Privacy Policy
Effective date: October 17, 2026 · Last updated: October 17, 2026
Lynx ERP Solutions Inc. ("Lynx", "we", "us") builds and operates LynxERP, a cloud ERP platform for distribution, wholesale, retail and manufacturing businesses. This Privacy Policy explains what personal information we collect, how we use and protect it, and the choices and rights you have.
In short:
- We collect only what we need to run LynxERP, support our clients and keep accounts secure.
- We do not sell personal information, and we do not use it for third-party advertising.
- "Sign in with Google" and "Sign in with Microsoft" give us only your name, email address and account ID. We get no access to your email, calendar or files.
- Business data in LynxERP belongs to our client company; we process it on that company's behalf.
- You can contact our Privacy Officer at info@lynxerp.ca at any time.
Contents
- Scope
- Our role: controller and service provider
- Information we collect
- Signing in with Google or Microsoft
- How we use information
- Consent and legal bases
- How we share information
- Where information is stored
- How long we keep information
- How we protect information
- Cookies and similar technologies
- Your rights and choices
- Google API Services: Limited Use
- Children
- Third-party websites
- Changes to this policy
- Contact us
1. Scope
This Privacy Policy applies to:
- our website at lynxerp.ca;
- the LynxERP application, including client sites we host for our business clients and our central sign-in service at portal.lynxerp.ca;
- LynxERP mobile and web apps, such as the driver and sales-representative apps;
- the LYNXTracker desktop application;
- our sales, onboarding and support communications.
It does not cover websites or services run by others, even if they link to or integrate with LynxERP.
2. Our role: controller and service provider
- Website visitors, prospects and our own clients' account contacts: Lynx decides how this information is used and is responsible for it.
- Business data inside LynxERP (for example customers, vendors, orders, invoices, inventory and employee records entered by a client): the client company controls this data. Lynx processes it only on the client's instructions and under our agreement with that client. If you are a customer, employee or contact of one of our clients and have a question about your data, please contact that company first; we will help them respond.
3. Information we collect
3.1 Information you give us
- Contact and enquiry details: name, company, job title, email, phone and the contents of messages or forms you send us (for example "Book a Demo" or "Contact Us"), including any attachments.
- Account information: name, email, username, password (stored only as a secure hash), role and permissions for users of LynxERP.
- Support information: details you include in support tickets, calls or emails.
- Billing contacts: billing contact name, address and email for our client companies. We do not store full payment-card numbers.
3.2 Information collected automatically
- Log data: IP address, browser type and version, device and operating system, internet service provider, pages visited, referring page, and date and time of each request.
- Security and audit data: sign-in attempts, sign-in method, account lockouts and records of key actions taken in LynxERP, kept to protect accounts and to give clients an audit trail.
- Cookies: see section 11.
3.3 Information from sign-in providers
If you choose to sign in with Google or Microsoft, we receive limited identity information from them. See section 4.
3.4 Business data processed for our clients
Our clients enter and manage their own business data in LynxERP, which may include personal information about their customers, suppliers, staff and contacts. We process this data only to provide the service to that client (see section 2).
3.5 Mobile apps
Where a client company enables these features, and only with the permission you grant on your device, LynxERP mobile apps may collect:
- device location during a delivery or sales route, to record visits and proof of delivery;
- photos and signatures you capture, such as proof of delivery;
- barcode scans and other data you enter.
You can turn off location or camera access in your device settings at any time. Some features may not work without it.
3.6 LYNXTracker
LYNXTracker is a time-and-activity desktop app that client companies may provide to their staff.
- It collects your username and password when you clock in.
- Only while you are clocked in, and with your permission, it records the names of open application windows and browser tabs and sorts them into categories (for example email, social media or web browsing).
- It does not record the content on your screen or your keystrokes, and it does not collect location, photos or video.
- It collects nothing while you are clocked out.
