Employee Communication & Intranet
lolyo
EU-Made Report an error0–5 in half steps. 5 means the rubric's top anchor is met on the evidence.
by cycoders GmbH · www.lolyo.at
Report an error on this page Is this your product? →
Link to this page
Add ?theme=dark to the image address for dark backgrounds.
The badge shows the category and the month of the latest evaluation, and EU-Made where
that is the product’s provenance. It never shows a score.
lolyo at a glance
- Vendor
- cycoders GmbH
- Headquarters
- Not stated on the vendor’s pages as of 29 Oct 2026
- Data hosting
- Not stated on the vendor’s pages as of 29 Oct 2026
- Free plan
- Not stated on the vendor’s pages as of 29 Oct 2026
- Panel verdict
- The AI panel rates lolyo 2.5/5, the mean of 6 judges. LOLYO is an employee app and mobile social intranet from cycoders GmbH in Raaba near Graz, Austria, positioned for mid-sized companies. how scores are made
- As of
- Vendor pages captured 29 Oct 2026; evaluated by the panel 30 Oct 2026. all sources
Read this page as one judge. Each weighs the same scores by what they care about.
The panel's verdict
LOLYO is an employee app and mobile social intranet from cycoders GmbH in Raaba near Graz, Austria, positioned for mid-sized companies. Scoring is close: no criterion spans more than one point, and all scores fall between 4 and 7. Integration and administration leads at 6 to 6 with sovereignty at 6 to 7, on single sign-on with Microsoft Entra ID or Google OpenID Connect, automatic Microsoft 365 user-data synchronisation, and SharePoint and OneDrive files readable in the app even without an MS 365 licence; processing is stated to run exclusively within the EU/EEA in an ISO-27001-certified Frankfurt data centre. Reach and targeting and works council and privacy sit lowest at 4 to 5: we found no public information on login without a company email address, read confirmation or urgent alerts, and the MITMACH-Booster's points for individual interactions drew works-council caution. Azure hosting carries US CLOUD Act exposure, no product subprocessor list was among the captured pages, and we found no public information on add-on prices, so full rollout cost is not computable from public pages.
Speaks for it
- Integration and administration scores 6 to 6, on single sign-on with Microsoft Entra ID or Google OpenID Connect and automatic user-data synchronisation with Microsoft 365
- SharePoint files and whole OneDrive folders open in the app via the MS Graph API, including for employees without an MS 365 licence
- Surveys are anonymous by default with only aggregate statistics delivered, and chats are end-to-end encrypted and unreadable even to the company
- Processing is stated to run exclusively within the EU/EEA in an ISO-27001-certified data centre in Frankfurt, with a data processing agreement offered and ISO 27001 and SOC 2 among the named certifications
- Tier prices are public — LOLYO at € 2,10 pro Nutzer:in/Monat plus € 109,– Grundgebühr/Monat for companies up to 500 employees, LOLYO plus ab € 0,99 and LOLYO plus KI ab € 1,19 pro Benutzer:in/Monat, each plus tier with € 4.990 initiale Einrichtung — alongside a 60-day full-version trial cancellable with one click
Held against it
- Reach and targeting is the weakest criterion at 4 to 5, with statistics appearing only as a bare feature word and no public information on login without a company email address, read confirmation or urgent alerts
- Works council and privacy scores 4 to 5, and we found no public information on a works-agreement template, quiet hours or accessibility to WCAG or BITV
- The MITMACH-Booster awards points for individual likes, comments and posts — behavioural scoring the works-council judge would negotiate under § 87 BetrVG before any rollout
- We found no public information on prices for add-ons such as automatic translation, the branded app and SSO, while LOLYO Sync and the Enterprise tier are quoted only on request
- We found no public information on product subprocessors for push delivery, translation or the AI assistant, and the pages state hosting on Microsoft Azure, subject to the US CLOUD Act through its US-headquartered parent
Best for
- You run a Microsoft 365 estate and want user data, SharePoint files and OneDrive folders available in one employee app, including for staff without an MS 365 licence
- You are a company of up to 500 employees that fits the published LOLYO tier and wants to pilot on the 60-day full-version trial
- You communicate with a multilingual, largely deskless workforce — the app offers more than twenty languages, with automatic translation as a paid add-on
- You need anonymous-by-default surveys that return only aggregate statistics and chats the company cannot read
Avoid if
- You must prove to a board who read a safety-critical notice — reach reporting appears only as a generic statistics entry, and we found no public information on read confirmation
- You need the REST interface or SAP synchronisation from day one — both sit behind the Enterprise plan offered on request, with LOLYO Sync individually programmed and quoted per project
- You need a priced total before committing — we found no public information on add-on prices, and the sync licence and Enterprise tier are custom quotes, so the judges could not compute an annual total from public pages
- Your works council will vet behavioural scoring before rollout — the MITMACH-Booster awards points for individual likes, comments and posts
The scores
| Criterion | Panel median |
|---|---|
| Reach & targeted announcements | 2 of 5 |
| Pages, documents & knowledge | 2.5 of 5 |
| Engagement, surveys & onboarding | 3 of 5 |
| Works council, private phones & privacy by design | 2.5 of 5 |
| Integration, identity & administration | 3 of 5 |
| European sovereignty | 3 of 5 |
| Pricing transparency | 2.5 of 5 |
Reach & targeted announcements
Show reasoningHide reasoning
How this is scored
How a message reaches every employee: a news feed and announcements on phone, browser and shared devices, targeting by site, department, role and language, access for staff without a company email address (invite codes, phone number, personnel number, QR codes, kiosk or shared devices), push notifications, mandatory reading with read confirmation, urgent alerts, scheduled posts, and reach analytics per message and audience.
