Privacy Policy

Last updated: October 18, 2026 · Effective: immediately

Courtesy translation — the Spanish version prevails. Read the Spanish original.

1. Who we are

Lymera is a B2B sales prospecting and follow-up platform operated by LYMERA GROWTH SOLUTIONS S.A.P.I. DE C.V., located at 77536 Cancún, Quintana Roo, Mexico. This Privacy Policy describes how we collect, use, store and protect the personal information of the users of our platform, of the people who visit our website and of the people who contact us. The platform and the website are available at https://lymeragrowth.com/en.

For purposes of the General Data Protection Regulation (GDPR), Mexico's Federal Law on the Protection of Personal Data Held by Private Parties (LFPDPPP) and, to the extent applicable, U.S. state privacy laws (such as California's CCPA/CPRA), LYMERA GROWTH SOLUTIONS S.A.P.I. DE C.V. acts as the controller ("data controller") of its users' account data, of the data of visitors to its website, of leads and of Lymera Hub and Growth Academy participants, and as the processor ("data processor") of the data that users upload or sync to the platform.

1.1 Who this Policy applies to

This Policy applies to everyone whose data we process, regardless of the country from which they contact us:

• Platform users: Lymera customers and the members of their teams who access an account.
• Website visitors: anyone who browses lymeragrowth.com, in Spanish or in English.
• Leads: anyone who submits a contact or meeting-request form, uses the Predictability Diagnostic or the ROI Projector, or asks to receive our communications.
• Lymera Hub and Growth Academy participants: anyone who accesses the courses, certifications, mentorships and community that Lymera offers as part of its service.

This Policy covers people located in Mexico, in the United States and in other jurisdictions; the rights you can exercise depending on your location are described in Section 10. The data of prospects that a customer uploads to the platform is processed by Lymera as a processor, following that customer's instructions; the customer is its controller. If your data is on the platform that way, you can contact the customer or write to us and we will help you route your request.

1.2 Language and versions

This Policy is published in Spanish and English. In the event of any discrepancy, the Spanish version prevails.

2. What data we collect

2.1 Account data

• Full name, email address and phone number.
• Company name and role within the company.
• Login credentials (stored using a cryptographic hash, never in plain text).

2.2 Platform usage data

• Activity logs: pages visited, actions taken, timestamps, IP address, user agent.
• Session identifiers and functional cookies needed to keep you signed in.

2.3 Data uploaded by the user

• Prospect and lead lists (names, email addresses, phone numbers, companies, job titles).
• Campaign content, email templates, sequences and marketing materials.
• Integrations configured with external systems such as HubSpot, Kommo and enrichment providers.

2.4 Data from Google services

When the user connects their Google account, we access the data described in Section 3.

2.5 Data from WhatsApp Business (Meta)

When the user activates the WhatsApp channel, we process the data described in Section 4.

2.6 Data from LinkedIn

When the user connects LinkedIn for outreach campaigns, we access the data described in Section 5.

2.7 Website visitor and lead data

When you visit lymeragrowth.com or contact us, we may collect:

• Data you give us in forms (contact, meeting or demo request): name, email address, phone number, company, job title, country and the message you write.
• Data from the website tools: the answers to the Predictability Diagnostic and the assumptions in the ROI Projector (for example, account size, average deal size or sales cycle). These tools calculate the result in your browser; we do not send those answers to our servers unless you choose to share them with us by submitting a form or requesting a meeting.
• Browsing and technical data: IP address, browser and device type, language, pages visited, referring page, campaign parameters (UTM), and the date and time of the visit.

We use this data for two types of purposes:

• Primary purposes (necessary to serve you): reply to your messages and requests; send you the information, result or tool you asked for; schedule and hold meetings or demos; evaluate your commercial request; and operate and protect the website against fraud, abuse and unauthorized use.
• Secondary purposes (not necessary to serve you): send you content, event invitations and commercial communications; follow up commercially on your interest; and run statistical analysis to improve the website, our materials and the measurement of our campaigns.

You can opt out of the secondary purposes at any time, using the unsubscribe link in any commercial email you receive or by writing to soporte@lymeragrowth.com with the subject Opposition to secondary purposes. Opting out does not affect the primary purposes or your use of the website. Where applicable law requires it (for example, for commercial communications to people in the European Union), the secondary purposes are based on your consent. The area responsible for your data and how to exercise your rights are explained in Section 10 and Section 15.

