Lineman -- Privacy Policy

Last updated: July 2026

This Privacy Policy explains how Goo Holdings Ltd (trading as "Lineman") collects, uses, shares, and protects your personal data when you use the Lineman service, visit our website, or interact with our support channels. Please read it carefully alongside our Terms and Conditions, which govern your use of the Service.

Goo Holdings Ltd is a company registered in England and Wales under company number 17141115, with its registered office at 79 Shawclough Way, Greater Manchester, OL12 6DS, England.

Where we use capitalised terms not defined in this policy, they have the meanings given in our Terms and Conditions.

Definitions
What Personal Data We Collect
Customer Content -- How We Handle Your Code
How and Why We Use Your Data
Data Sharing and Sub-processors
International Data Transfers
Data Retention
Cookies and Similar Technologies
Your Rights Under UK GDPR
Jurisdiction-Specific Disclosures
Children's Privacy
Data Security
Changes to This Policy
Contact Us

1. Definitions

In addition to the definitions in our Terms and Conditions, the following terms apply throughout this policy:

"Personal Data" means any information relating to an identified or identifiable natural person, as defined in UK GDPR Article 4(1).

"Processing" means any operation performed on Personal Data, including collection, recording, storage, retrieval, use, disclosure, and erasure.

"Controller" means the entity that determines the purposes and means of processing Personal Data.

"Processor" means an entity that processes Personal Data on behalf of a Controller.

"Data Subject" means the individual to whom Personal Data relates.

"Sub-processor" means a third party engaged by Goo Holdings Ltd to process Personal Data on its behalf.

"ICO" means the Information Commissioner's Office, the UK's independent supervisory authority for data protection.

2. What Personal Data We Collect

We collect and process the following categories of personal data:

2.1 Account Data

When you create an account, we collect:

Name
Email address
Organisation name (if applicable)
Billing address
Account configuration and preferences

2.2 Payment Data

When you subscribe to the Service, payment is processed by our third-party payment processor. We receive a transaction reference, billing address, and the last four digits of your payment method. We do not store full card numbers or bank account details on our systems.

2.3 Usage Data and Telemetry

We collect anonymised, aggregated operational data about how you use the Service:

Task types and categories
Token counts and model selection
Latency measurements and error rates
Feature usage and API access patterns

Cost-attribution data. Where cost reporting is enabled for your installation, we also collect a usage stream that attributes your AI agent token spend to the working context it was incurred in, so that you (and, where applicable, your organisation's administrators) can see where cost goes. Each cost-attribution record contains:

The repository remote identifier (host, owner and repository name), the branch name, the commit identifier, and any ticket reference parsed from the branch name of the project you are working in
Your Claude account identifier and organisation identifier, hashed on your machine before transmission (the raw identifiers never leave your machine)
Your Claude plan type and rate-limit tier
A session identifier, token counts, and the cost figure derived from them
Timestamps

Repository and branch names are workplace identifiers and may occasionally contain personal data (for example, a branch named after a person). We treat the cost-attribution stream as personal data accordingly. Cost-attribution records never contain message content, prompts, code, or file contents: only token counts and the identifiers listed above are read and transmitted.

Usage Data does not contain Customer Content. It is collected and stored separately from any code or files you process through the Service.

You can disable Usage Data and Telemetry collection, including the cost-attribution stream, at any time via the /lineman:telemetry off command in the Lineman MCP plugin (equivalently: lineman-mcp telemetry off from a terminal, or setting the environment variable LINEMAN_TELEMETRY=off). Disabling telemetry stops collection of all data described in this Section 2.3.