0 — Not a communication tool; the company cannot publish news or announcements to employees in the product.
3 — A news feed or announcement channel for employees with company accounts; targeting, access without a company email address and reach figures are basic or not described.
5 — News and announcements targeted by group, site or role, delivered to a mobile app with push notifications and to the browser, employees without a company email address able to log in, and views or reach shown per post.
8 — Targeting by site, department, role and language from HR data, login documented for staff without email or company devices (personnel number, SMS code, shared devices), mandatory reading with read confirmation and reminders, urgent alerts that override quiet settings, scheduled and multi-channel posts (app, email, intranet, screens), and reach analytics per audience.
10 — Reach that can be proved: delivery and reading tracked per channel against the whole workforce, offline access and low-bandwidth delivery documented, crisis messages with acknowledgement and escalation, aggregated reports exportable, and the reach analytics described with the data they use.
The Internal Communications Lead
News can be aimed at defined groups and roles and pushed to the smartphone, with a desktop version alongside and the vendor's whole positioning built around reaching the seventy percent without a desk — that covers my site news. I found no public information on read confirmation for must-read notices, on urgent alerts that override quiet settings, or on reach figures per message and audience; statistics appear only as a bare feature word on the pricing page. For a safety notice I cannot yet prove to the board who actually saw it. 2 5 9 11
The Frontline Operations Lead
News can be targeted to specific groups and roles, sent as push notifications to smartphones, and read on desktop, which would replace both the notice board and the WhatsApp group. We found no public information on how a new picker without a company email address logs in on day one, and reach reporting is only a generic statistics mention, so I cannot verify who actually read an announcement. 2 5 9 11
The Microsoft 365 Administrator
The employee app documents a news feed with likes and comments, targeting of news to defined groups and roles, push messages to the smartphone, a desktop version and a claim of reaching the 70% of staff not at a desk. We found no public information on how staff without a company email address log in, on read confirmation and urgent-alert behaviour, or on reach figures per message and audience. 2 9 11
The Works Council Member
News can be aimed at defined groups and roles, pushed to the smartphone in real time and read on desktop, with an app interface in more than twenty languages and the vendor explicitly targeting the seventy per cent of staff without a desk. We found no public information on a login without a company email address, on read confirmations or urgent alerts, and reach measurement appears only as an unspecified statistics item in a feature list. 2 9 11
The Data Protection Officer
News, a pinboard and chat with push messages reach all employees in real time on the smartphone and on the desktop, and news can be targeted at defined groups and roles. We found no public information on login for staff without a company email address, mandatory reading with read confirmation, urgent alerts or reach analytics per message; the captured pages mention only general statistics. 2 9 11 5
The Skeptic
A news feed, push messages to the smartphone, a desktop version and targeting of news to employee groups are documented. We found no public information on how staff without a company email address or company device log in, on mandatory reading with confirmation, urgent alerts or per-message reach figures — a bare "Statistiken" entry in a feature list is the closest the captured pages come. "Erreichen ALLE Mitarbeitenden in Echtzeit" is a claim, not a mechanism. 2 9 11 5
Pages, documents & knowledge
Show reasoningHide reasoning
How this is scored
What employees can look up: intranet pages and a content management system, documents and policies with versions and owners, search across content and connected systems, a people directory and org chart, multilingual content with machine translation of posts and pages, content review and expiry, and access from the app as well as the browser.
