legal
Privacy Policy
Effective · version 0.1
Draft pending legal review. This document is published for transparency and may change before it is finalized.
This policy explains how Lymit, LLC ("Lymit", "we", "us"), an Arizona limited liability company, handles personal data when you visit lymit.io, create an account, or use the Lymit service (the "Service"). It is written for developers and the people on their teams, and for anyone whose identifier reaches us through a customer's application.
1. Who is responsible for your data
- For your Lymit account, workspace and billing, Lymit is the controller (under the GDPR and UK GDPR) or business (under U.S. state privacy laws). This policy describes that processing.
- For data a customer's application sends through the Service (for example the user IDs it rate-limits), the customer is the controller and Lymit is a processor acting on the customer's instructions. If you are an end user of an application that uses Lymit, please direct privacy requests to that application; we will help it respond. See section 5.
Contact for any privacy question or request: hello@lymit.io.
2. What we collect
Account data, from your sign-in provider. When you sign in with GitHub or Google we receive your email address, your name or username, your avatar URL and the provider's account ID. We do not receive your password.
Workspace data. The workspace name, members and their roles, namespace configuration, dashboard rules and any notes you write, and records of API keys (a name, a short prefix for display, a one-way hash of the key, and when it was created, last used and revoked; we never store the key itself).
Billing data. If you subscribe to a paid plan, payment is handled by Stripe. Stripe collects your card details and billing address; we never see or store full card numbers. We receive and keep your Stripe customer ID, subscription status, plan and invoice history.
Usage data from the Service. For every rate-limit decision we record a usage event: your workspace, the namespace, the identifier your application sent, the algorithm, the cost, whether it was allowed, the remaining allowance, latency, the Cloudflare data center that served it, and a timestamp. We also count daily and monthly requests per workspace for quotas and billing, and keep the counter state each limit needs to work. Our request logs record the path, status, timing, workspace and plan, but not identifiers.
Technical data. Our hosting and network providers (Cloudflare and Vercel) process your IP address, browser user agent and request details to deliver the website and API and to protect them from abuse, for example with per-IP rate limits. We do not store IP addresses in our own databases.
Communications. If you email us, we keep the message and your contact details to reply and to keep a record.
We do not use advertising or analytics trackers, and we do not buy personal data about you from third parties.
3. How we use it and our legal bases
| Purpose | Data used | Legal basis (GDPR / UK GDPR) |
|---|---|---|
| Create and run your account and workspaces, authenticate you and your API keys | Account, workspace, usage | Performance of our contract with you |
| Enforce rate limits, quotas and burst ceilings, and show your dashboard and analytics | Usage | Performance of contract |
| Bill subscriptions and overage, handle taxes and keep financial records | Billing, usage counts | Performance of contract; legal obligation |
| Keep the Service secure, prevent abuse and fraud, debug problems | Technical, usage, logs | Legitimate interests (protecting the Service and our customers) |
| Improve the Service using aggregated, non-identifying statistics | Usage | Legitimate interests |
| Reply to your emails and send service messages (security notices, billing, changes to terms) | Account, communications | Performance of contract; legitimate interests |
| Comply with law and enforce our terms | Any, as needed | Legal obligation; legitimate interests |
We do not send marketing email. We do not make decisions about you based solely on automated processing that have legal or similarly significant effects. Rate-limit decisions are made about requests in a customer's application, following that customer's configuration.
4. Who we share it with
We do not sell your personal data, and we do not "share" it for cross-context behavioural advertising. We disclose it only to:
Service providers (subprocessors) that host and run the Service for us, under contracts that limit their use of the data to providing their services:
| Provider | What it does for us | Data involved | Location |
|---|---|---|---|
| Cloudflare, Inc. | Edge API, rate-limit counters (Durable Objects), DNS, network security | Usage, technical | Global network; counters are held in the data center region nearest the traffic |
| Supabase, Inc. | Authentication and control-plane database | Account, workspace, billing references | United States (AWS us-west-1) |
| Turso (ChiselStrike, Inc.) | Usage-event and analytics database | Usage | United States (AWS us-west-2) |
| Vercel, Inc. | Hosting for the website and dashboard | Technical | United States and global edge |
| Stripe, Inc. | Payments, invoices and tax | Billing | United States |
| GitHub, Inc. / Google LLC | Sign-in, only for the provider you choose | Account | United States |
| Google LLC (Google Workspace) | Our email, for messages you send to hello@lymit.io and security@lymit.io | Communications, account | United States |
| Resend (Plus Five Five, Inc.) | Sending service emails: usage warnings and notices about the Service or these terms | Account (email address), workspace name | United States |
Other parties, only when needed: professional advisers under confidentiality; authorities when the law requires it or to protect rights, safety or the Service; and a successor organization in a merger, acquisition or sale of assets, which would remain bound by this policy for data it receives.