2.3.1 Service-Operation Stream ("phone home")

Independently of telemetry, the Lineman MCP plugin sends a minimal "service-operation" event stream that we rely on to operate the product. This stream carries:

A randomly generated install identifier (install_id) and, if you have signed in, your user identifier (user_id)
The version of the Lineman MCP plugin installed on your machine
A snapshot of your service configuration: telemetry on/off, signed-in/anonymous, plan tier
Lifecycle events: plugin start, version upgrade, sign-in / sign-out, telemetry-toggle
A snapshot of the Git repository state of the project you are working in: the origin remote URL, the current branch, the current commit SHA, and whether your working tree has uncommitted changes. We use this to correlate failures we observe in the Service to a specific source-code state, so we can replay scenarios with adjusted settings during beta-test triage. If your project is not a Git repository, or if you do not have a git binary installed, this snapshot is omitted. If you set the environment variable LINEMAN_REDACT_REPO_REMOTE=1, the remote URL is replaced with an irreversible SHA-256 hash before transmission (we still see the SHA, branch, and dirty flag).

This stream does not contain Customer Content, file contents, prompts, command output, or stack traces. It exists so that we can count active installs, identify which release is in the field for crash-rate and regression analysis, trace the sign-in / sign-out funnel for support, and correlate failures to a specific source state for replay.

Because it is required to operate the Service safely, this stream cannot be disabled while you continue to use the Lineman MCP plugin. It is collected on the basis of legitimate interests (UK GDPR Article 6(1)(f)). If you do not want this data collected, please uninstall the plugin.

2.4 Security Logs

To maintain the security of the Service, we collect:

Authentication events (login times, methods used)
IP addresses
API access patterns
Anomaly detection signals

2.5 Error Logs

We collect anonymised error traces to diagnose and resolve technical issues. Error logs do not contain Customer Content.

2.6 Support Data

When you contact us for support or submit feedback, we collect:

The content of your correspondence
Your email address and name
Any attachments or screenshots you provide

2.7 Website Data

When you visit our website, we may collect:

Pages visited and time spent
Referral source
Browser type and version
Device type and operating system
IP address (which may be truncated or anonymised)

3. Customer Content -- How We Handle Your Code

This section explains how we handle the code, files, and data you submit for processing through the Service ("Customer Content"). This is central to our privacy commitment.

3.1 Transient processing only

Customer Content is processed in real-time and, by default, is not retained after the response is delivered to you. We do not maintain a persistent store of your code. The only departures from this default are the limited operational exceptions in Section 3.3, including the opt-in session-memory feature described there, which stores bounded extracts for a defined retention period (see Section 7).

3.2 No training, no fine-tuning, no model improvement

Goo Holdings Ltd does not use Customer Content to train, fine-tune, or improve AI models. This commitment is absolute and applies to all deployment topologies and subscription tiers.

3.3 Limited operational exceptions

Customer Content may be temporarily retained, subject to strict data minimisation, solely for the following purposes:

Short-term caching to complete multi-step requests within a single session
Opt-in session memory (Smart Compaction task artifacts): if you enable the Smart Compaction feature (off by default), extracts of your AI-assistant session conversation -- the completed-task regions, including verbatim conversation turns, an intent line, an outcome summary, and a list of related files -- are stored on our servers so they can be restored into your session on request after your assistant compacts its context. These extracts are stored in memory (not on durable disk), are keyed to your authenticated account and session, are retained for 24 hours, and are deleted automatically when the retention period expires (a server-side hard cap guarantees no extract can ever persist longer than 7 days)
Abuse detection and prevention where there is a reasonable basis to suspect misuse
Security monitoring and incident response to protect the Service and its users
Debugging where necessary to resolve a specific technical issue (with data minimisation and prompt deletion)
Legal compliance where required by law or legal process

All operational retention is subject to defined retention periods, access controls, and the principle of data minimisation.

3.4 Cloud processing

When you use the Lineman API (cloud endpoint), your code is transmitted to Goo Holdings Ltd servers for processing. It is processed transiently and discarded after the response is delivered, subject to the limited operational exceptions above.