0 — No pages or documents; the product carries only messages that scroll away.
3 — Files or simple pages can be shared; search, translation, a people directory and content governance are basic or not described.
5 — Pages and a document area with permissions, search across the content, a people directory, content available in the mobile app, and posts or pages translatable into several languages.
8 — A content management system with templates, page ownership, review dates and versioning, search across connected systems (SharePoint, Google Drive or similar), automatic translation of posts, pages and comments into named languages, an org chart from HR data, and pages readable offline.
10 — Knowledge that stays current: content lifecycle and expiry enforced, search and AI answers that cite their sources and respect permissions, analytics on what is searched and not found, accessibility of the content stated against WCAG, and a full export of pages and documents.
The Internal Communications Lead
Custom pages, a library with files assignable to groups, full-text search, an employee directory and over twenty interface languages give me the core of an intranet, and SharePoint or OneDrive folders can be embedded so documents are not maintained twice. I found no public information on page versioning, review dates, an org chart from HR data or offline reading, so I cannot yet treat this as a governed content system for policies and manuals. 2 5 13 17
The Frontline Operations Lead
Custom info pages, a library whose files can be assigned to groups, a global full-text search, a people directory and SharePoint and OneDrive files readable in the app even without an MS 365 licence make this a real intranet rather than messages that scroll away. We found no public information on versioning, review dates, an org chart or offline pages, and automatic translation is listed as an optional add-on. 2 5 13 17
The Microsoft 365 Administrator
Custom pages, a library where files are assigned to groups, a people directory with profiles, global full-text search and automatic translation as an add-on are documented, and SharePoint files or whole OneDrive folders can be embedded so staff without an MS 365 licence can still open documents in the app via the Graph API. We found no public information on page ownership, review dates and versioning, an org chart built from HR data, or offline reading. 2 5 13 17
The Works Council Member
A library holds documents, images, audio and video assignable to groups, alongside custom pages, a global full-text search, a staff directory, and SharePoint files and OneDrive folders embedded via the MS Graph API so even employees without an MS 365 licence can open them. Automatic translation is offered as a paid add-on. We found no public information on versioning, review dates or offline reading of pages. 2 5 13 17
The Data Protection Officer
Custom info pages, a library in which every file can be assigned to one or more groups, a global full-text search and a people directory are documented, with automatic translation as an add-on and the app in over 20 languages. Embedding SharePoint files and OneDrive folders via the Microsoft Graph API goes beyond a simple document area; we found no public information on versioning, review dates, offline pages or an org chart. 2 5 13 17
The Skeptic
Custom info pages, a library where every file can be assigned to groups, full-text search, a people directory and access from app and desktop are documented, with automatic translation sold as a paid add-on and SharePoint/OneDrive files embeddable via the MS Graph API. We found no public information on versioning, review dates, page ownership, an org chart or offline pages. 2 5 13 17
Engagement, surveys & onboarding
Show reasoningHide reasoning
How this is scored
How the workforce answers back and gets started: comments, reactions and moderation, employee surveys and pulse checks with anonymity rules, recognition, user-generated posts and communities, onboarding journeys for new starters including those without a desk, event and campaign pages, and the measures the vendor offers to report engagement.
0 — One-way only; employees cannot react, comment or answer in the product.
3 — Likes and comments on posts; surveys, moderation and onboarding are basic or not described.
5 — Comments and reactions with moderation, surveys or polls sent to targeted groups with results shown, employee posts or communities, and an onboarding area or journey for new employees.
8 — Pulse and engagement surveys with a stated anonymity threshold, automated onboarding journeys timed from the start date and reaching new starters before their first shift, recognition, communities with moderation rules, and engagement reported per group without exposing individuals.
10 — Listening that leads to action: survey results tied to follow-up tasks and published back to the workforce, anonymity and minimum group sizes documented, onboarding journeys measured by completion, and engagement data exportable for analysis.
