Privacy Policy

Last updated: 22 October 2026

Lyla is a service operated by Highfold Group Ltd. This Privacy Policy explains how we collect, use, and protect personal data in connection with the Lyla website (meetlyla.com), the Lyla customer account portal, the Lyla mobile app, and the Lyla chat assistant that our customers add to their own websites (the “Service”). We are registered with the Information Commissioner's Office (ICO) under reference ZC280583. If you have any questions, contact us at privacy@meetlyla.com.

1. Who we are and our role

The Service is operated by Highfold Group Ltd, based at Office 21848, 182-184 High Street North, East Ham, London, E6 2JA, United Kingdom. For the purposes of UK data protection law (the UK GDPR and the Data Protection Act 2018), our role depends on the data in question:

• As a controller - for personal data relating to people who visit meetlyla.com and to our business customers (account holders), we decide how and why that data is processed, and we are the controller.
• As a processor - when a business customer adds the Lyla chat assistant to their own website, Lyla collects and processes personal data from that business’s website visitors - and, where Call Answering is enabled, from people who call their number - on the customer’s behalf and on their instructions. In that case, the business customer is the controller of their visitors’ personal data, and we act as their processor. Those visitors should refer to the relevant business’s own privacy notice for how their data is controlled, and may contact that business to exercise their rights.

2. The personal data we collect

a. When you visit meetlyla.com
We collect limited technical information such as your IP address, browser type, and pages viewed, together with information from essential cookies needed to operate the site securely (see Section 9). For each visit we keep the pages viewed, the kind of device, the country (worked out from your IP address, which isn’t kept with the visit) and whether you signed up, used the chat or sent a message, for 90 days, without cookies. To leave robots out of our counts we also compare a similar one-way daily code of your IP address between our own websites for up to two days, and for nothing else.

b. When you create or use a Lyla account (business customers)

• Your email address, business name, and business website URL.
• Your account password, which is stored only as a secure hash (we never store it in plain text).
• The knowledge and content you provide for your assistant to use (for example, your opening hours, services, prices, and FAQs).
• Account and usage information, such as login activity, configuration settings, message and conversation volumes, and the enquiries your assistant captures.

c. Billing information
Payments are processed by Stripe. We do not collect or store your full card details; Stripe handles card data directly and securely. We receive limited billing information such as your subscription status, plan, and partial payment identifiers.

d. Data collected through the Lyla assistant on customer websites
When the Lyla assistant runs on a business customer’s website, it may process, on that customer’s behalf:

• Messages exchanged between a website visitor and the assistant.
• Enquiry details the visitor chooses to provide, which may include their name, email address, phone number (where the customer has enabled it), and any additional fields the customer has configured, along with the visitor’s consent to be contacted.
• Technical data such as a hashed IP address and browser/user-agent information, used for security and basic analytics.

e. Data collected through Call Answering (where enabled)
Where a business customer has switched on the optional Call Answering add-on, when a person telephones their dedicated Lyla number we may process, on that customer’s behalf:

• The caller’s phone number and the details they choose to give during the call (such as their name, a message, and a contact email or number), together with their consent to be contacted.
• A text transcript of the call and call metadata such as the time and duration. The live audio of the call is processed in real time by our telephony and voice providers to handle the call; we retain the transcript, not an audio recording.

We ask our business customers not to configure their assistant to collect special category data (such as health, racial or ethnic origin, or financial account data) or to collect data from children, and to ensure they have a lawful basis and appropriate notice and consent for the data their assistant collects.

f. Data collected through the Lyla mobile app
The Lyla mobile app lets account holders access and manage their own Lyla account on a phone or tablet - viewing the enquiries, calls, and conversations their assistant has captured, and editing their assistant’s knowledge. It processes the same account data described above. In addition:

• A device push token is collected so we can deliver push notifications (for example, when a new enquiry or call comes in) via Apple’s and Google’s push services. You can turn push notifications off at any time in the app or in your device settings.
• If you enable biometric unlock (fingerprint or face), the check is performed entirely by your device’s operating system - we never receive or store any biometric data.

3. How we use personal data

We use personal data to:

• Provide, operate, and maintain the Service, including generating the assistant’s responses and capturing and delivering enquiries to the relevant business.
• Create and manage accounts, authenticate logins, and provide customer support.
• Process subscriptions and payments.
• Keep the Service secure, prevent abuse and fraud, and diagnose technical problems.
• Communicate with you about your account, service changes, and (where permitted) relevant updates.
• Comply with our legal obligations and enforce our terms.
• Understand and improve how the Service performs.