3.5 Data protection roles for Customer Content

Business customers: Goo Holdings Ltd acts as a Processor for Customer Content processed on your behalf. A Data Processing Agreement (DPA) is available and forms part of the Terms for business users.
Consumer users: Goo Holdings Ltd may act as a Controller or joint Controller for certain processing activities related to the Service. The lawful basis and your rights are set out in Sections 4 and 9 of this policy.

4. How and Why We Use Your Data

Under UK GDPR, we must have a lawful basis for each type of processing. The table below sets out our purposes and the lawful basis we rely on for each.

4.1 Performance of contract (UK GDPR Article 6(1)(b))

Providing the Service and processing your requests
Managing your account and subscription
Processing payments
Sending service-related communications (e.g. subscription confirmations, service updates, security notices)

4.2 Legitimate interests (UK GDPR Article 6(1)(f))

We have carried out a balancing assessment for each of the following purposes and concluded that our legitimate interests are not overridden by your rights and freedoms:

Maintaining security and preventing abuse: collecting security logs and limited operational data to detect and respond to threats
Improving reliability: collecting error logs and telemetry to diagnose issues, monitor performance, and improve the stability of the Service
Product and usage analytics: using Usage Data, including events tied to your account identifier (your user ID, and your email address where you are signed in), to understand how the Service is used, measure your progress through onboarding and billing, and inform product development. The analytics that run on our public website load only after you consent and can be switched off at any time through the cookie settings (see Section 8.3); for the signed-in, server-side journey analytics we rely on, you may object at any time (see Section 9.6).
Fraud prevention: detecting and preventing fraudulent activity on the Service

4.3 Consent (UK GDPR Article 6(1)(a))

Marketing communications: we will only send you marketing emails if you have opted in. You may withdraw consent at any time by clicking the unsubscribe link in any marketing email or by contacting us at privacy@lineman.io.

4.4 Legal obligation (UK GDPR Article 6(1)(c))

Retaining payment and billing records as required by tax and accounting law
Responding to lawful requests from law enforcement or regulatory authorities
Complying with court orders or other legal process

4.5 No model training

For the avoidance of doubt, we do not rely on legitimate interests or any other lawful basis to use your Customer Content or Personal Data for training, fine-tuning, or improving AI models.

5. Data Sharing and Sub-processors

5.1 Categories of recipients

We may share your Personal Data with the following categories of third parties, solely for the purposes described in this policy:

Cloud infrastructure providers -- hosting, compute, and storage for the Service
LLM inference providers -- third-party model providers used to process tasks through the cloud API
Payment processors -- to process subscription payments securely
Support tools -- to manage support tickets and correspondence
Analytics providers -- to process aggregated, anonymised usage data (if applicable)

5.2 Sub-processor obligations

All sub-processors are bound by data processing agreements that require them to:

Process Personal Data only on our documented instructions
Implement appropriate technical and organisational security measures
Notify us of any personal data breach without undue delay
Delete or return Personal Data at the end of the engagement

5.3 Sub-processor list

Our current sub-processors are published, so you can consult the list without having to ask:

Sub-processors that handle Customer Content (Customer Personal Data) -- for example our cloud infrastructure, inference, payment, and email providers -- are listed in Annex C of our Data Processing Agreement.
Website-analytics sub-processors that process website-visitor data (Google Analytics 4, PostHog, and Microsoft Clarity) are listed, with their purpose, the categories of data they receive, and the applicable transfer safeguards, in Section 8.2.

You may also request the current list at any time by emailing privacy@lineman.io. We will provide reasonable advance notice before engaging a new sub-processor that processes Personal Data.

5.4 No selling of Personal Data

We do not sell your Personal Data to third parties. This applies under all circumstances and all applicable privacy regimes, including the California Consumer Privacy Act (CCPA/CPRA).

5.5 Law enforcement and legal disclosure

We may disclose Personal Data where required to do so by law, court order, or regulatory authority. Where permitted, we will notify you before making such a disclosure.