The Internal Communications Lead
The pinboard, likes and comments, surveys, onboarding pages with checklists and a points-and-goodies booster give new starters and the wider workforce real ways to answer back, and surveys are anonymous by default with non-anonymous ones clearly labelled. I found no public information on moderation rules, onboarding journeys timed to the start date, or engagement reporting per group, which is where my measurement interest would sit. 2 10 13 15
The Frontline Operations Lead
Surveys are anonymous by default with the company receiving only aggregate statistics, the MITMACH-Booster and its goodie store provide recognition, the social pinboard carries employee posts, and onboarding pages, checklists and a whitepaper covering preboarding through the first shift are documented. We found no public information on automated onboarding journeys timed from the start date or engagement reporting per group. 2 10 12 13 15
The Microsoft 365 Administrator
Likes, comments and a social pinboard are documented, surveys are stated to be anonymous by default with only aggregate statistics and non-anonymous ones labelled as such, the MITMACH-Booster adds points and a reward store, and onboarding gets its own pages, checklists and a whitepaper. We found no public information on moderation, onboarding journeys timed to the start date, or engagement reporting per group. 2 10 15 13 12
The Works Council Member
Colleagues can like, comment and post on a social pinboard, answer surveys that are anonymous by default — neither the employer nor the vendor can attribute an answer to a person, and any non-anonymous survey is labelled with a visible warning — and new starters get customisable onboarding pages with checklists and forms. We found no public information on moderation rules or engagement figures reported per group. 2 13 15
The Data Protection Officer
Comments, likes and a social pinboard are documented, as is a recognition system awarding points for interactions redeemable in a goodie store, with the captured pages stating surveys are always anonymous by default and deliver only statistical evaluation to the company. Onboarding pages, checklists and a whitepaper covering preboarding through integration are published; we found no public information on moderation rules, minimum group sizes for results or completion measurement of onboarding journeys. 2 10 13 15 12
The Skeptic
Surveys are documented as anonymous by default — neither the company nor the vendor can attribute answers, and non-anonymous surveys must be labeled — plus a pinboard for employee posts, points-based recognition with a goodie store, and customizable onboarding pages with a whitepaper covering preboarding through integration. We found no public information on moderation of comments and pinboard posts, on onboarding journeys timed from the start date, or on engagement reported per group. 2 13 15 12
Works council, private phones & privacy by design
Show reasoningHide reasoning
How this is scored
Whether the product can be rolled out under German co-determination and data protection: guidance or a template for a works agreement (Betriebsvereinbarung, § 87 BetrVG), no individual performance or behaviour monitoring by default, read and usage analytics aggregated or configurable, use on private phones without a company device (BYOD) with work and private data separated, quiet hours and availability settings, voluntary use without an employee email address, data minimisation and deletion, and accessibility.
0 — Built to monitor the behaviour or performance of individual employees, with that monitoring sold as a feature.
3 — A general GDPR statement; works council, use on private phones, analytics on individuals and quiet hours are basic or not described.
5 — Use on private phones described with what the employer can and cannot see, analytics shown in aggregate, notification or quiet-hour settings, and works councils or employee representatives named as a topic with information offered.
8 — A works-agreement template or checklist published, individual tracking off by default or switchable per tenant, read confirmations limited to messages that require them, quiet hours enforced, a login without a private email or phone number, data minimisation and deletion periods stated, and accessibility to WCAG or BITV stated.
10 — Co-determination built into the product: every analytics view and its granularity documented for the works council, configuration logged, employee-facing privacy notices in the app, minimum group sizes for every report, and published references of works-council-approved rollouts.
The Internal Communications Lead
Private-phone use is addressed head-on with no business data stored locally, the vendor states chat contents can be read neither by the company nor by the vendor, surveys return only aggregate statistics, and logs are deleted after fourteen days at the latest. I found no public information on a works-agreement template, quiet hours, individual tracking defaults or accessibility against WCAG or BITV — exactly the pieces my works council would ask for first. 4 7 14 15
The Frontline Operations Lead
Use on private phones is described with the statement that no business or sensitive data is stored locally, chats are end-to-end encrypted and cannot be viewed by the company, surveys return aggregates only, and deletion rules plus a published data processing agreement exist. We found no public information on works agreements or works councils as a topic, quiet hours, or accessibility standards — all of which I would need before any co-determined rollout. 4 7 14 15
The Microsoft 365 Administrator
Private-phone use is described with no sensitive business data stored on the device, chats are stated to be unreadable by the employer and by LOLYO, and deletion after purpose with 14-day log retention is published — useful raw material for a works agreement. We found no public information on a works-agreement template or checklist, quiet hours and notification settings, or accessibility to WCAG or BITV. 4 7 15
The Works Council Member
The privacy statements are unusually concrete for a social app: chats are end-to-end encrypted and closed to the employer, no business data rests locally on a private phone, server logs are deleted after fourteen days, and access is cut when someone leaves the company. But we found no public information on a works-agreement template, on quiet hours, or on what an administrator can see about one person's usage — and the MITMACH-Booster awards points for individual likes, comments and posts, behavioural scoring I would have to negotiate under § 87 BetrVG before any rollout. 4 7 10 14 15