4. Signing in with Google or Microsoft
LynxERP lets users of our client companies sign in with their company Google or Microsoft account instead of a separate LynxERP password. Sign-in is handled by our central sign-in service at portal.lynxerp.ca.
What we receive
When you choose "Sign in with Google" or "Sign in with Microsoft", and only after you approve it on the Google or Microsoft consent screen, we receive:
| Information | Why we need it |
|---|
| Your name | To show who is signed in on your LynxERP account |
| Your email address, and whether Google or Microsoft has verified it | To check your email domain belongs to a company registered with LynxERP, and to match you to your existing LynxERP user |
| Your unique Google or Microsoft account ID (and, for Microsoft, your organization's tenant ID) | To recognize you securely on later sign-ins, even if your email address changes |
| Your profile picture, if your account has one | To display on your LynxERP profile (optional) |
The permissions we request are: Google openid, email and profile; Microsoft openid, profile, email and User.Read.
What we do not receive
- We never receive your Google or Microsoft password.
- Sign-in does not give us access to your email, calendar, contacts, files, drive, Teams or any other data in your account.
- We do not access other people in your organization or your organization's directory.
How we use and keep it
- We use this information only to sign you in, keep your account secure, and keep a sign-in security log (date, time, IP address and sign-in method).
- We do not use it for advertising, we do not sell it, and we do not share it except as described in section 7.
- The tokens Google or Microsoft issue during sign-in are used once to confirm your identity and are not stored.
- We keep your account ID and email linked to your LynxERP user for as long as your company's LynxERP account is active and your user is enabled. Sign-in security logs are kept for up to 12 months.
Unlinking and deletion
5. How we use information
- To provide LynxERP: create and manage accounts, sign users in, process transactions our clients enter, and deliver the features clients use.
- To support you: answer enquiries, onboard new clients and resolve support tickets.
- To keep things secure: detect and prevent fraud, abuse, unauthorized access and security incidents, and keep audit trails.
- To improve our services: understand how the website and product are used, fix problems and develop new features, using aggregated or de-identified information where possible.
- To communicate with you: service notices, release notes and, where you have agreed, marketing emails. You can unsubscribe from marketing at any time; service notices are part of using LynxERP.
- To meet legal obligations: tax, accounting and other legal requirements, and to respond to lawful requests.
Some LynxERP features use third-party services to work. For example, an AI help assistant processes the questions you type to suggest answers, and mapping services convert addresses into map locations for routes and deliveries. Only the information needed for that feature is sent to the provider. Information we receive from Google or Microsoft sign-in is never used for these features.
6. Consent and legal bases
We collect, use and disclose personal information with your knowledge and consent, as required by Canada's Personal Information Protection and Electronic Documents Act (PIPEDA) and applicable provincial laws, except where the law allows otherwise. Consent may be express (for example, approving a Google or Microsoft sign-in screen) or implied (for example, sending us an enquiry so we can reply). You may withdraw consent at any time, subject to legal or contractual limits. We will explain what that means for the service.
Where the EU or UK General Data Protection Regulation applies, we rely on: performance of a contract (providing LynxERP); our legitimate interests (security, support and service improvement); consent (marketing and optional features); and legal obligations.
7. How we share information
We do not sell, rent or trade personal information. We share it only:
- With service providers who host, secure, back up, email or support our services on our behalf, under written confidentiality and data-protection obligations, and only as needed for that purpose;
- Within your company's LynxERP account, with other users and administrators your company has authorized;
- With integrations your company turns on (for example EDI partners, accounting or e-commerce platforms), as directed by your company;
- For legal reasons, when required by law, court order or a lawful government request, or to protect the rights, safety or property of Lynx, our clients or others;
- In a business transaction, such as a merger or sale of assets, where the recipient agrees to protect the information in line with this policy.