6. International Data Transfers

Your Personal Data may be transferred to, and processed in, countries outside the United Kingdom and European Economic Area. Where such transfers occur, we ensure that appropriate safeguards are in place:

UK International Data Transfer Agreement (IDTA): We use the UK IDTA as our primary transfer mechanism for transfers outside the UK.
UK Addendum to the EU Standard Contractual Clauses: Where appropriate, we rely on the UK Addendum to the EU SCCs.
Adequacy decisions: Where the UK government has made an adequacy decision for the recipient country, we rely on that decision.

You may request information about the specific safeguards applied to transfers of your data by contacting privacy@lineman.io.

7. Data Retention

We retain Personal Data only for as long as necessary to fulfil the purposes for which it was collected, or as required by law. The following retention periods apply:

Account Data: deleted within 30 days of account closure; any copies held in routine backups are purged within 90 days
Payment records: retained for 6 years after the transaction date, as required by UK tax and accounting law (the Companies Act 2006 and HMRC record-keeping requirements)
Customer Content: not retained -- processed transiently and discarded after response delivery (subject to the limited operational exceptions in Section 3.3)
Smart Compaction task artifacts (opt-in, see Section 3.3): retained for 24 hours from storage, then deleted automatically (with a server-side hard cap of 7 days in all cases)
Security and audit logs: retained for 12 months
Telemetry and Usage Data: retained for 13 months by default, configurable per account (plan-tier defaults plus a per-account setting); cost-attribution records older than your account's configured period are deleted by a daily scheduled purge
Error Logs: retained for 90 days
Support correspondence: retained for 24 months after the matter is resolved

7.1 Account deletion

You may request deletion of your account and all associated Personal Data at any time. We will process deletion requests within 30 days, subject to any legal retention obligations (for example, tax records that must be kept for a statutory period). To request deletion, email privacy@lineman.io or use the account settings in the Service.

8. Cookies and Similar Technologies

8.1 How we use cookies and how consent works

We and our analytics and advertising providers use cookies, local storage, pixels, software development kits, and similar technologies (together, "cookies") on our public website and within the signed-in Service.

When you first visit our website you are shown a cookie-consent banner provided by CookieHub. We operate Google Consent Mode v2 on a default-deny basis: until you make a choice, every non-essential category (preferences, analytics, and advertising/marketing) is denied, and the tags in those categories stay queued and set no cookies. Only strictly necessary storage (for example, security tokens) is enabled by default. A tag in a given category loads, and sets its cookies, only after you grant that category through the banner. You can review, change, or withdraw your choices at any time (see Section 8.4); withdrawing a category stops those tags from loading on future page views, though it does not undo processing that already took place while consent was active.

We rely on your consent (UK GDPR Article 6(1)(a) and the Privacy and Electronic Communications Regulations) as the lawful basis for every non-essential cookie in the preferences, analytics, and marketing categories. The categories the banner asks you to consent to map to the cookies described below.

8.2 Categories of cookies we use

Strictly necessary (always on, no consent required). These are needed for the Service to work and cannot be switched off:

Authentication and session cookies that keep you signed in, set by our authentication provider.
The cookie that records your own consent choices, set by CookieHub.
Security cookies (for example, cross-site-request-forgery protection). Under Consent Mode v2 these correspond to security_storage, which is granted by default.

We also run error and performance monitoring (Sentry) across the Service to detect crashes and diagnose faults. It is configured not to record session replays and not to collect default personal identifiers, and it does not set advertising or analytics cookies.

Preferences / functional (CookieHub "preferences" category). Cookies that remember choices you make, such as interface preferences. They load only if you grant the preferences category (functionality_storage and personalization_storage under Consent Mode v2).

