Taalbericht
Dit beleid wordt momenteel alleen in het Engels aangeboden om juridische precisie te garanderen. Navigatie en platformfuncties blijven in de geselecteerde taal.
Privacy Policy
Built around transparency, data minimisation, and user control under the principles of the European GDPR. Your account and the career content you create remain under your control.
Last updated:
Who is responsible for your data
Lyrra, a Dutch sole proprietorship registered under KVK number 99866161, is the controller of personal data processed for this service. Contact support@lyrra.io for privacy requests. See our Legal Information for registration details.
Why we process personal data
- Account authentication, saving and managing your career content, and features you request: performance of our contract with you (GDPR Article 6(1)(b)). Account information is needed to provide these features; career content is supplied at your choice.
- Preventing abuse, enforcing request limits, and investigating security incidents: our legitimate interest in protecting the service and its users (Article 6(1)(f)).
- Records we must keep for tax, accounting, or other legal requirements: compliance with legal obligations (Article 6(1)(c)).
Browser permission for an optional feature, such as the microphone, lets you control access to that device capability. Where processing relies on consent, you may withdraw it without affecting processing that was lawful before withdrawal. Lyrra does not make recruitment decisions or decisions with legal or similarly significant effects about you through the capture feature.
1. Zero Tracking & High Privacy
Lyrra is designed with a strict privacy-by-default architecture in accordance with the European GDPR / AVG.
We do not use any third-party marketing trackers, tracking pixels, or invasive analytics cookies. We do not track you across the internet.
To maintain platform security and protect against bots, we utilize Cloudflare Turnstile. This is a functional security tool that does not utilize tracking cookies or process data for marketing purposes.
2. Artificial Intelligence & Your Data
Our application utilises advanced AI models to process resumes and facilitate simulations.
- AI training privacy
Lyrra does not use your resumes, documents, notes, transcripts, prompts, or generated content to train AI models.
- Secure Transit
Your data is transmitted securely to the AI API only when you purposefully initiate an analysis or simulation.
3. Voice features
Voice interview features require your permission to use the microphone. Speech-recognition services convert your speech into text, and Lyrra receives the resulting transcript when you submit it.
Lyrra does not store raw microphone recordings in the interview flow. When spoken responses are enabled, voice service providers process generated response text to produce audio. Generated audio is not stored as career content.
4. Minimal Data Collection
We subscribe to the principle of data minimisation, collecting only what is strictly necessary:
Account & Auth
We collect your email address for secure authentication. Payment information is securely handled by Stripe. We never touch or store your raw credit card data.
Career Portfolio
Resumes, cover letters, and notes that you explicitly create. You maintain full ownership over this content at all times.
5. Lyrra Capture Chrome Extension
Lyrra Capture receives temporary access to the active browser tab only after you explicitly click the extension. It reads job-listing fields such as the company, position, location, salary, description, source, and URL so that you can review them before saving a tracker entry.
Automatic capture is disabled on linkedin.com, indeed.com, workopolis.com, simplyhired.com, resume.com, and their subdomains. On these sites, Lyrra does not inject its extraction script or read page content; it displays an empty manual form. This is a fixed list, not an automatic check of other sites’ terms. Only save information you are entitled to use, including when entering it manually.
We do not collect unrelated browsing history, monitor tabs in the background, submit applications, sell extension data, or use captured information for advertising. Page content is not sent to Lyrra until you choose to save it. Authentication tokens are revocable, are kept in Chrome session storage, and expire from the device when the browser session ends.
Saved tracker fields are sent to Lyrra over encrypted HTTPS. Supabase processes account, authentication, database, and storage data; Vercel and Cloudflare provide hosting, delivery, and security services. Saved role context is sent to Mistral only if you later initiate a related AI feature, and generated response text is sent to voice service providers only if you initiate supported voice playback. Stripe does not receive captured listing content.
API requests also carry security metadata such as your IP address, browser user agent, and request origin. We derive a hashed identifier from these values for abuse prevention. Upstash processes rate-limit identifiers and request counters, which may also be keyed by your account ID. The extension rate limiter uses a 60-second sliding window with expiring counters and analytics disabled. This short rate-limit window does not describe the retention of hosting or security logs, which are separate records. Hashing these identifiers does not make them anonymous.
Lyrra personnel do not read extension-derived user data except with your explicit consent for a specific support request, when required to investigate security or abuse, to comply with law, or after the data has been aggregated and anonymised for permitted internal operations.
The use of information received from Google APIs will adhere to the Chrome Web Store User Data Policy, including the Limited Use requirements.
6. Your Privacy Rights
We grant all Lyrra users the highest standard of privacy rights outlined by the GDPR:
Right to Portability
Download your career, practice, canvas, interview, negotiation, and tracker data in a machine-readable ZIP/JSON format via Data Management.
Right to be Forgotten
Permanently delete your account directly through your dashboard. This removes your account data and user-owned avatar and signature files, and cancels or deletes billing data where applicable.
You also maintain the Right to Access, Right to Rectification, and the Right to Withdraw Consent at any time.
Where applicable, you may request restriction of processing and object to processing based on legitimate interests. You may complain to the Dutch supervisory authority, the Autoriteit Persoonsgegevens, or the supervisory authority where you live, work, or believe an infringement occurred. Contact support@lyrra.io to exercise your rights; we may need to verify your identity.
7. Data Retention & Lifecycle
We retain your account and saved career content to provide the service until you delete the content or close your account. Signing out or uninstalling Lyrra Capture does not delete tracker entries already saved in your Lyrra account.
Deletion and exceptions: Use Data Management to request account deletion. Records needed for legal obligations or a specific security investigation may need to be retained for those purposes. Backup and infrastructure-log retention is separate from removal of active account records. Contact support@lyrra.io for information about records retained in your case. We do not promise automatic deletion after a fixed period of account inactivity.
International processing
Our service providers operate internationally. Processing or access outside the European Economic Area may occur depending on the service and its configuration. Such transfers require an applicable GDPR transfer mechanism, such as an adequacy decision or the European Commission’s standard contractual clauses, with additional safeguards where required. Contact support@lyrra.io to request information about the transfer arrangements and a copy of applicable safeguards for your data.
8. Contact Us
Data Protection Inquiries
For any inquiries regarding your data, privacy, or GDPR compliance.