The Data Protection Officer
Use on the private smartphone is described with the statement that no business or sensitive data is stored locally, chats are end-to-end encrypted and unreadable even to the company, surveys deliver aggregate statistics only, and server logs are deleted after 14 days at the latest. We found no public information on a works-agreement template, quiet-hour settings or accessibility against WCAG or BITV. 4 7 15 14
The Skeptic
Use on private phones is addressed with the statement that no sensitive data is stored locally, chats are end-to-end encrypted and invisible to the employer, and deletion periods are stated (server logs at most 14 days). We found no public information on works councils or a works-agreement template, quiet hours, or what the employer can see of individual interaction data — a fair question when the MITMACH-Booster awards points for liking, commenting and posting. 4 7 15 14
Integration, identity & administration
Show reasoningHide reasoning
How this is scored
How the product fits the company's systems and is run: Microsoft 365, SharePoint, Teams and Google Workspace integration, user provisioning from the HR system or directory (Entra ID, SAP SuccessFactors, Personio, Workday), single sign-on and SCIM, roles and admin rights by site or department, an API and webhooks, integrations with shift planning and payroll for frontline links, white-label apps, and an export of content and users when leaving.
0 — Stand-alone with manual user lists and no integration of any kind.
3 — Users imported from a file and a few links to other tools; single sign-on, provisioning and an API are basic or not described.
5 — Single sign-on with named identity providers, users provisioned from a directory or HR system, Microsoft 365 or Google Workspace integration, several named integrations, and a documented API.
8 — Automated provisioning by SCIM or HR connector including staff without email, delegated administration by site or department, integration in Microsoft Teams and SharePoint, connectors for named HR, shift and payroll systems, webhooks, a white-label app option, and an audit log.
10 — Runs as part of the company's systems: a public developer platform with versioned API and SDKs, every integration documented, a status page and stated SLA, and a full export of content, users and analytics that a successor system can import.
The Internal Communications Lead
Single sign-on with Microsoft Entra ID or Google, automatic user data synchronisation with Microsoft 365, a REST interface, Microsoft 365 and SAP named as connectable systems, administrator permissions assignable by area and a branded app option fit our Microsoft world well. I found no public information on SCIM, webhooks or an audit log, and the active interface to third-party systems is individually programmed, quoted on request and restricted to the enterprise plan. 3 9 16 17
The Frontline Operations Lead
Single sign-on with Microsoft Entra ID or Google, automatic user-data synchronisation with Microsoft 365, a REST interface and named connections to Microsoft 365 and SAP are documented, with admin permissions assignable per area. The passive and active interfaces are restricted to the Enterprise tier, the Google login to the plus plan, and we found no public information on SCIM provisioning, webhooks, delegated administration by site, or an audit log. 2 3 5 9 16 17
The Microsoft 365 Administrator
Single sign-on with Microsoft Entra ID, automatic user-data synchronisation with MS 365 for names, positions, teams and phone numbers, SharePoint and OneDrive embedding via the Graph API, assignable admin permissions for defined areas, a REST interface and a branded-app option are documented — though the interfaces sit at the Enterprise tier and LOLYO Sync is individually programmed on request. We found no public information on SCIM provisioning, running the app inside Microsoft Teams, webhooks, an audit log, or an export of content and users when the contract ends. 3 5 2 16 17
The Works Council Member
Single sign-on with Microsoft Entra ID or Google OpenID Connect, automatic synchronisation of names, positions, teams and phone numbers with Microsoft 365, a REST/JSON interface and individually programmed synchronisation into third-party systems such as SAP, with a branded app and on-premises as paid options. The third-party interfaces are reserved for the Enterprise plan and the sync licence is quoted only on request. We found no public information on SCIM provisioning, webhooks or an audit log. 3 5 9 16
The Data Protection Officer
Single sign-on with Microsoft Entra ID or Google OpenID Connect, automatic synchronisation of names, positions, teams and phone numbers with Microsoft 365, a passive JSON/REST interface and a custom-programmed sync to systems such as SAP are documented, plus assignable admin permissions and a branded app as an add-on. The active interface and API access are tied to the Enterprise plan by request or custom quote; we found no public information on SCIM provisioning, webhooks, an audit log or a Teams integration. 3 16 17 5 2
The Skeptic
Single sign-on with Microsoft Entra ID or Google, automatic user-data synchronisation with Microsoft 365, a passive JSON/REST interface for employee data and feed content, named third-party systems (Microsoft 365, SAP), scoped admin permissions and a branded-app add-on are documented. The passive interface and the individually programmed LOLYO Sync are reserved for a LOLYO Enterprise tier available only on request, and we found no public information on SCIM, webhooks or an audit log. 3 5 16 17 2
European sovereignty
panel opinion
Show reasoningHide reasoning
How this is scored
Who the contracting entity and the parent company are, where employee profiles, messages, files and usage data are hosted, and who the subprocessors are (hosting, push notifications, email and SMS delivery, video, translation, AI models, analytics, support). Independently sourced by the sovereignty pipeline; an employee app holds data on the whole workforce, often on private phones, so the whole chain counts, not only the database.
