Privacy Policy
Last updated: 19 October 2026
This policy explains what personal data Lyto (“we”) collects when you use lyto.online, why we need it, who helps us process it, and the rights you have under the EU General Data Protection Regulation (GDPR).
1. Who is responsible
Lyto is the data controller for the data described here. For any privacy question or request, write to lyto.dev@gmail.com.
2. What we collect
- Account data — your email address, used to sign you in with a magic link.
- Profile and CV — the résumé you upload and the answers you save in your profile (experience, skills, location, screening answers), used to match roles and fill applications.
- Job-platform session — the session cookies you paste so Lyto can apply on your behalf. They are encrypted before they are stored, with a key kept separately from the database, and you can revoke them at any time.
- Search settings and activity — your targets and filters, the jobs found, the applications sent, their status, and a log of each run.
- Billing data — if you take a paid plan, PayPal handles the payment. We receive the subscription status and plan, never your card or bank details.
- Support chats — messages you send to the assistant on our site, used to answer you.
- Technical data — IP address and basic request logs, kept for security and to keep the service running.
3. Why we use it (legal basis)
- To provide the service you signed up for — matching and applying to jobs, showing your pipeline, billing (performance of a contract).
- To keep the service secure and prevent abuse (legitimate interest).
- To meet tax and accounting obligations (legal obligation).
We do not sell your data and we do not use it for advertising.
4. Who processes it for us
- Supabase — sign-in and database.
- Hetzner — the servers the application runs on, in the EU.
- Anthropic — AI analysis of your CV, match reasons, and the assistant’s answers.
- PayPal — payments for paid plans.
- A residential proxy provider — routes the automated browser so it connects from your region.
Some of these providers may process data outside the EU; when they do, they rely on safeguards recognised by the GDPR, such as the European Commission’s Standard Contractual Clauses.
When Lyto applies to a job for you, your application (CV and answers) is sent to that employer through the job platform, as you asked. From then on the employer and the platform handle it under their own privacy policies.
5. How long we keep it
We keep your data while your account is active. If you delete your account, we delete your profile, CV, session cookies and application history, except what we must keep by law (for example invoices). Session cookies also expire on their own.
6. Your rights
You can ask to access, correct, delete or export your data, to restrict or object to its use, and you can withdraw any consent at any time. Write to lyto.dev@gmail.com; we answer within one month. You can also complain to your data protection authority — in Italy, the Garante per la protezione dei dati personali (garanteprivacy.it).
7. Cookies
lyto.online only uses the cookies needed to keep you signed in and to remember your theme. There are no advertising or tracking cookies.
8. Changes
If we change this policy we will update the date above, and tell you by email when the change is significant.