2.8 Cookies and similar technologies

A cookie is a small file that a website stores in your browser. Lymera's website templates do not create their own cookies or store the answers to the Diagnostic or the ROI Projector in your browser. The cookies and technologies that may be involved are set by the providers we use to run the website:

Advertising and marketing. The website templates do not load third-party advertising pixels or tags (for example, from Meta, LinkedIn or Google Ads). If we decide to use them, we will update this Policy and, where the law requires it, ask for your consent before activating them.

How to control them. You can block or delete cookies in your browser settings. When the website shows a cookie notice, you can accept or reject the non-essential categories from it. If you block all cookies, some features, such as forms, may not work properly.

2.9 Lymera Hub and Growth Academy data

Lymera Hub and Growth Academy are part of Lymera: they are operated by Lymera, not by an independent third party. When you enroll or participate, Lymera processes as controller:

• Your name and email address.
• Your progress in courses and bootcamps and your assessment results.
• The certificates issued to you.
• Your participation in mentorships, live sessions and the community.

We use this data to operate the academy, track your progress, grade assessments, issue certificates and send you operational notices about the sessions you take part in. We keep it while your account is active; after that, the periods in Section 9 apply.

3. Google and Gmail data (Limited Use)

3.1 Permissions requested

When a user connects their Google account to Lymera, the following OAuth permissions (scopes) are requested:

3.2 Limited Use commitment

Lymera's use, transfer and storage of information received from Google APIs meets the Limited Use requirements as follows:

• We do not use Google data for advertising. We do not sell data to third parties for advertising purposes or use it for marketing profiling outside the application.
• We do not use the data to train generalized artificial intelligence models. Gmail data is not used as training input for public or general-purpose machine learning models.
• We do not transfer the data to third parties except when strictly necessary to provide the service (infrastructure providers such as hosting and database, under data processing agreements), when required by law, or with the user's explicit consent.
• We do not expose the data to humans, except: (a) with the user's explicit consent, (b) for security purposes (for example, investigating abuse), (c) when required by law, or (d) when the data is anonymously aggregated for internal operational use.
• Access restricted to the stated purpose. We only access the messages, threads and settings needed for the functions described in Section 3.1.

3.3 Tokens and credentials

The access tokens (access_token) and refresh tokens (refresh_token) issued by Google are stored encrypted at rest in our database and transmitted only over encrypted connections (TLS 1.2+). The user can revoke these tokens at any time by following the instructions in Section 11.

4. WhatsApp Business (Meta) data

4.1 Data we process

When the WhatsApp channel is activated in Lymera, we process the following information:

4.2 Usage commitments

• Messages are only sent to prospects who have voluntarily given their phone number to the Lymera user or who have opted in under WhatsApp Business policies.
• We do not use WhatsApp data for third-party advertising or to profile prospects outside Lymera's functionality.
• We do not train AI models on the content of WhatsApp conversations.
• We comply with Meta's policies on message frequency, permitted content and opt-out: a prospect can reply STOP to be automatically excluded from future communications.
• Meta API access tokens are stored encrypted and transmitted only over TLS 1.2+.

4.3 Prospect data in WhatsApp

A prospect's phone number and message history are treated as third-party data processed on behalf of the Lymera user. The user is responsible for having the appropriate legal basis (consent or legitimate interest under applicable law) to contact their prospects through this channel.

5. LinkedIn data

5.1 Data we process

When the user connects their LinkedIn account to Lymera, we may access and process:

5.2 Usage commitments

• We do not access the user's full contact/connection list or their feed or private posts.
• We do not use LinkedIn data for advertising or for profiling outside Lymera.
• We do not train generalized AI models on LinkedIn conversation data.
• Access is limited to the outreach functionality described in Section 5.1; we do not read or store information from profiles that the user has not actively selected as prospects.
• LinkedIn OAuth tokens are stored encrypted and revoked when the integration is disconnected.

5.3 User responsibility

The Lymera user is responsible for using the LinkedIn integration in accordance with the LinkedIn User Agreement, including daily message limits, professional conduct rules and the prohibition on spam. Lymera is not responsible for the actions the user takes on LinkedIn through the platform.