0 — Non-EU vendor and contracting entity, hosting unstated, subprocessors unnamed, and no data processing agreement offered.
3 — A privacy policy and a data processing agreement exist, but hosting location is unstated or non-EU and the subprocessors are not listed.
5 — EU hosting available and an EU contracting entity or EU representative, but parts of the chain (push delivery, translation, AI, email, analytics, support) run through non-EU providers without a stated safeguard.
8 — EU hosting on named infrastructure, EU contracting entity, subprocessors listed with their locations, a data processing agreement published, and security certifications (ISO 27001, SOC 2) stated.
10 — Sovereign end to end and evidenced: European ownership, entity, hosting and every subprocessor, or self-hosting on the customer's own servers, data export and deletion documented, and certifications published with their scope rather than implied.
The Internal Communications Lead
The imprint and privacy policy name cycoders GmbH in Raaba, Austria as the responsible entity, the security page places data in an ISO-27001-certified data centre in Frankfurt with all processing exclusively inside the EU/EEA, and a data processing agreement plus a long certification list are stated. I found no public information on a product subprocessor list — push delivery, translation and the AI assistant are unnamed, and the noted Microsoft hosting under the US CLOUD Act leaves the chain beyond the database unproven. 4 6 7 14
The Frontline Operations Lead
The vendor is an Austrian company with a published imprint and register number, processing is stated to run exclusively in the EU/EEA in an ISO-27001-certified datacenter in Frankfurt, and a data processing agreement plus an extensive certification list are published. We found no public information on product subprocessors or ownership, and the captured pages note that the Azure data centers are in Germany while Microsoft as a US company falls under the US CLOUD Act. 4 6 7 14
The Microsoft 365 Administrator
The controller is cycoders GmbH in Raaba, Austria, processing is stated to run exclusively in the EU/EEA in an ISO-27001-certified data centre in Frankfurt, a data processing agreement is offered, and ISO 27001, ISO 27701, SOC 2 and further certifications are listed. The hosting runs on Azure from a US-headquartered provider, and we found no public information on product subprocessors for push delivery, translation or the AI assistant. 4 6 7 14
The Works Council Member
The contracting entity is cycoders GmbH in Raaba near Graz, registered at the regional court for Graz, with data in an ISO-27001-certified datacentre in Frankfurt, processing stated as exclusively within the EU/EEA, a data processing agreement offered and certifications including ISO 27001 and SOC 2 named. For my works agreement the chain beyond the database stays open: we found no public list of product subprocessors for push delivery, translation or the AI assistant, and the German datacentres belong to US-headquartered Microsoft with the CLOUD Act that follows from that. 4 6 7
The Data Protection Officer
The vendor is cycoders GmbH in Austria with register number and VAT ID published, all processing is stated to occur exclusively within the EU/EEA in an ISO-27001-certified data centre in Frankfurt am Main, a data processing agreement is offered and certifications including ISO 27001 and SOC 2 are named. For my clients I would still need the missing piece: no subprocessor list for the product chain — push delivery, translation, the AI assistant, email — was among the captured pages, and the hosting sits on Microsoft Azure, whose US-headquartered parent is subject to the US CLOUD Act. 4 6 7 14
The Skeptic
The controller is an Austrian GmbH, processing is stated to occur exclusively in the EU/EEA with an ISO-27001-certified data center in Frankfurt, a data processing agreement is offered and a long certification list (ISO 27001 among others) is published. But the hosting chain runs through US-headquartered Microsoft with its CLOUD Act exposure, and no product subprocessor list — push delivery, translation, the Aisha AI assistant — was among the captured pages, so the chain beyond the database is undocumented. 4 6 7 14
Pricing transparency
Show reasoningHide reasoning
How this is scored
Whether a buyer can compute the real annual cost from public pages alone: price per user or per employee, whether frontline and desk staff are priced differently, platform or base fee, which modules (intranet, employee email, surveys, translation, AI, a white-label app) cost extra, minimum seats and term, and setup and onboarding fees.
