How Lenya uses Opportunity Model information

Who is responsible

The controller is Lenya ApS, Danish CVR 46552172, Svend Trøsts Vej 19, 3. 17, 1912 Frederiksberg C, Denmark.

Privacy contact: Oliver Holm Egeskov, Oliver@lenya.ai.

How you can reach this assessment

Most people start with an access code from Lenya. The code opens /opportunity, where you enter a first name and company website. The Growth Mindset-branded page opens the same entry without a code. Using that page does not mean the assessment is limited to a closed subscriber list. Some earlier visitors started with a personal invitation code instead.

What we collect

• Open entry: your first name and the company website you submit. We save them as a lead record as soon as you submit, even if you stop there, together with the time and any campaign tags in the link you used (utm_source, utm_medium and utm_campaign). We then fetch pages from that website to understand the business. As you continue, the same record keeps the three opportunities we showed you, the process you chose, and the furthest step you reached: analysis shown, process chosen, Blueprint finished, phone number given, call booked.
• Invitation: contact details already held for that invitation, typically first name, last name, work email, company, job title and, where provided, a mobile number. Those details may have been collected earlier, for example through Lenya outreach, rather than typed in by you on this site.
• Your answers about how the company handles selected workflows, including any short description you type.
• At the end of the main assessment: a mobile number, which Lenya uses to text you about your results. The note under that field reads: “We'll text you about your results. Only me, no spam. Reply stop anytime. — Oliver, founder of Lenya”
• An email address. On the Automation Blueprint page you give one to open your Blueprint, and we email you a PDF copy of it. Elsewhere it is optional, so Lenya can send you the Blueprint PDF you ask for. Lenya may follow up with you by email.
• On the Automation Blueprint page: your answers to two questions, your number of employees and your annual revenue (as a range, or “prefer not to say”). With the industry we read from your website, a fixed rule uses them to choose which form you see: some readers are asked for an email and a mobile number, others for their company name and an email only. We keep the answers, that result and the Blueprint we wrote on your lead record. The rule changes only which form and offer you see, not the Blueprint itself.
• If you give your mobile number but no email address, we may look up a work email for you in Apollo.io, a business-contact database, using your first name and your company's website. We keep it only if Apollo has verified it and it is at your company's own web address, and we mark it as found by Apollo.
• After you finish, an automated first look at whether your company fits the businesses Lenya works with: its rough size, country and industry, worked out from your website, your answers and a web search for your company.
• Browser session storage used to keep the assessment working (for example a session token, answers and contact details you have entered), and your cookie choice, kept in local storage. Some demo or review tools also use local storage on that device.
• If you arrived via a partner-branded page such as Growth Mindset, a short partner identifier (for example growth-mindset) stored in browser session storage so the branded presentation can continue for that session, and recorded on your lead record. That identifier is not needed to run the assessment itself.
• Security records for invitation attempts use a one-way hash derived from a browser nonce and technical request data. Limits that stop the assessment being overused rely on a one-way hash of the network address each request came from. The raw IP address and browser string are not stored for either purpose. The hash can still be personal data. (The address and browser type are stored only with a mobile number you give, as proof of what you were told; see “Texts from Lenya”.)
• Visits to the entry page are counted by our server as it serves the page, without cookies and without storing anything on your device: one count per visitor per day, using a one-way hash of your network address and browser that changes every day, so visits cannot be linked from one day to the next. The raw address is not stored.
• If you book an implementation call, a random reference for this visit is passed to Cal.com with the booking so it can be matched to your analysis, and Cal.com tells Lenya the booking's name, email and time when you book, reschedule or cancel.

You do not have to complete the assessment. If you do not provide the details a given path needs, that path cannot prepare or open the Blueprint. Lenya does not send you marketing texts from this assessment.

Cookies and similar storage

Essential storage is always on: the session storage that keeps the assessment working, the partner page you arrived on, and your cookie choice (kept for up to 12 months).

Only if you press Accept on the cookie banner, we also:

• record usage events (for example which steps were reached and how long the analysis took), stored by Lenya against your assessment session rather than your name;
• remember the partner page or tagged link you came from for 30 days in local storage, so a referral still counts if you come back later. If you then submit a website, those visits (up to ten, from the last 30 days) are saved on your lead record.

