Privacy Policy

1. Who is responsible for your personal data?

Lenbird (“Lenbird”, “we”, “us”) is a CRM and workspace for e-commerce provided by Aurelius Group AB, Swedish company reg. no. 559421-6961 (“the company”). The company is the data controller for the processing of personal data described in this policy, which takes place on the website lenbird.com and in the Lenbird platform (app.lenbird.com and its related services, such as the tracking and event services at tracking.lenbird.com and events.lenbird.com).

If you have questions about how we process personal data, or want to exercise any of your rights, contact us at info@lenbird.com.

2. What personal data do we process?

• Account and customer data. When you create an account we process, for example, your name, email address, company details, role and login credentials, as well as the settings and content you add to the service.
• Communication. The content of messages you send to us, for example support requests by email.
• Technical information and logs. IP address, browser and device information, timestamps and security logs created when you use the website or the service.
• Data processed in the service on behalf of our customers. When you as a customer connect your store (for example WooCommerce), social media or advertising accounts to Lenbird, data about your store's customers is processed — for example names, contact details, order history and conversations. For this data, you as the customer are the data controller and Lenbird is the data processor. Processing follows your instructions and is governed by a data processing agreement.

3. Purposes and legal bases

• Providing the service — creating and managing accounts, delivering Lenbird's features and providing support. Legal basis: performance of a contract.
• Security and operations — preventing abuse, troubleshooting and logging events. Legal basis: our legitimate interest in keeping the service secure and stable.
• Development and communication — improving the service and informing you about important changes. Legal basis: legitimate interest.
• Marketing — for example newsletters, if you have chosen to receive them. Legal basis: consent, which you can withdraw at any time.
• Legal obligations — for example bookkeeping. Legal basis: legal obligation.

4. Cookies

The website lenbird.com only uses strictly necessary cookies required for operation and security. We do not use third-party advertising cookies on the website. The Lenbird platform (app.lenbird.com) uses cookies for login and session management.

5. Google services and Google user data

Lenbird offers integrations with Google, for example for conversion tracking in Google Ads (Lenbird Tracking). When you choose to connect your Google account to Lenbird, this happens through Google's own sign-in (OAuth), where you see and approve exactly which permissions Lenbird requests.

What Google data we access

• Basic account information (name and email address) to identify which Google account has been connected.
• Access to your Google Ads account via the Google Ads API to create and manage conversion actions and to send conversion events from your own store to your own advertising account.

How we use, store and share Google data

• Google user data is used solely to provide and improve the features you have chosen to activate. It is never used for our own advertising, never sold to third parties, and never used to develop, improve or train generalised AI or machine-learning models.
• Access credentials (OAuth tokens) and related data are stored securely on servers within the EU and only for as long as the integration is active.
• Google user data is not shared with third parties, except with the subprocessors (for example our hosting provider) required to operate the service, who are bound by contract, or where disclosure is required by law.
• No human at Lenbird reads Google user data, except with your explicit consent (for example in a support case), where necessary for security purposes, or where required by law.

Revoking access and deleting data

You can disconnect the integration inside Lenbird at any time, or revoke Lenbird's access from your Google account at myaccount.google.com/permissions. You can also request deletion of stored Google-related data by contacting info@lenbird.com.

Lenbird's use and transfer to any other app of information received from Google APIs will adhere to the Google API Services User Data Policy, including the Limited Use requirements.

6. Who do we share data with?

We never sell personal data. Data may be shared with carefully selected providers that help us run the service (for example hosting within the EU and email delivery), always under data processing agreements. Data is also shared with the third-party services you actively connect to your account (for example Google or Meta), to the extent required for the integration. Finally, data may be disclosed where we are required to do so by law or by a decision of a public authority.

7. Transfers outside the EU/EEA

We primarily process personal data on servers within the EU/EEA. If a transfer to a country outside the EU/EEA is needed — for example to a third-party service you have connected — we ensure appropriate safeguards are in place, such as the European Commission's Standard Contractual Clauses or an adequacy decision (for example the EU–U.S. Data Privacy Framework).

8. How long do we keep the data?

• Account data is kept for as long as the account is active and is deleted or anonymised within a reasonable time after the account is closed.
• Logs and technical information are kept for a limited time for security and troubleshooting.
• Accounting records are kept for as long as the Swedish Bookkeeping Act requires (currently seven years).
• Google-related data is kept only while the integration is active, or until you request deletion.

9. Your rights

Under the General Data Protection Regulation (GDPR) you have the right to:

• request access to the personal data we process about you,
• have inaccurate data corrected,
• have data erased (the “right to be forgotten”),
• request restriction of processing,
• receive your data in a machine-readable format (data portability),
• object to processing based on legitimate interest, and
• withdraw any consent you have given, at any time.

Contact info@lenbird.com and we will help you. You also always have the right to lodge a complaint with the Swedish Authority for Privacy Protection (IMY), imy.se, or with your local supervisory authority within the EU/EEA.

10. Security

All traffic to and from lenbird.com and the Lenbird platform is encrypted (TLS/HTTPS). Access to personal data is limited to the people who need it for their work, and data is stored on servers within the EU with ongoing security updates and backups.

11. Changes to this policy

We may update this policy, for example as the service evolves or legislation changes. The date at the top of the page shows when the policy was last updated. In the event of material changes, we will inform you through the service or by email.

12. Contact

Aurelius Group AB
Email: info@lenbird.com