0 — No public prices at all; every customer is a sales call.
3 — A starting price or a free tier exists, but how cost scales with users, modules or a branded app is unclear.
5 — Tiers are public with their per-user or base price and main inclusions, but at least one commonly needed piece (frontline users, translation, a branded app, extra modules) is unpriced or "on request".
8 — Every tier priced publicly with its scaling rule (per user, per frontline user, per active user), add-ons and a branded app priced, minimum seats and term, setup fees and VAT treatment stated.
10 — Complete price computability: annual cost derivable for a given headcount and module set, with every add-on, setup, support and branded-app fee and the cancellation and data-return terms published.
The Internal Communications Lead
Tiers are public with their numbers: € 2,10 per user per month plus a € 109 monthly base fee for companies up to 500 employees, and for larger companies from € 0,99 or € 1,19 per user per month plus € 4.990 initial setup, with a 60-day free trial. But the add-ons I would need — automatic translation, the branded app, single sign-on, the e-inbox, on-premises — are listed with no prices, the sync interface is quoted individually on request, and I found no public information on minimum term or VAT treatment, so I cannot compute my annual cost for 3,000 people. 3 5 8 11
The Frontline Operations Lead
The tiers are public — LOLYO at "€ 2,10/Nutzer*in/Monat + € 109,– Grundgebühr/Monat" for companies up to 500 employees, LOLYO plus "ab € 0,99 pro Benutzer:in/Monat + € 4.990 initiale Einrichtung" and plus KI "ab € 1,19 pro Benutzer:in/Monat" — with a 60-day full-version trial cancellable with one click. But we found no public information on prices for the add-ons I need — automatic translation for my six languages, the branded app, SSO — and LOLYO Sync and the Enterprise tier are offered on request, so the real annual cost for 1,800 mostly seasonal staff is not computable from public pages. 3 5 8
The Microsoft 365 Administrator
The plans are public — LOLYO at €2.10 per user per month plus €109 base fee per month, and the plus tiers from €0.99 or €1.19 per user per month with €4,990 initial setup — with a 60-day full-version trial and three hours of personal IT support included. Automatic translation, the branded app and SSO are listed as add-ons, and we found no public information on their prices, on minimum seats, term or VAT treatment. 2 5 8 11
The Works Council Member
The tiers are public: LOLYO at € 2,10 pro Nutzer:in/Monat plus € 109,– Grundgebühr/Monat for companies up to 500 employees, LOLYO plus ab € 0,99 and LOLYO plus KI ab € 1,19 pro Benutzer:in/Monat, each with € 4.990 initiale Einrichtung, plus a 60-day full-version trial. The add-ons a frontline rollout needs — translation, branded app, SSO, the sync licence — are named but carry no price, the sync being an individual quote. We found no public information on minimum term or VAT treatment. 3 5 8
The Data Protection Officer
The base plan is public at "€ 2,10/Nutzer*in/Monat + € 109,– Grundgebühr/Monat" and the plus tiers at "ab € 0,99 pro Benutzer:in/Monat" and "ab € 1,19 pro Benutzer:in/Monat" each with "+ € 4.990 initiale Einrichtung", alongside a 60-day full-version trial cancellable with one click. Add-ons such as automatic translation, the branded app, SSO and LOLYO Learning are named without prices, and the Enterprise plan and LOLYO Sync run on request or by custom quote; we found no public information on minimum seats, term or VAT treatment. 5 8 3 2
The Skeptic
Three tiers are public — "€ 2,10 pro Benutzer:in/Monat + € 109,- Grundgebühr/Monat" for LOLYO, "ab € 0,99 pro Benutzer:in/Monat + € 4.990 initiale Einrichtung" for LOLYO plus, "ab € 1,19" for LOLYO plus KI — with a 60-day full-version trial and three hours of IT support included. The add-ons (automatic translation, branded app, SSO, on-premises), the Enterprise tier and LOLYO Sync are unpriced or "Angebot auf Anfrage", and how the "nutzungsbezogene" usage-based license scales, minimum seats, term and VAT treatment are not stated. 5 3 8
European sovereignty — proven facts
0 of 6 dimensions provenBuilt only from facts shown on the vendor's own pages. A dimension we could not prove is left open, not scored as zero.
| Legal entity | Not determined ⚠ unverified | — | uncited Report an error |
|---|---|---|---|
| Hosting location | Not determined ⚠ unverified | — | uncited Report an error |
| Hosting options | Not determined ⚠ unverified | — | uncited Report an error |
| Open source | Not determined | — | uncited Report an error |
| Data processing agreement | Not determined | — | uncited Report an error |
| Transfer impact assessment | Not determined ⚠ unverified | — | uncited Report an error |
Questions about lolyo
Is lolyo European?