This product uses no third-party analytics, advertising pixels, visitor-identification or session-recording tools. If you press Reject, the model still works fully and none of the optional storage or tracking is used. The campaign tags in the link you used are still saved on your lead record when you submit your website, because they are part of that request. Separately, the server keeps operational logs of how each analysis ran (timings and errors, not your answers) to keep the service working; these do not depend on cookies. Nor does a short alert to Lenya if the analysis or Blueprint fails for you, so someone can follow up. You can change your choice at any time with Cookie settings, at the top or bottom of each page. The booking calendar is loaded from Cal.com only when you open it, and Cal.com may then set its own cookies under its own privacy notice.

What we use it for

We keep these purposes separate:

• Assessment delivery. Preparing and showing your Automation Blueprint, including company-website analysis and the example output.
• Security. Checking access codes, limiting abuse, and keeping sessions scoped to the person who opened them.
• A text about your results. One text from Oliver after your Blueprint is ready, asking about your results, which you can answer or ignore. It is not a marketing sequence, and we do not send sales offers by text unless you reply and ask.
• Referral attribution. Recording which partner page or tagged link brought you here, and, if you accepted cookies, which partner pages or tagged links you visited in the 30 days before you submitted your website. This application does not export your answers or mobile number to that partner. We may tell a partner how many people came through their link and the names of referred companies that became clients, so their share can be paid. We never give a partner your answers, mobile number or email address.
• Follow-up. Oliver reviewing the result and following up with you about your analysis, including the opportunities you were shown and even if you stop before the end, and, if you choose to open booking, arranging an implementation conversation. To do this we record your enquiry in our customer relationship system (CRM), Twenty, and Oliver gets an email about it. On the main assessment, nothing about you or your company goes into the CRM unless you give your mobile number. On the Automation Blueprint page, the email you give to open your Blueprint also records your enquiry in the CRM, with or without a mobile number.
• With your consent, understanding in aggregate how the product is used.

We do not sell this information.

Lawful bases

For the processing needed to provide the assessment you asked for — contact details required for the path, company-website research, answers, Blueprint generation, and session storage that makes the assessment work — we rely on legitimate interests: giving you the company-specific result without using more personal information than that work needs.

For the lead record created when you submit your website, and for following up with you about that analysis, we rely on legitimate interests in responding to a business that asked for one. You can object at any time by emailing Oliver.

For recording your enquiry in our CRM, the automated first look at your company, and looking up a work email so Oliver can follow up by email, we rely on legitimate interests in following up with a business that asked for an assessment. You can object to any of these by emailing Oliver.

For optional usage analytics and for remembering your source beyond the visit, we rely on your consent, given with Accept. You can withdraw it with Cookie settings.

For protecting the access-code page against guessing and abuse, we rely on a separate legitimate interest in keeping the service secure. Hashed technical data is still treated as personal data.

For the text about your results, we rely on legitimate interests in following up on the Blueprint you asked for, which the note under the number field tells you about. We do not send marketing texts from this assessment, so no marketing consent is collected.

If you open the booking calendar, Cal.com receives whatever you enter on that booking form so you can complete a requested implementation conversation. The calendar is loaded only then. The lawful basis we use for that business-contact booking is legitimate interests, not the fact that the calendar only loads when you open it. We do not treat you as a party to an implementation contract merely because you finished the assessment.

These bases are not used for unrelated marketing, partner disclosures of your answers, or extra device tracking.

You can object to processing based on legitimate interests at any time, including by replying STOP to a text. Opting out of texts does not by itself delete the assessment record.

Texts from Lenya

A few minutes after your Blueprint is ready, Oliver sends one text about your results, from Lenya’s UK number. Texts identify Oliver and Lenya. None are sent between 22:30 and 07:30 in your time zone (worked out from your number’s country, or your browser where a country has several); a text due then goes between 07:30 and 08:15. Each number gets that automatic text only once. If you reply, Oliver answers by hand.

You can withdraw at any time by replying STOP to a text from us, or by emailing Oliver@lenya.ai. A STOP reply adds your number to our opt-out list and cancels any text still queued for you.

