Privacy Policy

Last updated: 2026-11-01 · Lynbro ApS (CVR 46321499), Rødovre Parkvej 276, 2610 Rødovre, Denmark

Controller

Data controller: Lynbro ApS (CVR 46321499), Rødovre Parkvej 276, 2610 Rødovre, Denmark. Contact: privacy@cbot.dk. We are EU-hosted (Germany).

Data we collect

Account data (name, email, password hash, language, theme). Usage data (conversations, messages, leads you capture, channel tokens — encrypted at rest). Technical data (IP, device fingerprint for security, request logs). Billing data is handled by Stripe.

Purpose & legal basis

To provide the Service (contract), secure it and prevent abuse (legitimate interest), send OTP and service emails (contract), and — with consent — analytics. AI replies are generated via OpenAI.

Your GDPR rights

Access, rectification, erasure, restriction, portability, and objection. Contact privacy@cbot.dk; we respond within 30 days. You may complain to Datatilsynet (Danish DPA).

Retention

Account data while your account is active; 30 days after deletion for export, then erased. Logs are rotated. Leads are kept per your configuration.

Sub-processors

OpenAI (AI replies), Stripe (payments), Meta/Telegram (channels you connect), our EU hosting provider. A DPA is available.

Facebook and Instagram data

When a business connects a Facebook Page or Instagram professional account, we store the account ID and name and an encrypted access token. We store messages that people send to that account, and the replies, so that the business can read and answer them in its cbot inbox. An AI assistant may answer; for that, the message text is sent to OpenAI. We use this data only to provide the inbox and replies to that business. We do not sell it or use it for advertising. If a person unsends a message, we remove its text. When a business removes a channel, we remove the webhook subscription and the token at once. Conversations are deleted with the business's project or account, or on request to privacy@cbot.dk within 30 days. See https://cbot.dk/data-deletion.

Security

Passwords are Argon2id-hashed; channel/CRM tokens are encrypted at rest; TLS in transit; tenant isolation; audit logging.

Contact

privacy@cbot.dk