Yes. whats-best.ai classifies lolyo as EU-Made.
Where does lolyo store data?
Not stated on the vendor’s pages as of 29 Oct 2026.
Does lolyo have a free plan?
Not stated on the vendor’s pages as of 29 Oct 2026.
What are the best alternatives to lolyo?
As of 3 Nov 2026, the panel rates Flip (3.5/5), Workvivo by Zoom (3/5) and Staffbase (3/5) highest among the other 17 Employee Communication & Intranet products evaluated. Ratings that look equal are rounded to half stars; the order uses the unrounded rating, then the name. The highest-rated European alternative is Flip (EU-Made). Ratings are the AI panel’s opinion, formed from public evidence: how scores are made. The full list, with European products first: lolyo alternatives.
Where this could be wrong
- Evidence ages. The oldest capture behind this page is from 29 Oct 2026. Vendors change pricing and policies without notice; every fact reflects its source as of the capture date shown in the registry.
- Weak sourcing — Transfer impact assessment, Hosting location, Hosting options, Legal entity. Not confirmed on the vendor’s own pages as captured.
- AI can misread a source. Extraction and judgement are automated; a citation guarantees traceability, not infallibility. If something here is wrong, say so — no account needed, every report is decided within 5 business days, and accepted corrections are published.
What we left out
A claim that does not survive our checks costs us the claim, not the page. This is what was taken off this one.
- 30 product facts could not be confirmed on the vendor’s page as captured and were left out of this page and of the panel’s material. Know more? Tell us
- 2 compliance facts could not be confirmed on the vendor’s page as captured and were left out of this page and of the panel’s material. Know more? Tell us
- 1 subprocessors fact could not be confirmed on the vendor’s page as captured and was left out of this page and of the panel’s material. Know more? Tell us
- 4 sovereignty dimensions could not be confirmed on the vendor’s own pages and are shown as unknown. Know more? Tell us
- 6 of the readings below were written against an earlier fact sheet — a fact has been corrected, added or pulled since. Until the panel next runs on this product you are reading the older judgement. Know more? Tell us
Sources (17)
The pages every claim on this page was read from — each one checked, dated, and kept verifiable.
- 1 Vendor homepage www.lolyo.at Checked 29 Oct 2026 Details →
- 2 Features page (employee app) www.lolyo.at Checked 29 Oct 2026 Details →
- 3 Features page (intranet) www.lolyo.at Checked 29 Oct 2026 Details →
- 4 Security / trust page www.lolyo.at Checked 29 Oct 2026 Details →
- 5 Pricing page www.lolyo.at Checked 29 Oct 2026 Details →
- 6 Legal notice www.lolyo.at Checked 29 Oct 2026 Details →
- 7 Privacy policy www.lolyo.at Checked 29 Oct 2026 Details →
- 8 Reach & targeted announcements — found from sitemap www.lolyo.at Checked 29 Oct 2026 Details →
- 9 Reach & targeted announcements — found from sitemap www.lolyo.at Checked 29 Oct 2026 Details →
- 10 Pages, documents & knowledge — found from sitemap www.lolyo.at Checked 29 Oct 2026 Details →
- 11 Pages, documents & knowledge — found from sitemap www.lolyo.at Checked 29 Oct 2026 Details →
- 12 Engagement, surveys & onboarding — found from sitemap www.lolyo.at Checked 29 Oct 2026 Details →
- 13 Engagement, surveys & onboarding — found from sitemap www.lolyo.at Checked 29 Oct 2026 Details →
- 14 Works council, private phones & privacy by design — found from sitemap www.lolyo.at Checked 29 Oct 2026 Details →
- 15 Works council, private phones & privacy by design — found from sitemap www.lolyo.at Checked 29 Oct 2026 Details →
- 16 Integration, identity & administration — found from sitemap www.lolyo.at Checked 29 Oct 2026 Details →
- 17 Integration, identity & administration — found from sitemap www.lolyo.at Checked 29 Oct 2026 Details →