Analytics (CookieHub "analytics" category). These help us understand how the website and the Service are used so that we can improve them. They load only after you grant the analytics category (analytics_storage). Our analytics providers are:

Google Analytics 4 (Google): aggregated website- and product-usage measurement, delivered through Google Tag Manager and routed via our first-party, server-side tagging endpoint (sst.lineman.io). Sets Google analytics cookies (for example, _ga). Data categories: a pseudonymous client/cookie identifier (_ga), device and browser information, approximate location derived from a truncated IP address (full IP addresses are not stored in Google Analytics), and the pages you view together with on-site usage events.
PostHog (hosted in the European Union): product and website analytics (events and funnels), with first-party ingestion via our own endpoint (gt68.lineman.io). Session replay is switched off; on our public marketing pages PostHog also captures heatmaps (aggregated click, scroll and pointer-position metadata, not a session recording). PostHog profiles are created only for signed-in users. Data categories: a pseudonymous device/visitor identifier, device and browser information, approximate location derived from your IP address, page views with product events (funnels), and page-interaction metadata such as clicks, scrolls and pointer movement (heatmaps). For signed-in users these are associated with your account identifier (see Section 8.3).
Microsoft Clarity (Microsoft Corporation): session replay and heatmaps. Clarity runs on our public marketing pages only, and is hard-disabled on every signed-in area (your dashboard, onboarding, and the admin console), so those pages are never recorded. It masks the content typed into form fields by default and sets its own cookies (_clck and _clsk). Data categories: a pseudonymous session/visitor identifier (_clck and _clsk), device and browser information, approximate location derived from your IP address, and page-interaction metadata such as clicks, scrolls, mouse movement and navigation (with form-field content masked). Clarity processes data in the United States; where data is transferred outside the UK and the European Economic Area, we rely on the transfer safeguards described in Section 6.

Advertising / marketing (CookieHub "marketing" category). These let us measure the effectiveness of our advertising and reach relevant audiences on third-party platforms. They load only after you grant the marketing category (ad_storage, ad_user_data, and ad_personalization). Our advertising and marketing providers are:

Google Ads (Google): conversion measurement and remarketing.
Meta Pixel (Meta, covering Facebook and Instagram): conversion measurement and audience matching.
LinkedIn Insight Tag (LinkedIn): conversion measurement and audience matching.
X Pixel (X, formerly Twitter): conversion measurement and audience matching.
TikTok Pixel (TikTok): conversion measurement and audience matching.
Reddit Pixel (Reddit): conversion measurement and audience matching.
HubSpot (HubSpot): marketing and CRM attribution; it sets the hubspotutk cookie that identifies a contact in our CRM. It loads on our production website only.
LinkJolt (LinkJolt): affiliate and referral attribution, used to credit a partner when you arrive through a referral link.
Apollo.io (Apollo): business-to-business website-visitor identification. It helps us recognise the organisations (and, for visitors in the United States, individuals) interested in Lineman so our sales team can follow up, and it de-anonymises visits by matching them against Apollo's business dataset. To resolve individual visitors it uses a third-party identity graph provided by LiveIntent. It loads on our production website only and processes data in the United States; where data is transferred outside the UK and the European Economic Area, we rely on the transfer safeguards described in Section 6.

Some of these browser tags are paired with a server-side measurement endpoint (a conversions API) so that conversions can still be measured when a browser blocks the tag; that server-side measurement is subject to the same consent signal. Because these are advertising and marketing technologies, they may involve sharing limited, hashed, or pseudonymous identifiers with the relevant platform for measurement and audience matching.

We do not hold a single retention figure for every third-party cookie, because each provider sets its own. As a guide, cookies in these categories last for the duration of your session, or for a period set by the relevant provider (typically up to a number of months, and longer for some analytics and advertising cookies). Each provider's own cookie and privacy documentation states the precise durations.

