Privacy Policy
Updated: September 2026
1. Who we are
This Privacy Policy explains how Gruther, a company incorporated under the laws of France, with its registered office at 19 boulevard Malesherbes, 75008 Paris, France, handles personal data.
Gruther publishes the website at lensx.tech and operates LensX, a business-to-business platform that connects an organization’s HR, finance, and operations records into a single deterministic data layer, its organizational memory, and lets authorized people reason over that layer with AI assistance. LensX is sold to enterprises and consulting firms, including customers established in the European Union.
In this policy, “we”, “us” and “our” mean Gruther. “LensX” means the platform and the website. “Customer” means an organization that has entered into an agreement with us for the use of LensX.
2. How to contact us about privacy
For any question about this policy, about how your personal data is handled, or to exercise the rights described in sections 10 and 11, write to us:
- By email: info@lensx.tech
- By post: Gruther, 19 boulevard Malesherbes, 75008 Paris, France
Please put “Privacy” in the subject line so your request reaches the right people quickly.
3. Who this notice covers
This policy applies to four groups of people:
- Customer administrators and users. The people at a customer organization who hold a LensX account and use the platform.
- People whose data a customer processes through LensX. Typically the customer’s employees, candidates, contractors, clients, or counterparties, whose records the customer connects to the platform. For this group we act as a processor, not as a controller: see section 6.
- Website visitors. Anyone who browses lensx.tech.
- Prospects and business contacts. People who request a demonstration, write to us, or otherwise engage with us about the product.
This policy does not describe how our customers handle personal data in their own right. If your employer or another organization uses LensX to process information about you, that organization decides what is processed and why, and its own privacy notice governs that processing.
4. Account, billing, and support data
Account data. When a customer sets up LensX we collect the names, business email addresses, job titles, workspace roles, and authentication details of the people who will use the platform, together with records of their sign-ins and administrative actions. We act as a controller for this data. The legal basis is the performance of the contract between us and the customer, and our legitimate interest in keeping the service secure and accountable.
Billing data. We collect the billing contact, billing address, purchase order or order form references, and invoice and payment records associated with a customer account. We act as a controller for this data. The legal basis is the performance of the contract and, for the retention of accounting records, compliance with our legal obligations.
Support correspondence. When you contact us for support or ask a question, we keep your message, our reply, and any information you choose to include, so that we can resolve the issue and refer back to it later. We act as a controller for this data. The legal basis is the performance of the contract with the customer and our legitimate interest in providing and improving support.
5. Website visitor and prospect data
When you visit lensx.tech, our hosting infrastructure processes technical data needed to deliver the pages to you and to protect the site: IP address, browser and device type, the pages requested, referring URL, and timestamps. Where a link you followed carries campaign parameters, those parameters may be retained with a request you submit so that we understand which of our own materials led you to us.
If you request a demonstration or otherwise contact us, we process the business contact details and the content of your enquiry in order to respond and to keep a record of the exchange.
We act as a controller for this data. The legal basis is our legitimate interest in operating a secure website, in responding to enquiries addressed to us, and in understanding how our own published materials perform. Where you have given consent for a specific use, that consent is the basis and you may withdraw it at any time.
6. Customer records processed in LensX
The substance of LensX is the customer’s own records: HR data such as roles, job descriptions, skills, evaluations and org structure; finance data such as budgets, cost centres and transactions; and operations data such as projects, workloads and delivery records. Those records frequently contain personal data about the customer’s employees, candidates, contractors, clients, and counterparties.
For all of that content we act as a processor. The customer is the controller. We process those records only on the customer’s documented instructions, as set out in the service agreement and the data processing terms that form part of it, and for no independent purpose of our own. We do not sell that data, we do not use it to build products for other customers, and we do not use it to train models.
The practical arrangements, including storage, encryption, access control, retention and subcontracting, are described in our Data Processing Practices.
8. International transfers
We are established in France and our people work there. Personal data originating in the European Economic Area and processed by us therefore stays within the EEA, where the GDPR applies directly and no transfer safeguard is required for it to reach us.