5. Data customers send through the Service
Applications that use Lymit send us identifiers so we can count requests against them. We process this data only to provide the Service to that customer: enforcing limits, recording usage events, and showing the customer its own analytics. We do not use it for any other purpose, combine it with other data, or disclose it except to the subprocessors above.
We ask customers to send opaque identifiers (such as internal IDs or hashes) rather than names or email addresses. Usage events are deleted when the customer's analytics retention period ends. Counter state and configuration are deleted when the customer deletes the namespace or workspace. Requests about this data should go to the customer who controls it; if you contact us, we will pass your request on.
6. How long we keep it
| Data | Retention |
|---|---|
| Usage events | 7 days on Hobby, 30 days on Pro, 90 days on Enterprise, then deleted |
| Account and workspace data | For as long as your account exists; deleted within 30 days of an account deletion request |
| Daily and monthly request counts | For as long as the workspace exists, for quotas and billing |
| Billing and invoice records | As long as tax and accounting law requires (generally up to 7 years) |
| Emails with us | Up to 3 years after the last message, unless needed longer for a dispute |
Deleted data can persist in encrypted backups for up to 30 days until those backups expire.
7. International transfers
Lymit is based in the United States, and the Service is hosted mainly in the United States. If you are in the European Economic Area, the United Kingdom or Switzerland, your personal data will be transferred to the United States. Where required, we rely on our providers' certifications under the EU-U.S. Data Privacy Framework (and its UK and Swiss extensions) and on Standard Contractual Clauses approved by the European Commission and UK authorities to protect those transfers. Contact us for more information.
8. How we protect it
We use encryption in transit (TLS) for every connection, and our providers encrypt stored data at rest. API keys are stored only as one-way hashes. Access to customer data is scoped by workspace and enforced in the database with row-level security. Staff access to production is limited to what is needed to run the Service. No system is perfectly secure; if you find a vulnerability, please report it to security@lymit.io. If a breach affects your personal data, we will notify you and the authorities as the law requires.
9. Cookies and local storage
We use only what the site needs to work:
- Authentication cookies set when you sign in, which keep you signed in to the dashboard. They are strictly necessary and are removed when you sign out or they expire.
- Theme preference, stored in your browser's local storage if you choose light or dark mode. It never leaves your device.
We do not use analytics, advertising or third-party tracking cookies, so there is nothing to opt out of. If that changes, we will update this policy and ask for consent where the law requires it.
10. Your rights
Depending on where you live, you may have the right to:
- access the personal data we hold about you and get a copy;
- correct data that is inaccurate;
- delete your data;
- port your data to another service in a machine-readable format;
- object to or restrict processing based on legitimate interests;
- withdraw consent where we rely on it;
- not be discriminated against for exercising these rights.
To exercise any of them, email hello@lymit.io from the address on your account. We may need to verify your identity before acting, and we will reply within one month (or the period your local law requires). You may use an authorized agent where your law allows; we will ask for proof of their authority.
EEA, UK and Swiss residents also have the right to lodge a complaint with their data protection authority. We would appreciate the chance to address your concern first.
California and other U.S. state residents: in the last 12 months we have collected the categories of data described in section 2 (identifiers, commercial information, internet or network activity) for the purposes in section 3, and disclosed them to the service providers in section 4 for business purposes only. We have not sold or shared personal data, and we do not knowingly process sensitive personal information.
11. Children
The Service is not directed to children. You must be 18 or older to create an account, and we do not knowingly collect personal data from anyone under 16. If you believe a child has given us personal data, contact us and we will delete it.
12. Changes to this policy
We may update this policy as the Service changes. If a change is material, we will tell you by email or a notice in the dashboard before it takes effect. The effective date at the top shows when the current version took effect.
13. Contact
Lymit, LLC · Arizona, USA · hello@lymit.io
Security reports: security@lymit.io