8.3 Analytics and advertising on signed-in areas

To be clear about where these technologies operate:

Session replay (Microsoft Clarity) never runs on signed-in areas. It is hard-disabled on your dashboard, onboarding, and the admin console, so those pages are never recorded.
Our product analytics (Google Analytics 4 and PostHog) do operate across the Service, including signed-in journey steps such as onboarding and billing, and, once you are signed in, are associated with your account identifier so that we can understand and improve the product experience. They record interaction and journey metadata, for example which steps you complete. They do not capture your Customer Content, code, prompts, file contents, or the contents of your repositories. They still load only after you have granted analytics consent.

8.4 Managing your choices

You can review, change, or withdraw your cookie consent at any time:

Re-open the cookie preferences panel through the CookieHub consent control to change which categories you allow. Withdrawing a category stops those tags from loading on future page views; withdrawal does not affect processing carried out while consent was active.
Browser controls: you can block or delete cookies through your browser settings. Disabling strictly necessary cookies may prevent the Service from functioning correctly. For general information about cookies, visit allaboutcookies.org.

We will update this section if our cookie or tracking practices change.

9. Your Rights Under UK GDPR

Under the UK General Data Protection Regulation, you have the following rights in relation to your Personal Data:

9.1 Right of access

You have the right to request a copy of the Personal Data we hold about you, together with information about how it is processed.

9.2 Right to rectification

You have the right to request that we correct any inaccurate or incomplete Personal Data.

9.3 Right to erasure

You have the right to request that we delete your Personal Data. We will comply within 30 days, subject to any legal retention obligations.

9.4 Right to restriction of processing

You have the right to request that we restrict the processing of your Personal Data in certain circumstances -- for example, where you contest its accuracy or object to our processing.

9.5 Right to data portability

You have the right to receive a copy of your Personal Data in a structured, commonly used, and machine-readable format, and to transmit it to another controller, where the processing is based on consent or contract and is carried out by automated means.

9.6 Right to object

You have the right to object to processing based on our legitimate interests. We will stop processing unless we can demonstrate compelling legitimate grounds that override your rights and freedoms.

9.7 Right to withdraw consent

Where we process your data on the basis of consent, you may withdraw that consent at any time. Withdrawal does not affect the lawfulness of processing carried out before withdrawal.

9.8 How to exercise your rights

To exercise any of these rights, email privacy@lineman.io. We will respond within one calendar month. If your request is complex or we receive a large number of requests, we may extend this by a further two months, in which case we will notify you within the first month.

We will not charge a fee for exercising your rights unless the request is manifestly unfounded or excessive, in which case we may charge a reasonable fee or refuse the request.

9.9 Right to complain

If you are not satisfied with our response, you have the right to lodge a complaint with the ICO:

Information Commissioner's Office Wycliffe House, Water Lane, Wilmslow, Cheshire, SK9 5AF Website: ico.org.uk Telephone: 0303 123 1113

We would appreciate the opportunity to address your concerns before you contact the ICO, so please reach out to us first at privacy@lineman.io.

10. Jurisdiction-Specific Disclosures

10.1 California (CCPA/CPRA)

If you are a California resident, the following additional disclosures apply under the California Consumer Privacy Act as amended by the California Privacy Rights Act:

Categories of Personal Information collected: Identifiers (name, email, IP address); commercial information (subscription and payment records); internet or electronic network activity (usage data, telemetry, security logs); professional or employment-related information (organisation name, if provided).

Business or commercial purpose for collection: as described in Section 4 of this policy.

Categories of third parties with whom we share Personal Information: service providers (cloud infrastructure, payment processors, support tools) as described in Section 5.

Sale or sharing: We do not "sell" or "share" your Personal Information as those terms are defined under the CCPA/CPRA. We have not sold or shared Personal Information in the preceding 12 months.

Your California rights:

Right to know: You may request that we disclose the categories and specific pieces of Personal Information we have collected about you.
Right to delete: You may request deletion of your Personal Information, subject to statutory exceptions.
Right to correct: You may request correction of inaccurate Personal Information.
Right to opt out of sale/sharing: Not applicable, as we do not sell or share your data.
Right to non-discrimination: We will not discriminate against you for exercising your CCPA rights.