With your number we keep a record of the exact note you were shown, its version, the time, where you came from (for example the newsletter link), and the IP address and browser type that submitted it, so we can show what you were told. Texts can be sent to mobile numbers in any country.

Earlier versions of this assessment had an optional box for marketing texts. Ticks given there are not used for anything beyond what that box said.

If a text is sent, Twilio (our text provider), Missive (the inbox where we read and answer replies) and the relevant mobile networks process your number, the message, timestamps and delivery state. This product does not start a new marketing sequence from a free-text reply.

Automated analysis

We use AI services to read company-website material and your workflow answers, then draft the Blueprint. Contact details are kept out of that analysis where the product is built to redact them. This is automated processing of the information you (or the invitation) provided. The Blueprint is an illustrative company assessment, not a legal decision about you as an individual and not a solely automated decision with legal or similarly significant effects. Hours and similar ranges come from the bands you select, not from the model inventing numbers.

After you finish, an AI also gives Oliver a first suggestion of whether your company looks like a fit. It is only a suggestion: Oliver decides, it doesn't change your Blueprint, and it has no legal or similarly significant effect on you.

Who receives it

• Lenya’s operators, so Oliver can review and follow up.
• Lovable, which hosts this website and its database (Supabase), including the server logs that hosting creates, such as IP addresses.
• OpenAI, for reading the public company website, identifying opportunities, interpreting process answers and drafting the Blueprint (on the Automation Blueprint page, only as a backup), and for the first look at your company after you finish. Our requests ask OpenAI not to store them.
• Twenty, our customer relationship system (CRM), where Oliver keeps your enquiry.
• Resend, which delivers the internal emails to Oliver about new enquiries and the Blueprint PDF we email you (your email address, first name and Blueprint).
• Apollo.io, which receives your first name and your company's website and name if we look up a work email for you.
• Anthropic, which writes the Automation Blueprint from what we read on your website and your two answers, and for company research and some interview steps on the invitation path.
• Twilio, which sends our texts, and Missive, where we read and answer replies, if a marketing text is sent.
• Instantly, where an invitation was created from Lenya’s Instantly outreach (name, email, company and related lead fields already held in that campaign).
• Cal.com, if you open the booking calendar and enter details there.

Growth Mindset provides branding on its entry page. The partner identifier described above is used for that branded session and on Lenya’s lead record. It does not export your answers, mobile number, or a subscriber list to Growth Mindset. Separate off-app sharing, if any, is not part of this product.

Some of these providers operate outside Denmark. An EU database location, if used, would not by itself mean every log, support channel or subprocess stays in the EU. Email Oliver@lenya.ai if you want the current transfer details for the providers above.

How long we keep it

We keep Opportunity Model enquiry records for up to 12 months after our last contact with you, unless you become a client or ask us to delete them sooner. Automatic deletion is not switched on yet, so we remove old records by hand. You can email Oliver@lenya.ai at any time to ask us to delete your information. This includes the copy in our CRM and the emails about your enquiry in our inbox: when we delete your record, we delete those too.

Consent evidence and opt-out/suppression records are kept separately from routine SMS delivery logs. We keep them for as long as needed to show what was agreed if there is a complaint, and to avoid contacting someone who has opted out.

These practices do not automatically apply to customer contracts, invoices, commission records, or information genuinely needed for a dispute. Whole assessment answers are not kept merely because an invoice must be retained.

Session storage lasts for the browser session. Access codes are stored as a lookup digest and a bcrypt verifier, not in plain text. Deletion from backups and from third-party systems is not immediate unless that provider actually supports it.

Your rights

You can ask for a copy of your information, ask us to correct it, delete it, restrict it, or object to processing based on legitimate interests. You can also object to direct marketing, including SMS. Where consent is used, you can withdraw it by emailing Oliver@lenya.ai. Where portability applies, you can ask for a machine-readable copy of information you provided.

These rights are not unlimited. If we refuse a request we will explain why.

You can complain to Datatilsynet, the Danish data protection authority, at datatilsynet.dk. If UK data protection law applies to you, you can also complain to the ICO at ico.org.uk.