AI processing. To generate replies (in chat or on a call), the content of a conversation or call together with the relevant business’s knowledge content is processed by automated systems, including third-party AI infrastructure that we use to operate the Service. Responses are generated automatically. We do not use the contents of customer conversations to train publicly available AI models.

4. Legal bases for processing (UK GDPR)

Where we act as a controller, we rely on:

• Performance of a contract - to provide the Service to our customers and operate their accounts.
• Legitimate interests - to secure, maintain, and improve the Service, and to communicate with customers, where these interests are not overridden by your rights.
• Consent - where required, for example for certain communications or non-essential cookies. You may withdraw consent at any time.
• Legal obligation - to comply with applicable law, including tax and accounting requirements.

Where we act as a processor for our customers’ website-visitor data, the customer is responsible for establishing the appropriate legal basis.

5. Sharing your data and sub-processors

We do not sell personal data. We share it only as needed to run the Service:

• Stripe - payment processing.
• ArloWebStudio - our installation partner: if you ask us for help putting Lyla on your website, we pass your request (your name, email address, business and website) to ArloWebStudio so they can do it for you.
• Highfold Group Ltd - as the operator of the Service.
• Telephony and voice providers - where Call Answering is enabled, to supply phone numbers and handle the live audio of calls.
• Apple Push Notification service and Google Firebase Cloud Messaging (via Expo) - to deliver push notifications to the Lyla mobile app.
• We also rely on service providers for functions such as email delivery, AI processing, and hosting. All providers that process data on our behalf are required to do so only on our instructions and to keep it secure.

We may also disclose data where required by law, to enforce our terms, to protect our rights, users, or the public, or in connection with a business sale or reorganisation (subject to this policy).

6. International transfers

Some of our providers may process data outside the United Kingdom. Where personal data is transferred outside the UK or EEA, we ensure an appropriate safeguard is in place, such as an adequacy decision or the UK International Data Transfer Agreement / Standard Contractual Clauses.

7. How long we keep data

• Account data is retained for as long as your account is active and for a reasonable period afterwards, then deleted or anonymised, unless we are required to keep it longer (for example for tax records). If you delete your account from the portal or the mobile app, it is deactivated immediately and your data is kept for a 30-day recovery window, during which you can sign in and reactivate it; after that window the account and its associated data are permanently erased.
• Captured enquiries are retained for the period needed to provide the Service and are subject to routine pruning. Where a business customer switches on conversation history, full chat transcripts are stored on their behalf and automatically deleted after a retention period the business customer chooses (90 days by default); the business customer, as controller of their visitors’ data, may also delete any conversation sooner. Business customers can likewise set a retention period for captured enquiries.
• Call Answering records - where enabled, call transcripts and related call details are stored on the business customer’s behalf for the period needed to provide the Service and are subject to routine pruning; the business customer, as controller of their callers’ data, may delete them. We do not retain call audio recordings.
• Billing records are kept as required by law.

When data is no longer needed, we delete or anonymise it.

8. How we protect your data

We use appropriate technical and organisational measures, including encryption of data in transit (HTTPS/TLS), secure password hashing (argon2id), access controls, and segregation of customer data. No method of transmission or storage is completely secure, but we work to protect personal data against unauthorised access, loss, or misuse.

9. Cookies

meetlyla.com and the account portal use essential cookies required for the site and login to function securely (for example, session and CSRF-protection cookies). These are necessary for the Service and do not require consent. If we introduce non-essential cookies (such as analytics), we will request consent where required and update this policy.

10. Your rights

Subject to applicable law, you have the right to:

• Access the personal data we hold about you.
• Request correction of inaccurate data.
• Request erasure of your data.
• Restrict or object to certain processing.
• Request portability of data you provided.
• Withdraw consent where processing is based on consent.

To exercise these rights, contact privacy@meetlyla.com. If your data was collected through a Lyla assistant on a business’s website, that business is the controller - please contact them, and we will support them in responding.

You also have the right to complain to the UK Information Commissioner’s Office (ICO) at ico.org.uk.

11. Children

The Service is not directed at children, and we do not knowingly collect personal data from children. Business customers must not configure their assistant to collect data from children.

12. Changes to this policy

We may update this policy from time to time. We will post the updated version here and change the “Last updated” date. Significant changes will be communicated where appropriate.

13. Contact us

Highfold Group Ltd (Lyla)
Office 21848, 182-184 High Street North, East Ham, London, E6 2JA, United Kingdom
Email: privacy@meetlyla.com
Web: meetlyla.com