Privacy statement

This says what we hold about you, why, and how to get rid of it. It covers the wearesyncing account, the customer portal and visits to wearesyncing.com - not the measurements themselves, which stay on your own equipment.

Who is responsible

Lenstar Lab B.V., trading as wearesyncing. Write to [email protected] about anything on this page.

What we hold

• Your account - email address, your name if you gave one, the language you use us in, and a phone number only if you entered one. Your password is stored as a one-way hash; we cannot read it. If you use two-factor, the seed for it is stored encrypted with a key the database itself does not hold.
• Your company - name, country, VAT number and address, and who belongs to it with which role. The VAT number is checked against the European Commission's VIES service. On an order that is invoiced without VAT we keep what that check answered: whether the number is valid, the name and address it is registered under where the member state discloses them, and whether that name matched the one on the order. European VAT law makes that confirmation the condition for invoicing without VAT (art. 18(1)(a) Implementing Regulation 282/2011), so it is the proof behind the invoice rather than a copy of a register.
• What the company has - the licences issued to it and the measuring units registered to it, with when each was last seen.
• Hardware fingerprint - on Linux equipment without a usable security chip, the analyser combines the machine ID, disk serial and available board/system identifiers into a SHA-256 hash. We receive that hash and the identifier names used, not the raw identifier values. We store the accepted hash with the registered machine, when it was bound, and the hashes offered in activation and relink requests. These come from the analyser on your equipment.
• Sign-in records - the moment of each sign-in, the IP address and the browser string, so an account can be checked for use that is not yours.
• An invitation - the address it was sent to, until it is used or expires.
• A message you send us - if you use the form behind "Talk to us" on wearesyncing.com: your name, your company if you named one, your email address and what you wrote. It is mailed to our sales address and answered from there. We also keep one line saying that a message arrived, with the address it named, the company and the IP address it came from, so a flood of them can be told from a person.
• A "Notify me" signup - if you use that form on wearesyncing.com: your name, your email address, how you said you heard about us and anything else you wrote, if you filled those in. We keep the IP address it came from, so a flood of signups can be told from a person. Signing up again with the same address keeps the first signup rather than adding a second row.
• A visit to wearesyncing.com - a short script on the page tells our own server that the page was opened. It reads nothing from your browser or your device, sets no cookie and writes nothing to your device. As with any request to a website, your browser sends your IP address and its identification string along with that message. From this we record that the page was opened, your kind of device, browser and operating system, and the country, region and city your IP address points to, where those can be worked out. Your IP address and your browser's identification string are also combined into a code that recognises, for the rest of the day only, that two page views were the same visit; the IP address is not kept as an address and it is not linked to your account. This is our own software on our own machine in Europe, and nothing about your visit is sent anywhere else.

Why we hold it

To give you the account and the licence you asked for, which is the contract between us; to keep the account secure, which is our own legitimate interest and yours; and, for the VAT number and the invoice behind it, because tax law requires it. A message you send us through the contact form we hold because you asked us a question: answering it is a step taken at your request before any contract, and keeping the form from being used to send mail through us is our own legitimate interest. A "Notify me" signup is the same kind of step: you asked to be told when you can test or buy, which is preparation for a contract at your own request, and the IP address is kept for the same reason as the contact form's - telling a flood of signups from a person is our own legitimate interest. Counting visits to wearesyncing.com is our own legitimate interest too: knowing how many people the site reaches and which pages they read, with no cookie and nothing that follows you from one day to the next. You may object at any time.

We use the hardware fingerprint for licence enforcement: to bind one licence seat to the equipment you activated and prevent unauthorised copies, which is our legitimate interest. Providing it is necessary to activate this Linux licence path. A changed hash automatically refuses activation or renewal; a person with your company's activation right must approve a relink of the same licence. It does not buy a new licence or add a seat. Tell staff using this equipment about this processing and this statement.

Who else sees it

• Our mail provider sends the messages we send you - an invitation, a password link, a notice. It sees your address and the message. It is in the United States and processes on our instruction only.
• The VIES service of the European Commission answers whether a VAT number is valid, and - where the member state concerned discloses it - the name and address registered under it.
• Nobody, for the visit counting. It runs on our own machine, not on an analytics company's. There is no Google Analytics on this site and no advertising network of any kind.
• Nobody buys this data from us and nobody advertises with it.

How long

Your account and its company stay as long as the account exists. An unused invitation is deleted after seven days. Records of sign-ins, refused access and rate limits are deleted after 90 days. The audit trail - who changed what in an account, a company, a licence or an order - is deleted after twelve months; the one exception is the line recording that an order was removed, which is the only record of that order and is kept for now. Invoicing data is kept for the seven years Dutch tax law demands. A message you sent us stays in the sales mailbox while we are answering it and while the conversation it started is still running; the line recording that it arrived is deleted after 90 days. A "Notify me" signup is kept until we have told you testing or buying is open, or for twelve months since you signed up if that never happens, whichever comes first. Records of visits to wearesyncing.com are deleted after twelve months - long enough to compare a month against the same month a year earlier, which is the only reason we count at all.

The accepted hardware fingerprint stays while the machine stays registered, including when its seat is released. Removing the machine also removes its associated activation and relink request records. Temporary offered fingerprint hashes and identifier-name lists are erased when a request is denied or redeemed. Uncompleted requests expire after 15 minutes; the licence server checks every 30 seconds and erases expired offered hashes in bounded batches. Approval receipts remain. Database failures are reported as unhealthy until cleanup succeeds. You can ask us to erase these records using the contact address above.

What you can ask for

To see what we hold, to have it corrected, to have it deleted, to take it with you, and to object to us holding it. Write to [email protected] and you get an answer within a month. If that answer does not satisfy you, you can complain to the Autoriteit Persoonsgegevens.

Last changed 2 November 2026.