8. Where information is stored
Lynx is based in Canada. Information may be stored and processed in Canada and in other countries where our service providers operate, including the United States. When information is processed outside your province or country, it may be accessible to authorities there under local law. We use contractual and technical safeguards to protect it wherever it is processed.
9. How long we keep information
| Information | Retention |
|---|
| Enquiry and demo-request details | Up to 24 months after our last contact, unless you become a client |
| User accounts and linked Google/Microsoft sign-in IDs | While the client's account is active and the user is enabled, then deleted or de-identified within 90 days after the account closes |
| Sign-in security logs | Up to 12 months |
| Client business data | As instructed by the client and under our agreement. On termination, returned or deleted within 90 days, except backups, which expire on their normal cycle |
| Billing and accounting records | As long as tax and accounting law requires (generally 6 years in Canada) |
| Support tickets | Up to 36 months after the ticket closes |
| Server and website logs | Up to 12 months |
We may keep information longer where the law requires it, or to resolve disputes or enforce agreements.
10. How we protect information
- Encryption in transit (HTTPS/TLS) for the website, the application and the sign-in service.
- Passwords stored only as salted one-way hashes, account lockout after repeated failed sign-ins, and support for company single sign-on.
- Role-based access controls within LynxERP; Lynx staff access client data only when needed to provide or support the service.
- Separation of each client's data, regular backups and monitoring.
- Credentials for Google and Microsoft sign-in kept only on secured servers, never in source code.
No system is completely secure. If a breach of security safeguards creates a real risk of significant harm, we will notify affected individuals, our clients and the Office of the Privacy Commissioner of Canada as the law requires.
11. Cookies and similar technologies
- Essential cookies keep you signed in, protect forms against forgery and remember security settings. LynxERP cannot work without them.
- Preference cookies remember choices such as language or layout.
- Analytics cookies on our public website help us understand visits in aggregate.
You can manage cookies through our cookie banner and your browser settings. Blocking essential cookies will prevent sign-in. We do not use cookies inside the LynxERP application for third-party advertising.
12. Your rights and choices
Depending on where you live, you may have the right to:
- access the personal information we hold about you and learn how it is used and shared;
- correct inaccurate or incomplete information;
- delete information, or withdraw consent, subject to legal and contractual limits;
- receive a copy of your information in a portable format (data portability);
- object to or restrict certain processing, including direct marketing;
- complain to a privacy regulator.
To make a request, email info@lynxerp.ca. We will verify your identity and reply within 30 days (or sooner if your local law requires). If your request concerns business data a client company controls, we will pass it to that company and help it respond.
Residents of Quebec have rights under Quebec's Act respecting the protection of personal information in the private sector, and residents of the EU/UK under the GDPR. If you are not satisfied with our response, you may contact the Office of the Privacy Commissioner of Canada or your local data-protection authority.
13. Google API Services: Limited Use
LynxERP's use and transfer to any other app of information received from Google APIs will adhere to the Google API Services User Data Policy, including the Limited Use requirements. In particular, information we receive from Google is used only to provide and improve the user-facing features described in this policy; it is not used for advertising, not sold, not used to train generalized AI or machine-learning models, and not read by humans except with your consent, for security purposes, or to comply with the law.
14. Children
LynxERP is a business service and is not directed to children. We do not knowingly collect personal information from anyone under 16. If you believe a child has given us personal information, please contact us and we will delete it.
15. Third-party websites
Our website and application may link to other websites and services. Their privacy practices are governed by their own policies, and we are not responsible for them.
16. Changes to this policy
We may update this Privacy Policy from time to time. We will post the new version here with a new "Last updated" date. If changes are significant, we will give notice in the application or by email before they take effect.
Our Privacy Officer is responsible for our compliance with this policy. Please contact:
Privacy Officer, Lynx ERP Solutions Inc.
1030 Kamato Road, Unit 208
Mississauga, ON L4W 4B6, Canada
Email: info@lynxerp.ca
Phone: +1 (647) 875-0350