To exercise these rights, email privacy@lineman.io.

10.2 Brazil (LGPD)

If you are located in Brazil, the Lei Geral de Protecao de Dados (LGPD) provides you with additional rights:

Lawful bases: We rely on the performance of contract, legitimate interests, and consent (where applicable), which correspond to the bases set out in LGPD Article 7.

Your LGPD rights include: confirmation of the existence of processing; access to your data; correction of incomplete, inaccurate, or outdated data; anonymisation, blocking, or deletion of unnecessary or excessive data; data portability; deletion of data processed with consent; information about public and private entities with which we share data; information about the possibility of denying consent and the consequences; and revocation of consent.

To exercise your rights under the LGPD, email privacy@lineman.io.

10.3 Other jurisdictions

Where mandatory local law in your jurisdiction provides data protection rights that are stronger than those set out in this policy, those rights are preserved and prevail to the extent of any inconsistency. This includes, without limitation, rights under the EU General Data Protection Regulation (where applicable), the Canadian Personal Information Protection and Electronic Documents Act (PIPEDA), and other applicable data protection legislation.

11. Children's Privacy

The Service is intended for users aged 18 and over. We do not knowingly collect Personal Data from anyone under the age of 18. If we become aware that we have collected Personal Data from a child under 18, we will take steps to delete that data promptly.

If you believe that a child under 18 has provided Personal Data to us, please contact us immediately at privacy@lineman.io.

12. Data Security

We implement appropriate technical and organisational measures to protect your Personal Data against unauthorised access, alteration, disclosure, or destruction. These measures include:

Encryption of data in transit (TLS) and at rest
Access controls limiting data access to authorised personnel on a need-to-know basis
Regular security assessments and monitoring
Incident response procedures

No method of transmission over the internet or electronic storage is completely secure. While we take reasonable steps to protect your data, we cannot guarantee absolute security.

12.1 Breach notification

In the event of a personal data breach that is likely to result in a risk to your rights and freedoms, we will notify the ICO without undue delay and, where required, within 72 hours of becoming aware of the breach. Where the breach is likely to result in a high risk to your rights and freedoms, we will also notify you directly.

13. Changes to This Policy

We may update this Privacy Policy from time to time to reflect changes in our practices, the Service, or applicable law.

Material changes: We will provide at least 30 days' notice of material changes by email to the address associated with your account or by prominent notice within the Service.
Non-material changes: Minor updates (e.g. formatting, clarifications that do not affect your rights) will be posted on our website with an updated "Last updated" date.

Your continued use of the Service after a change takes effect constitutes your acceptance of the updated policy, subject to any legal requirement for fresh consent.

Previous versions of this policy are available on request by emailing privacy@lineman.io.

14. Contact Us

If you have questions about this Privacy Policy or wish to exercise your data protection rights, you can reach us at:

Goo Holdings Ltd (trading as "Lineman") Registered in England and Wales, company number 17141115 Registered office: 79 Shawclough Way, Greater Manchester, OL12 6DS, England

Privacy and data protection enquiries: privacy@lineman.io
General support: support@lineman.io
Legal enquiries: legal@lineman.io

Data Protection Officer: Goo Holdings Ltd has assessed its processing activities and is not required under UK GDPR Article 37 to appoint a statutory Data Protection Officer. Grant Unwin is the designated privacy contact and can be reached at privacy@lineman.io.

EU representative: Goo Holdings Ltd is established in the United Kingdom. We are reviewing whether we are required to appoint a representative in the European Union under Article 27 of the EU GDPR, and we will update this section and publish the representative's details if and when one is appointed.

Supervisory authority: If you are not satisfied with our response to a privacy concern, you have the right to lodge a complaint with the ICO: