Privacy policy

Last updated 21 September 2026

Lyra is a tool marketing agencies use to run social media accounts on behalf of their clients. That means we handle two kinds of information: data about the people who use Lyra, and data belonging to the social accounts they connect. This page says exactly what we hold, why, for how long, and who else sees it.

Who we are

Lyra is operated by ניקולאי בטורין ורומן ופרינסקי, a partnership trading as כוכבים ברשת and registered in Israel as an עוסק מורשה (VAT-registered business), number 558625729, at 2 Yehadut Sfarad St, Apt. 26, Ashkelon 7868030, Israel (יהדות ספרד 2, דירה 26, אשקלון 7868030).

For anything on this page, write to [email protected]. Our full details are on the legal notice.

Our role, and the agency's

• For the people who sign in to Lyra (an agency's team), and for anyone who asks us for early access, we are the controller: we decide what is collected and why.
• For everything about an agency's clients (their connected accounts, posts, direct messages, comments, the people who wrote them, audience figures and advertising), the agency is the controller and we are its processor. We process that data only to run Lyra as the agency configures it, under our data processing agreement.
• Instagram, Facebook, TikTok, YouTube and the ad platforms are independent controllers. When the agency publishes or reads through Lyra, data goes to or comes from them under their own terms and privacy policies.

If you messaged or commented on an account an agency manages and want to exercise your rights, the agency is the right first contact. We will help them answer, and you can also write to us.

What we store

People who sign in

• Email address, name, and profile picture if you add one.
• A password, stored only as a scrypt hash with a per-account salt. We cannot read it or recover it.
• When you last signed in, and the workspaces and roles you belong to.

Connected social accounts

When a client connects a platform account, that platform gives us an access token. We never see or ask for a platform password. We store:

• The account's public identifiers: its platform id, handle, display name and profile picture.
• The access and refresh tokens, encrypted, and the permissions they carry.
• Whether the connection is still working.

An account can be disconnected at any time: from inside Lyra, from the client's portal link, or from the platform's own settings. Disconnecting deletes the tokens immediately.

Content the agency publishes

• Media uploaded or linked, its captions and titles, and when it is scheduled.
• What each platform did with it: published, failed and why, and the link to the live post.

Messages and comments

Where an agency uses the inbox, we store direct messages and comments sent to the connected accounts, so the inbox can show a conversation rather than a single line: the text, the sender's platform name and id, and when it was sent. Where auto replies are on, we also record which messages were answered, so nobody is answered twice.

This is the most sensitive data Lyra holds, and it is why it expires automatically (see below) rather than being kept.

Figures

• Reach, views, likes, comments, shares and follower counts, as each platform reports them.

Advertising

• For ad accounts an agency connects: the ad account's name, currency and status, its campaigns, ad sets and ads with their settings and targeting, daily spend and results, and the monthly limit set on it.
• Alerts Meta sends us about those ads, such as a rejection and its reason.
• A record of every change made through Lyra, and who made it.
• We never receive card or bank details. Billing stays with Meta or Google.

Client portal links

A client portal link records how often it was opened, roughly when, and whether the visitor used a phone, tablet or desktop. To count people rather than requests we store a one-way keyed hash of the visitor's address and browser, salted separately for every link. It cannot be reversed into an address, and produces unrelated values for the same person on two different links, so it cannot be used to follow anybody.

Early access requests

If you ask for early access we store what you enter in the form (your name, work email, agency, website, number of clients, platforms and message) so we can reply.

Integrations

When an agency's own software uses the Lyra API, we log each request (the key used, the endpoint, the result and the time) so the agency can see what its integrations did.

Why we use it

We do not use any of this for advertising, we do not sell it, and we do not use it to train AI models.

How long we keep it

Who else sees it

It reaches only:

• The platforms themselves (Meta, Google, TikTok) when Lyra publishes, reads or answers on the agency's behalf, and only what that action needs.
• Our service providers, who host and carry the data for us and may not use it for anything else: Hetzner (servers), Cloudflare (network and media storage) and Google Workspace (our email). The full list, with locations, is on the subprocessors page.
• An AI provider, only if a workspace turns on AI-assisted auto replies. The agency chooses the provider (Anthropic or OpenAI) and supplies its own API key, and only the single incoming message being judged is sent. It is off by default.
• OpenStreetMap, when someone in the campaign builder uses the targeting map: map images are loaded from OpenStreetMap's servers, which see the viewer's IP address, and the names of places searched for are looked up through its Nominatim service.
• Authorities, only where the law requires it, and we will tell the agency unless we are forbidden to.

