GDPR Policy

This Privacy Policy describes how Navinspire IA, publisher of the Lynara solution, processes, protects and secures personal data in accordance with the General Data Protection Regulation (GDPR - EU 2016/679), the Data Protection Act, European e-Privacy directives, the AI Act (2024/2025) and international best practices in cybersecurity.

By using Lynara, you accept the processing described in this Policy.

1. Data Controller

The data controller for data processing via Lynara is:

Navinspire IA (NAVINSPIRE IA)
60 Rue François 1er, 75008 Paris - France
Email: contact@navinspire.com

For on-premise, sovereign cloud, or private GCP/Azure/AWS deployments, Navinspire may act as processor or joint controller depending on contractual configuration.

2. Personal Data Processed

Lynara may collect and process the following types of data:

Identity & contact

• First name, last name
• Email address
• Phone (optional)
• User ID

Professional data

• Role and Permissions
• Company
• AI settings (Gemini, BYOK…)

Commercial & Financial

• Invoices, Receipts, Purchase orders
• Financial entries
• Suppliers / customers

HR data (optional)

• CVs, cover letters
• Candidate profiles & Employee info
• Interview history
• HR documents (contracts, supporting documents)

CRM data

• Emails & Commercial history
• Campaigns & Customer interactions
• Support tickets

AI & OCR data

• Submitted prompts & AI results
• Vector embeddings & Indexed documents (RAG)
• Data extracted via Google Document AI

No sensitive data is processed unless voluntarily provided by the Client in an HR module.

3. Processing Purposes

Service provision

Authentication, Module management (HR, CRM, Purchasing, AI…), Email ingestion and campaigns, RAG, OCR extraction, AI automation, AI model configuration.

Service improvement

Technical troubleshooting, Performance analysis, Internal model optimization, Anti-fraud measures.

Security & compliance

Abnormal activity detection, System logging, Attack protection, GDPR & AI Act regulatory compliance.

Legal obligations

Billing, Requests from competent authorities (CNIL…).

4. Legal Bases for Processing

5. User Rights

You have the following rights:

• Right of access to your data
• Right of rectification
• Right to erasure (right to be forgotten)
• Right to object
• Right to restriction
• Right to portability
• Right to withdraw consent
• Right to lodge a complaint with the CNIL

To exercise your rights: privacy@navinspire.com

6. Subprocessors and Third Parties

Navinspire IA selects GDPR and AI Act compliant subprocessors. No unsecured transfers are made.

Infrastructure

• Supabase (Database) - hosted on AWS Europe
• AWS (Storage, replication) - Europe
• Redis (cache)
• Grafana Labs (Monitoring)

Artificial Intelligence

• Google Document AI (OCR) - European regions
• Google AI / Vertex AI (AI)
• Azure OpenAI (GPT)
• AWS Bedrock (Claude, Titan, Llama...)
• OpenRouter (multi-models)

7. International Transfers

Some BYOK AI processing may result in transfers outside the EU. These transfers rely on Standard Contractual Clauses (SCC), Binding Corporate Rules, or legal regimes validated by the European Commission.

Transfers are strictly limited to AI models selected by the Client.

8. Retention Period

9. Security Measures

• TLS 1.2+ encryption
• AES-256 encryption at rest
• Multi-tenant isolation (RLS)
• Two-factor authentication (2FA)
• Advanced audit & logging
• AI anti-prompt injection
• Encrypted backups
• Regular vulnerability testing

GDPR, CNIL, Cloud Security Alliance, AI Act compliant.

10. Use of AI in Lynara

• Client data is never used to train public models.
• "Managed" AI models (Gemini, OpenRouter) respect non-training policies.
• In BYOK mode, third-party provider usage and policies apply.
• Prompts, outputs, embeddings are securely stored.
• Local AI models (Ollama) operate entirely locally (depending on configuration).

11. Data Breach Procedure

Immediate Response

Immediate analysis, leak identification, containment and risk elimination.

Notification

CNIL notification < 72h, notification of affected users (if high risk), complete report to Client.

12. Contact & DPO

For any questions or to exercise your rights: contact@navinspire.com