A transfer outside the EEA arises only where one of the service providers named in section 7 is established outside it, or supports its service from outside it. For those transfers, and for personal data reaching us from the United Kingdom, we rely on appropriate safeguards under Chapter V of the GDPR, in particular the European Commission’s Standard Contractual Clauses, together with supplementary technical and organizational measures: encryption in transit and at rest, access restricted to the personnel who need it, logging of access to customer environments, and contractual limits on the purposes for which the data may be used.
Customers may request a copy of the transfer mechanism applicable to their agreement by writing to info@lensx.tech.
9. How long we keep personal data
- Account data: for the duration of the customer agreement and for a limited wind-down period afterwards, so that access can be restored if the customer returns and so that we can answer questions about the account.
- Customer records processed in LensX: for as long as the customer instructs. On termination they are returned or deleted within the window agreed in the service agreement.
- Billing and accounting records: for the period required by applicable accounting and tax law.
- Support correspondence and enquiries: for as long as needed to handle the matter and to keep a reasonable record of our dealings, then deleted.
- Website technical logs: for a short period, for security and troubleshooting.
10. Your rights
If the GDPR applies to the processing of your personal data, you have the right to request access to it (Article 15), to have inaccurate data corrected (Article 16), to have data erased in the circumstances the law provides (Article 17), to have processing restricted (Article 18), to receive data you provided in a portable format (Article 20), and to object to processing carried out on the basis of legitimate interests (Article 21). Where processing rests on your consent, you may withdraw that consent at any time, without affecting the lawfulness of processing carried out before the withdrawal.
In France the GDPR is supplemented by Law No. 78-17 of 6 January 1978 on information technology, data files and civil liberties, as amended, which carries the same rights and adds the right to give directives on what becomes of your personal data after your death.
A fuller explanation of each right, and of how to use it, is set out on Your GDPR Rights.
11. Exercising your rights
Write to info@lensx.tech, or to the postal address in section 2, describing the right you wish to exercise and the data concerned. We may ask for information sufficient to verify your identity before we act, so that we do not disclose personal data to the wrong person.
We respond within one month of receiving the request. Where a request is complex, or where we have received several requests from you, we may extend that period by up to two further months and will tell you within the first month if we do.
If your personal data is held in LensX on behalf of one of our customers, that organization is the controller and is the right party to address first. Please contact it directly. If you contact us instead, we will refer you to it, and we assist our customers in responding to requests they receive.
12. Complaints
We would prefer to resolve a concern with you directly, so please raise it with us first. You also have the right to complain to a supervisory authority.
If you are in the European Economic Area, you may complain to the supervisory authority of the member state where you live or work, or where the alleged infringement took place. Our own lead supervisory authority is the Commission nationale de l’informatique et des libertés (CNIL), 3 place de Fontenoy, 75007 Paris.
14. Automated processing and AI
LensX answers questions by reasoning over the records a customer has connected. The facts live in the customer’s deterministic data layer, not in model weights, and answers are traceable back to the records they were drawn from.
We do not use customer data to train models. Customer records are used to answer that customer’s questions and for no other purpose.
We do not ourselves take decisions producing legal effects concerning an individual, or similarly significantly affecting them, based solely on automated processing. Where a customer uses the platform to inform its own decisions about people, that customer is responsible for how it uses the output, including for keeping a human in the loop where the law requires one. Outputs are analytical support and should be reviewed before they are relied on.
15. Children
LensX is a business-to-business platform. It is not directed at children, and we do not knowingly collect personal data from children through the website or the platform. If you believe a child has provided us with personal data, write to info@lensx.tech and we will delete it.
16. Security
We encrypt data in transit and at rest, restrict access to the personnel who need it for a defined purpose, log access to customer environments, and separate customer workspaces from one another. Access within a customer’s workspace is granted by that customer, per person, team, or department.
No system is immune from risk, and we do not claim otherwise. Our approach is described in more detail on our Security page.
17. Changes to this policy
We update this policy when our practices, the platform, or the law change. The date at the top of this page shows when the current version was published. Where a change is significant we take reasonable steps to inform affected customers, and where the law requires consent for a new use, we ask for it before that use begins.