Privacy Policy

Information we collect

We collect account information you provide, the data you put into the product (such as roles, candidates, and interview records), and basic usage data needed to run the service.

• Account and contact details
• Content you create in Panelynx
• Usage and device metadata
• Security signals: your IP address, the network it belongs to, approximate location derived from it, browser and device type, and a one-way code computed from your device's characteristics

How we use it

We use your data to provide and improve the product, to keep it secure, and to support you. We do not sell your data.

Security and abuse prevention

When you register or sign in, we record the security signals listed above. We use them only to prevent fraud and abuse, such as fake or repeated trial accounts, and to keep the service secure.

Our lawful basis is our legitimate interest in protecting the service and our customers (Article 6(1)(f) GDPR, and legitimate interests under Sri Lanka's Personal Data Protection Act No. 9 of 2022). You can object to this processing by contacting us.

• Raw IP addresses and device codes: kept for 180 days, then deleted; a one-way hash is kept so repeat abuse can still be recognised
• Groupings of related accounts: kept for 12 months
• Access: limited to authorised Panelynx staff

Data sharing and subprocessors

We share data only with the subprocessors needed to run the service, under contract. A current list is available on request.

Data retention

We retain your data for as long as your account is active and as needed to provide the service. You can request deletion, subject to legal obligations.

Security signals follow the shorter periods described under Security and abuse prevention.

Cookies and analytics

On this public website we use PostHog to understand which pages people arrive on and which ones they leave from. PostHog is our processor and stores this data in the European Union. It is off until you allow it: decline the banner and the script is never downloaded, so nothing is sent to PostHog at all.

We also use Leadfeeder to work out which company a visit came from, by looking up the network the visit arrived on. It tells us that someone at a company read a page; it does not tell us who they are, and we do not use it to identify individuals. Like PostHog it is off until you allow analytics, and declining means the script is never downloaded.

• px_consent_v2: remembers whether you allowed analytics and recording, for 12 months
• ph_*: set by PostHog to recognise a returning browser, and only after you allow it
• _lfa and LF*: set by Leadfeeder to recognise a returning browser, and only after you allow it
• ldfdr_opt_out: set when you decline, or withdraw, so Leadfeeder stops itself

If you allow analytics, we also record a sample of visits so we can see where people get stuck. A recording shows the pages you saw and where you clicked and scrolled. It does not show what you type: every form field is masked, and our contact and enterprise forms are excluded from recording entirely, so nothing you enter there is captured. We never record network traffic, so what a form sends is never in a recording either. Recordings are kept for 30 days and then deleted.

We do not use advertising cookies. To change your answer, clear the cookies for panelynx.com and choose again.

Your rights

Depending on where you live, you may have rights to access, correct, export, or delete your personal data. We support data-subject requests and will help you action them.

• Access and portability
• Correction and deletion
• Objection and restriction

International transfers

Where data is transferred across borders, we use appropriate safeguards consistent with applicable law.

Contact

To exercise your rights or ask a privacy question, contact our privacy team using the details below.