Privacy Policy

Version 2026-10-12 · 12 October 2026

LynBro ApS, CVR 46321499, Denmark, is the data controller for the personal data described here. Contact: support@jasms.dk.

Two different roles, and the difference matters. For data about you and your staff — who signed in, who was invoiced — we are the controller, and this policy applies. For the recipients you send messages to, you are the controller and we are your processor: we act on your instructions and never decide what to send or to whom. Those terms are in the Data Processing Terms.

What we hold, and why

Data	What it is	Why (legal basis)	How long
Account details	Company name, contact name, email address, optionally a phone number.	To provide the service and to invoice you (contract).	For as long as the account exists, then as required by Danish bookkeeping law (5 years for anything on an invoice).
Message metadata	Destination number, time, route, delivery status, price and cost.	To deliver messages, bill correctly, and prove delivery when you ask (contract; legitimate interest in fraud prevention).	As long as the account exists. Billing-relevant fields are kept for the statutory 5 years.
Message content	The text you send.	To deliver it (contract).	Configurable per account. Bodies are redacted automatically once your retention period elapses; the default is set in your settings and can be shortened at any time.
Incoming messages	The sender's number, the number written to and the text of SMS sent to a number or keyword you rent, or replies to your messages.	To deliver them to you and to honour opt-outs such as STOP (contract; legal obligation for opt-outs).	As long as the account exists; the same retention setting as your outgoing messages applies to their text. Opt-outs are kept so they keep working.
Website statistics	Pages viewed, the referring site (host only), campaign tags (utm_*), language, approximate country, device and browser type. No cookies and nothing stored on your device; no IP address in this record — visitors are counted with an anonymous code that changes every day.	To understand how the website is used and improve it (legitimate interest, Article 6(1)(f)).	400 days.
Sign-in and security records	IP address, timestamp, browser identifier, success or failure of each attempt.	To keep accounts from being broken into (legitimate interest, Article 32 security obligation).	90 days.
Payment records	Amount, date, method, VAT split, bank reference. Not card numbers.	To take payment and keep books (contract; legal obligation).	5 years, as Danish bookkeeping law requires.

What we do not do

We do not sell personal data, and we never have.
We do not use your message content for advertising, profiling, or to train anything.
We do not run advertising or analytics trackers on this site. See the Cookie Policy — there is no consent banner because there is nothing to consent to.
We do not read your messages. Automated abuse checks look at patterns — rates, destinations, repeated content — not at meaning.

Who else is involved

Only the suppliers the service needs to work. Each is bound by a written processing agreement.

Who	What for	What they see
Contabo GmbH (Germany)	Hosting of the service, its database and our mail server.	Everything the service stores, on servers in the EU. Contabo runs the machines; it has no access to the application.
GatewayAPI (Denmark)	Delivery of SMS; numbers and keywords for two-way SMS.	The destination number, the sender and the message text, and messages sent to a number or keyword rented through them.
BulkGate (Czech Republic)	Delivery of SMS; replies to its shared reply number.	The destination number, the sender and the message text, and replies sent to that number.
Zadarma	Delivery of international SMS and fallback delivery.	The destination number, the sender and the message text.
gyk.dk (LynBro ApS, Denmark)	Shortening a link in a message when the network requires it.	The link only — not the recipient or the rest of the text.
Cloudflare Turnstile	Bot protection on the sign-in and registration forms.	Chosen specifically because it does not profile visitors and sets no tracking cookies. It sees the request's IP address and a token, nothing about who you are.
Stripe	Card payments, when you top up by card.	You are redirected to Stripe's own hosted page. Card details are entered on Stripe's systems and never reach ours — we receive only the outcome and the last four digits.
Google (Google Drive)	Off-site copies of our backups, for disaster recovery.	A copy of the database. Stored for a limited number of days and used only to restore the service.

Where the data sits

The service runs on servers in the European Union. Messages to Danish numbers are delivered over our own equipment in Denmark or through the Danish and EU delivery partners listed above. Delivering an international SMS necessarily sends the destination number and message text to the mobile network in the destination country, wherever that is — that is what sending an SMS abroad means, and it cannot be avoided while still sending the message. Where a supplier processes data outside the EU, that transfer relies on the European Commission's Standard Contractual Clauses.

How it is protected

Encrypted in transit throughout: HTTPS to the portal and API, TLS to the mail server and to every supplier.
Passwords stored as bcrypt hashes. API secrets stored hashed and shown once, at creation.
Two-factor authentication required for administrative access.
Sign-in attempts throttled; bot protection on the public forms.
Message bodies redacted automatically once your retention period elapses, so old content stops existing rather than merely being hidden.
Access to production is limited to named people and is logged.

Your rights

Access. A copy of what we hold about you.
Rectification. Correction of anything inaccurate.
Erasure. Deletion, except where bookkeeping law requires us to keep an invoice record. The portal has a self-service erase under GDPR.
Portability. Your data in a machine-readable format; the portal exports CSV.
Objection. To processing we base on legitimate interest.
Complaint. To Datatilsynet, the Danish Data Protection Agency, if you think we have got it wrong.

Ask at support@jasms.dk. We answer within one month. Much of it is self-service in the portal, under GDPR & your data.

If something goes wrong

If a breach happens that is likely to put rights and freedoms at risk, we notify Datatilsynet within 72 hours of becoming aware, and we tell affected customers without undue delay. We will say what happened and what we did, not the minimum we can get away with.

Changes

Material changes are notified by email to the address on the account. The version and date are at the foot of this page.

LynBro ApS · CVR 46321499 · Denmark · support@jasms.dk
Version 2026-10-12 · last updated 12 October 2026. English is the governing version of these documents.