5.4 Operation through HeyReach

Lymera operates the LinkedIn channel with HeyReach, a prospecting automation provider. LinkedIn profiles are connected through HeyReach, either with profiles that Lymera manages for the user or with the user's own HeyReach account connected to Lymera. HeyReach acts as a processor for Lymera (and, for a customer's prospect data, as a sub-processor).

To run the prospecting, HeyReach receives and processes the data described in Section 5.1: public profile data of the user and of prospects (name, job title, company and profile URL), the status of connection requests, the messages sent and received, and the technical identifiers needed to operate the connected account. Use of HeyReach is subject to its own terms and privacy policy, and use of LinkedIn is subject to the LinkedIn policies cited at the start of this section.

Deleting data in Lymera does not automatically delete the data that HeyReach keeps. If you want us to process with HeyReach the deletion of LinkedIn data, say so in your request (Section 9.2).

6. How we use data

We use the information we collect exclusively for the following purposes:

• Provide, maintain and improve the features of the Lymera platform.
• Send and receive emails on the user's behalf from their connected Gmail account.
• Send and receive WhatsApp Business messages on the user's behalf.
• Manage LinkedIn outreach activities on the user's behalf.
• Detect replies, bounces and events relevant to sales management.
• Authenticate users and protect their accounts against unauthorized access.
• Send operational communications (service notifications, policy changes, security alerts).
• Handle requests from visitors and leads: reply to messages, deliver the results of the website tools, schedule meetings and evaluate commercial requests.
• Operate Lymera Hub and Growth Academy: track progress, grade assessments and issue certificates.
• With your consent or where the law allows it, send you commercial communications and run statistical analysis (secondary purposes, Section 2.7).
• Comply with applicable legal, tax and regulatory obligations.

7. Who we share data with

We do not sell personal data. We share information only with the following recipients:

• Infrastructure and operations providers: hosting, database, cloud services and operations tools (including the content and community hosting tools that support Lymera Hub and Growth Academy) needed to operate the platform, the website and the academy, under contractual agreements that limit the use of data to the contracted service.
• Website and commercial management providers: HubSpot (website hosting, forms, analytics and management of commercial contacts) and Google (website typefaces), as described in Section 2.8.
• HeyReach: the LinkedIn prospecting automation provider with which Lymera operates that channel. It acts as a processor (or sub-processor) and receives the profile and messaging data needed to run the prospecting, as described in Section 5.4.
• Integrations authorized by the user: external systems such as HubSpot, Kommo, Meta (WhatsApp Business API) or LinkedIn, only when the user explicitly connects them.
• Competent authorities: when there is a valid court order or a legal obligation to disclose the information.

Lymera Hub and Growth Academy are part of Lymera: Lymera processes their data as controller and shares it only with the recipients in this section.

8. Storage and security

We implement reasonable technical and organizational measures to protect personal information:

• Encryption at rest of sensitive credentials and third-party tokens (Google, Meta, LinkedIn).
• Encryption in transit using TLS 1.2 or higher on all communications.
• Role-based access control and the principle of least privilege.
• Audit log of access to sensitive data.
• Periodic encrypted database backups.

Despite these measures, no system is completely invulnerable. In the event of a security incident affecting personal data, we will notify affected users and the relevant authorities in accordance with applicable law.

8.1 International transfers

Lymera operates from Mexico, and the data of people located in the United States, the European Union and other countries may be processed in Mexico. Our providers (hosting, cloud, HubSpot, HeyReach and others) may process data in Mexico and in other countries, including the United States.

When we transfer personal data outside the country where it was collected, we do so using the mechanisms required by applicable law (for example, standard contractual clauses, a level of protection recognized as adequate, or the data subject's consent, as appropriate) and with agreements that limit the use of data to the contracted service. We apply the security measures in this Section wherever the data is processed.

9. Retention, deletion and deletion requests

9.1 Retention periods

We keep personal data while the user's account is active or as needed to provide the services. When an account is closed or a deletion request is received:

• We delete account data and uploaded data within 30 calendar days of the request.
• We revoke the Google, Meta (WhatsApp) and LinkedIn access tokens associated with the account.
• We keep only the minimum records required by legal or tax obligations for the period set by law.

When the account is closed because the service agreement has ended, the periods in the Terms and Conditions apply: 30 calendar days to export your data and, after that period, 30 calendar days to delete it (sections A.6.5 and C.8).