Google and YouTube data

When a client connects a YouTube channel or a Google Ads account, Google asks them to grant specific permissions and then gives us a token. What we do with it is limited to the feature it was connected for:

• openid, email, profile: to know which Google account connected the channel. Nothing else.
• youtube.readonly, youtube.upload, youtube.force-ssl, yt-analytics.readonly: to list the channel's videos, upload the videos the agency schedules and their thumbnails, read and answer their comments in the inbox, and show the channel's figures.
• adwords: to read a Google Ads account's campaigns and what they cost, and to make the changes the agency asks for: pausing, budgets, schedules, and building campaigns. Google has no read-only advertising permission, so this one carries both reading and changing.

Lyra's use and transfer of information received from Google APIs adheres to the Google API Services User Data Policy, including the Limited Use requirements. We do not sell it, use it for advertising, or use it to train AI models, and no person reads it except with the agency's permission, where the law requires it, or to investigate a security incident.

Lyra uses YouTube API Services. By connecting a YouTube channel you agree to the YouTube Terms of Service, and Google's use of data is described in the Google Privacy Policy.

Disconnecting a Google account inside Lyra deletes its tokens immediately and withdraws the grant at Google, so Lyra stops appearing among the account's connected apps; the YouTube data we stored about the channel is deleted within 30 days. You can also revoke Lyra's access yourself at Google's security settings, which stops it from our side too.

Meta data (Instagram, Facebook, Meta Ads)

When a client connects an Instagram professional account, a Facebook Page or a Meta ad account:

• Instagram (instagram_business_basic, instagram_business_content_publish, instagram_business_manage_messages, instagram_business_manage_comments, instagram_business_manage_insights): to show the profile, publish posts, reels and stories, read and answer direct messages and comments, set ice breakers, and show insights.
• Facebook Pages (pages_show_list, pages_read_engagement, pages_read_user_content, pages_manage_metadata, pages_manage_posts, pages_manage_engagement, pages_messaging, business_management): to list the Pages the client chooses, publish to them, receive their messages and comments as they arrive, and answer, hide or delete comments.
• Meta ad accounts (ads_read, ads_management, business_management): to read campaigns and results, make the changes the agency asks for, set the monthly spending limit, and receive Meta's alerts about rejected ads.

Meta sends messages, comments and ad alerts to Lyra as they happen, signed so we can check they really came from Meta. A client can remove Lyra at any time in Facebook (Settings → Business integrations) or Instagram (Settings → Website permissions), which stops our access at once. If they also ask Meta to delete their data, Meta tells us and we delete the tokens for those accounts. See data deletion.

TikTok data

When a client connects a TikTok account (user.info.basic, user.info.profile, user.info.stats, video.list, video.upload, video.publish), we use it to show the profile and its statistics, list its videos, and publish the videos the agency chooses with the privacy, interaction and disclosure settings chosen for each, or send them to the creator's TikTok drafts. A client can remove Lyra in TikTok (Settings → Security → Manage app permissions), and TikTok tells us when they do.

Where it is held, and who reaches it

The application and its database run on servers rented from Hetzner Online GmbH in Germany, and uploaded media is stored in Cloudflare R2 in its EU jurisdiction, so it stays in the European Union. The partnership operates from Israel and reaches that data from there; the European Commission has recognised Israel as providing an adequate level of data protection, so no additional transfer safeguards are required.

Cloudflare also carries traffic to and from Lyra through its global network, and Google Workspace hosts our email; both are covered by the EU-US Data Privacy Framework and the European Commission's standard contractual clauses.

Cookies and browser storage

We set only the cookies Lyra needs to keep you signed in, and store a few preferences in your browser. There is no analytics or advertising tracking. The cookie notice lists every one.

Your rights

You can ask for a copy of your data, ask us to correct or delete it, ask us to restrict or stop processing it, or take it elsewhere in a machine-readable format. Write to [email protected], or see the deletion page, which explains how to do much of it yourself. We answer within 30 days.

If you are in the EU or UK, the GDPR applies to us in full, because we hold data in the European Union and offer Lyra to people there, and you can complain to your local data protection authority. In Israel, the authority is the Privacy Protection Authority (הרשות להגנת הפרטיות).

Security

Traffic is encrypted in transit. Passwords are hashed and never recoverable. Platform access tokens, and any API key a workspace saves, are encrypted at rest with AES-256-GCM, so a copy of the database on its own does not yield a working credential. Every request is scoped to a single workspace, so one agency cannot reach another's data, and a client portal link reaches exactly one client's profile. Incoming webhooks are checked against the platform's signature before anything is stored. If a breach affects your data, we will tell the agencies concerned without undue delay and within 72 hours of knowing.

Children

Lyra is a business tool and is not for anyone under 18. We do not knowingly hold data about children.

Changes

If this policy changes materially we will email workspace owners and update the date at the top at least 30 days before the change takes effect. Smaller corrections take effect when published.