Privacy policy

Effective September 28, 2026

Who we are

lyli is made by Björkén Media AB (org. nr 559486-2194), Gamla Kyrkogatan 4, SE-261 31 Landskrona, Sweden. We are the controller for the personal data described on this page. Write to us at hey@lyli.io about anything here.

Our two roles

• Controller for lyli accounts, workspaces, billing and support, and for visits to lyli.io and demo.lyli.io. This page explains that data.
• Processor for the data our customers collect with lyli: visits to their websites, replays of the visits they choose to record, clicks on their short links and loads of their pixels. Our customers decide what’s collected and how long it’s kept, under our data processing agreement. If you visited a website that uses lyli, that website’s owner is the one to ask about your data.

What we keep about people who use lyli

Your account

• Your email address and name, and a photo if you upload one.
• If you sign in with Google: your name, email address and Google account id. We don’t keep your Google profile picture or Google’s access tokens.
• Your display preferences: date format, clock and time zone.
• Your workspaces, your role in each (admin or member), and invitations: the invited address, who sent it and when. An invitation expires after 7 days.

Signing in

• A 6-digit code is emailed to you. We store it only as a hash, and it expires after 10 minutes. The address a code was requested for is kept for up to a day.
• Each signed-in device is a session that lasts 30 days and renews while you use lyli. For each we keep the kind of device, the browser and the operating system (for example, “desktop, Chrome, macOS”), so you can see and sign out your devices. We never store your IP address or your full browser identification with it.
• To stop abuse, we count sign-in attempts per IP address and per email address. We store these counts only under a keyed hash, and delete them after a day without attempts.

The free trial

Each person gets one 30-day trial. To keep it that way, we store a keyed hash of your email address (in lower case, without a “+tag”, and for Gmail without dots) when your trial starts. We keep it after you delete your account, so the trial can’t be started again. It can’t be turned back into your address; it only tells us whether an address has had a trial.

Billing

• Payments are handled by Stripe. When an admin buys a plan, we give Stripe the workspace’s name and that admin’s email address. Stripe collects the billing address, the payment method and, for businesses, the VAT ID. Card details never reach us.
• We keep the workspace’s Stripe customer and subscription ids, its plan, and its dates (trial, renewal, end).
• Invoices and what they’re based on are kept for 7 years, as the Swedish Bookkeeping Act requires. So the Stripe customer stays after a workspace is deleted.

Emails

We email you sign-in codes, invitations and notices about your workspace’s plan (a trial ending, paused dashboards, an outgrown plan, a failed payment), and tell you when an import you started finishes or stops. Billing notices go to a workspace’s admins only. Our emails contain no tracking images. What you send to hey@lyli.io is kept as long as needed to help you.

Using lyli

Our hosting provider keeps short-lived request logs, which include IP addresses, to run and secure the service. lyli itself doesn’t store them.

When you watch a replay, your browser loads the recorded website’s images, fonts and styles from that website, as a visitor’s browser would.

Importing from Google Analytics

An admin of a workspace can import a site’s history from Google Analytics 4. Nothing is imported unless they start it.

What we ask Google for

• Read-only access to your Google Analytics (Google’s analytics.readonly permission), used only to list the properties you can import and to read the reports of the one you pick, for the import.
• Your Google account’s email address, to show which account you connected. It’s kept only until the import starts.
• Google’s access token, kept encrypted. Once an import starts, the token is kept only while it runs, then revoked and deleted when the import ends, however it ends. If no import starts within an hour of connecting, the token is revoked and deleted, with the email address, at our next daily cleanup. For signing in with Google, we keep no Google tokens at all.

What comes over

• Daily totals: page views, visits and visitors by page, landing page, hostname, source, campaign tags, country and city, device, browser and operating system, and custom events. Google hands out totals per day: no single visits, IP addresses or user ids. Campaign tags are cleaned as lyli cleans its own, with email addresses and ids removed.
• Imported history is part of the site’s data. We process it on your behalf under our data processing agreement, and delete it with the site or its data, or when you delete the imported history in Site settings.

The numbers are Google’s

Imported days show Google Analytics’ own counts, as Google hands them out. Google counts differently from lyli (by its own sessions, with thresholds and modeling in some reports) and is blocked more often, so imported days and the days lyli recorded can differ. We don’t correct or rescale them. Only import what you’re allowed to move: what Google Analytics collected about your visitors is covered by your own privacy notice.

Google’s policy

lyli’s use and transfer of information received from Google APIs adheres to the Google API Services User Data Policy, including the Limited Use requirements. We don’t use it for advertising or sell it, and no one reads it unless you ask us for help with it, for security, or when the law requires.

Cookies and browser storage

lyli sets only the cookies it needs to work, and none for advertising or measurement:

The map on Realtime is drawn by Mapbox. When it’s shown, your browser loads it from Mapbox, which receives your IP address, stores an anonymous id in your browser and receives anonymous usage data about the map. Mapbox never receives your visitors’ data: their places are drawn on the map in your browser.

Visitors to lyli.io and the demo

We measure lyli.io and demo.lyli.io with lyli itself, without cookies. Your IP address and browser identification are combined with a random value that changes every day and turned into a code that can’t be traced back to you; the daily value is deleted within two days, and your IP address is never stored. We keep the page you visited, the site that sent you, campaign tags (with email addresses and ids removed), your country and city, a location rounded to about 11 km, and your kind of device, browser and operating system. We do this on our legitimate interest in knowing how our site is used.

Shared views

A workspace can share some of its reports through a link. Anyone with the link (and its password, if it has one) sees totals for that website, and on Realtime the cities its current visits come from, never who they are.

Why we may use your data

• To provide lyli under our contract with you: your account, workspaces, sign-in, plan, imports from Google Analytics and the emails that come with them.
• Our legitimate interests: keeping lyli secure and free of abuse (sign-in limits, one trial per person), and measuring our own sites without cookies.
• Legal obligations: keeping invoices and bookkeeping records.

Who we share it with

We don’t sell personal data. These providers process it for us:

Data stored in London is covered by the EU’s adequacy decision for the United Kingdom. Transfers to the United States rely on the EU–US Data Privacy Framework where the provider is certified, and otherwise on the European Commission’s standard contractual clauses.

How long we keep it

• Your account and preferences: until you delete your account.
• Signed-in devices: until they expire (30 days without use) or you sign them out.
• Sign-in codes: 10 minutes; the address they were sent to, up to a day.
• Invitations: until accepted, or 30 days after they expire.
• The trial hash: for as long as lyli offers trials.
• Invoices and billing records: 7 years.
• Google’s access for an import: until the import ends; unused, until our next daily cleanup after its hour.
• Visits to lyli.io and the demo, which can’t be traced back to you: for as long as we keep lyli.io’s statistics; page speed measurements for 25 months.

Your rights

You can ask to see the data we keep about you, have it corrected or deleted, receive it in a portable form, or object to or restrict how we use it. Most of it you can change yourself in Account settings, where you can also delete your account. For anything else, write to hey@lyli.io; we answer within a month. You can also complain to the Swedish Authority for Privacy Protection (imy.se) or the authority where you live.

Security

Everything travels encrypted, and our providers encrypt what they store. Sign-in codes and abuse counts are stored as hashes, IP addresses aren’t stored, and every request is checked against the workspace it belongs to.

Children

lyli is a service for businesses and isn’t meant for children.

Changes

When we change this policy, we update the date at the top. If a change matters to how we use your data, we tell account holders by email before it takes effect.