9.2 Data deletion request process

To request the deletion of your personal data from the Lymera platform, follow these steps:

1. Send an email to soporte@lymeragrowth.com with the subject: Data deletion request.
2. Include in the body of the email:
   • Your full name.
   • The email address associated with your Lymera account.
   • Whether you want to delete only specific data (e.g., WhatsApp history, LinkedIn data) or the entire account.
   • Any additional detail that helps us identify your account (e.g., company name).
3. Identity verification: we may ask you to confirm your identity by replying from the email registered in Lymera or through a verification code sent to that email.
4. Confirmation: you will receive an acknowledgment of receipt within 5 business days of your request, stating the estimated deletion date.
5. Effective deletion: we will complete the deletion within 30 calendar days of confirming your identity, and we will notify you by email when the process has finished.

9.3 Scope of deletion

A full deletion request includes:

• Account data: name, email, phone, company, role.
• Uploaded or synced prospect and lead lists.
• Conversation history (email, WhatsApp, LinkedIn) stored in Lymera.
• Templates, sequences and campaign content.
• Contact details and requests submitted through the website (forms, Diagnostic, ROI Projector).
• Lymera Hub and Growth Academy data: progress, assessment results and certificates.
• Google, Meta and LinkedIn access tokens.
• Activity and IP logs within the technically possible timeframes.

Exception: we will keep the minimum records required by Mexican tax and commercial law (typically 5 years for billing data) or by any other applicable legal obligation. These records will not be used for any commercial purpose.

9.4 Deletion from third-party integrations

Deleting data in Lymera does not automatically delete the data that Meta, LinkedIn or Google may keep on their own platforms. To do so, you must manage the deletion directly with each provider:

• Google: myaccount.google.com/data-and-privacy
• Meta (WhatsApp/Facebook): Meta Help Center — data request
• LinkedIn: LinkedIn Privacy Center

10. Your rights

As a data subject, you have the right to:

• Access: know what data we hold about you.
• Rectification: request the correction of inaccurate data.
• Cancellation / erasure: request the deletion of your data when it is no longer necessary (see Section 9).
• Objection: object to processing for specific purposes.
• Portability: receive your data in a structured, commonly used format.
• Withdrawal of consent: withdraw your authorization at any time.

To exercise these rights, write to us at soporte@lymeragrowth.com. We will respond within the periods established by applicable law (up to 20 business days in Mexico under the LFPDPPP). Depending on your location, also see sections 10.1 to 10.3.

10.1 Mexico: ARCO rights and privacy notice

This Policy is our comprehensive privacy notice under the LFPDPPP. The controller is LYMERA GROWTH SOLUTIONS S.A.P.I. DE C.V., located at 77536 Cancún, Quintana Roo, Mexico. The area in charge of handling privacy requests is Lymera's Privacy and Support team, at soporte@lymeragrowth.com.

You can exercise your rights of access, rectification, cancellation and objection (ARCO), as well as withdraw your consent or limit the use or disclosure of your data. Your request must include:

1. Your name and a way to send you the answer (email address or mailing address).
2. The documents that prove your identity or, where applicable, the legal representation of the person acting on your behalf.
3. A clear description of the data on which you want to exercise the right and which right it is.
4. Any detail that helps us locate your data (for example, the email you used in a form or your company name).

We will communicate our determination within a maximum of 20 business days from when we receive your complete request and, if it is granted, we will carry it out within the following 15 business days. Where the law allows it, these periods may be extended once for an equal period if circumstances justify it; in that case we will let you know. To opt out of the secondary purposes, what is described in Section 2.7 is enough.

If you believe your right to the protection of personal data has been violated, you can go to the competent data protection authority in Mexico.

10.2 United States

If you live in California or in another U.S. state with a comprehensive privacy law (such as California's CCPA/CPRA), you have the following rights, subject to the exceptions in applicable law:

• Know and access: learn the categories of personal data we collect about you, their sources, the purposes and the recipients, and get a copy of your specific data.
• Correct: ask for the correction of inaccurate data.
• Delete: ask for the deletion of your personal data (see Section 9).
• Portability: receive your data in a structured, commonly used format.
• Opt out of sale and sharing: we do not sell personal data or share it with third parties for cross-context behavioral advertising. If this changes, we will say so in this Policy and give you a way to opt out.
• Limit the use of sensitive personal information: we do not use sensitive personal information for purposes other than providing the service and protecting the security of accounts.
• Non-discrimination: we will not treat you unfavorably for exercising these rights.

