us to keep the answers in anonymized form.

Is it obligatory? No. Participation is entirely voluntary. There is no statutory or contractual requirement to take part, and no consequence if you decline, skip questions, or stop midway. Every item on the form is optional except the first, which determines which questions you are shown. A skipped item is recorded as blank.

What we ask you not to send us. Please do not include in free-text fields: personal data about other identifiable individuals, confidential or commercially sensitive information your employer has not cleared, or any special-category data under Article 9 GDPR (health, political opinions, trade union membership, and so on). We do not seek any of this and will delete it if we receive it.

2.3 Recording the interview

The conversation is not recorded by default.

• We will ask you at the start of the call whether you agree to an audio or audio-video recording and an automated transcript. You may decline, and the conversation proceeds as normal.
• If you decline, the interviewer takes written notes and sends them to you afterwards for review, so you can correct or strike anything before they are used.
• If you agree, you may withdraw that agreement during the call or afterwards, and we delete the recording and transcript.
• Consent to be recorded is separate from, and not a condition of, taking part.

If other people are present on the call, each of them is asked separately and their answer is respected.

2.4 Contacting us

If you email us, we process your name, email address, and whatever you write. If you use the contact form on this website, we process your name, work email address, your function and your primary interest. We do this for the purpose of replying and keeping a record of the exchange. Legal basis: Article 6(1)(f) GDPR — our legitimate interest in responding to people who contact us. We keep correspondence for up to 24 months after the last message, unless it forms part of a contract or a legal record.

2.5 What we do not do

• We do not sell, rent, or trade personal data.
• We do not buy contact lists or enrich your record from data brokers.
• We do not use your personal data to train AI models.
• We do not carry out automated decision-making producing legal or similarly significant effects, and we do not profile you within the meaning of Article 22 GDPR. Our analysis groups responses to find patterns across organizations; it produces no decision about you as an individual.
• We do not ask which organization you work for, and we do not publish your name, your organization's name, or anything attributable to you without your separate written agreement. Research outputs use aggregated or anonymized findings.

3Where your data is stored and who can reach it

Access within Leyn is limited to the people who need it: the interviewers and the small team analyzing the results. Every processor is engaged under a written data processing agreement meeting Article 28 GDPR.

We do not disclose personal data to any other third party, except where we are legally required to do so, or where it is necessary to establish, exercise, or defend a legal claim.

International transfers

Form responses and interview records are stored in the EU. However, Microsoft, Google, and Cloudflare are US-headquartered groups, and limited access from outside the EU/EEA can occur — principally for technical support, incident response, and abuse prevention. Cloudflare's edge network processes website connection data, and passes on contact form messages, outside the EU/EEA by design.

Where such a transfer takes place, it is protected by:

• the EU-US Data Privacy Framework, where the receiving entity is certified under it; and/or
• the European Commission's Standard Contractual Clauses (Implementing Decision (EU) 2021/914), together with the supplementary technical measures (encryption in transit and at rest, access controls, logging) described in each provider's documentation.

You may request a copy of the relevant safeguards by emailing trust@leyn.ai.

4How long we keep it

Deletion is permanent and includes backups, on the backup rotation cycle, within 90 days.

5How we protect it

We apply measures appropriate to the risk, including: encryption in transit (TLS) and at rest; access limited to named individuals on a need-to-know basis; multi-factor authentication on all accounts holding personal data; logging of access to research records; and a documented process for handling a personal data breach, including notification to the Swedish Authority for Privacy Protection within 72 hours where Article 33 GDPR requires it, and to you where Article 34 requires it.

6Children

This website and our research are directed at people acting in a professional capacity. We do not knowingly collect personal data from anyone under 18. If you believe we have, email trust@leyn.ai and we will delete it.

7Your rights

Under the GDPR you have the right to:

• Access — obtain confirmation of whether we process your data, and a copy of it.
• Rectification — have inaccurate data corrected, or incomplete data completed.
• Erasure — have your data deleted ("right to be forgotten").
• Restriction — have processing limited while a dispute about accuracy or lawfulness is resolved.
• Portability — receive the data you gave us in a structured, commonly used, machine-readable format, or have it transmitted to another controller where technically feasible.
• Object — object at any time to processing based on our legitimate interests (sections 2.1 and 2.4).
• Withdraw consent — at any time, for any processing based on consent (sections 2.2 and 2.3), without affecting the lawfulness of what came before.
• Not be subject to automated decision-making — we carry out none, as stated in section 2.5.

How to exercise them. Email trust@leyn.ai. We respond within one month of receiving your request, extendable by two further months for complex requests, in which case we tell you within the first month and explain why. There is no charge, unless a request is manifestly unfounded or excessive. We may ask for information to confirm your identity, and we use it only for that purpose.

How to complain. If you are unhappy with how we have handled your data, please tell us first — we would rather fix it. You also have the right to lodge a complaint with a supervisory authority, in the EU/EEA member state of your habitual residence, your place of work, or the place of the alleged infringement. Our lead authority is:

Integritetsskyddsmyndigheten (IMY) — the Swedish Authority for Privacy Protection Box 8114, 104 20 Stockholm, Sweden +46 (0)8 657 61 00 · imy@imy.se · https://www.imy.se

Participants in Norway may contact Datatilsynet (https://www.datatilsynet.no). A full list of EEA authorities is published by the European Data Protection Board at https://edpb.europa.eu/about-edpb/about-edpb/members_en.

If you are in the United Kingdom

Where UK GDPR applies to you, this notice applies in the same terms, read with the UK GDPR and the Data Protection Act 2018. Transfers out of the UK rely on the UK International Data Transfer Addendum to the Standard Contractual Clauses, or the UK Extension to the EU-US Data Privacy Framework. You may complain to the Information Commissioner's Office, Wycliffe House, Water Lane, Wilmslow, Cheshire SK9 5AF (https://ico.org.uk).

8Changes to this notice

We update this notice when what we do changes. The version number and date at the top tell you which version you are reading. If a change materially affects how we use personal data you have already given us, we contact you directly — and, where the change requires it, ask for your consent again rather than assuming it.

9Questions

trust@leyn.ai — a person at Leyn reads it.