How to exercise them. Write to us at soporte@lymeragrowth.com with the subject U.S. privacy request and state your name, the email associated with your account or contact, and the right you want to exercise. We will verify your identity by comparing the details you give us with the ones we already have, or with a code sent to your email. You can use an authorized agent: they must present your written authorization and we may verify your identity directly with you. We will acknowledge receipt within 5 business days and respond within 45 calendar days; if we need more time, we may extend the period by another 45 calendar days and will explain why. As a general rule, we do not charge for handling these requests.

Lymera's role. For your account data, website data and Lymera Hub and Growth Academy data, Lymera acts as the controller (“business”). For prospect data uploaded by our customers, Lymera acts as the customer's service provider (“service provider”) and does not use it outside the contracted service; requests about that data are routed to the customer.

Personal data we collect (categories from the last 12 months):

We obtain this data from you, automatically when you use the website or the platform, and from our customers (prospect data). We use it for the purposes in Section 6, disclose it for operational purposes to the recipients in Section 7 and keep it as set out in Section 9. In the 12 months before the date of this update we have not sold personal data or shared it for cross-context behavioral advertising.

10.3 European Union and European Economic Area

If you are in the EU or the EEA and the GDPR applies, in addition to the rights in the list above you can ask for the restriction of processing and lodge a complaint with the supervisory authority in your country. Our legal bases are:

• Performance of a contract or pre-contractual steps at your request (account, platform, academy and replies to your requests).
• Legitimate interest (security, abuse prevention, basic website analytics and B2B commercial communication), balanced against your rights.
• Consent (secondary purposes and non-essential cookies, where the law requires it), which you can withdraw at any time.
• Compliance with legal obligations, for example tax obligations.

Transfers of data outside the EEA are governed by Section 8.1. To exercise your rights, write to us at soporte@lymeragrowth.com; we will respond within the one-month period set by the GDPR, which may be extended under that regulation.

11. How to revoke Google access

You can revoke Lymera's access to your Google account at any time in two ways:

• From Lymera: go to the Integrations section, find the Gmail integration and click Disconnect. This invalidates the stored tokens and removes the connection.
• From Google directly: visit myaccount.google.com/permissions, find "Lymera" in the list of apps with access to your account and click Remove access.

Once access is revoked, the email sending and reading features will stop working, but your Lymera account will remain active. You can reconnect Gmail at any time.

12. How to revoke WhatsApp and LinkedIn access

12.1 WhatsApp Business (Meta)

You can disconnect the WhatsApp channel from Lymera:

• From Lymera: go to Integrations, find the WhatsApp Business integration and click Disconnect. This revokes the Meta API token and disables the channel.
• From Meta Business Suite: go to WhatsApp Business settings and remove the Lymera app from the apps connected to your WABA.

Once disconnected, sending and receiving WhatsApp messages stops. Your Lymera account remains active.

12.2 LinkedIn

You can revoke Lymera's access to your LinkedIn account in two ways:

• From Lymera: go to Integrations, find the LinkedIn integration and click Disconnect. This revokes the stored OAuth token.
• From LinkedIn directly: go to Settings > Privacy > Authorized apps and services, find "Lymera" and click Remove access.

Once access is revoked, LinkedIn outreach features will no longer be available, but your Lymera account remains active.

13. Minors

Lymera is a B2B platform intended for adult professionals. We do not knowingly collect personal data from anyone under 18 years of age. If we detect that a user is a minor, we will delete their account and the associated data.

14. Changes to this policy

We may update this Privacy Policy to reflect changes in our practices or in applicable law. Any material change will be notified to users by email or through a visible notice on the platform at least 15 calendar days before it takes effect. Continued use of Lymera after that date means you accept the updated version.

15. Contact

If you have questions about this Privacy Policy or about the processing of your personal data, contact us:

• Privacy and data requests email: soporte@lymeragrowth.com
• Support email: soporte@lymeragrowth.com
• Area responsible for privacy: the Privacy and Support team of LYMERA GROWTH SOLUTIONS S.A.P.I. DE C.V.
• Mailing address: 77536 Cancún, Quintana Roo, Mexico