Privacy for this website

Lucy is a proactive AI coach from Lucy Labs that lives on your desktop as a cloud-backed app. This notice covers the website and its visitor information; desktop deployments have separate permissions and controls.

Effective October 11, 2026

Who we are

Lucy Labs, Inc. operates this website and is responsible for the visitor information described in this notice. It is a Delaware corporation formed on September 23, 2026, registered to do business in Puerto Rico. Our business mailing address is 1413 AVE PONCE DE LEON STE 401 PMB 1213, San Juan, PR 00907-4023, USA. Questions about this notice or your information go to privacy@lucylabs.ai. See the Legal Notice for entity and registered-office details.

Legal notice and registered-office details

What we collect

Screening can identify some credential and sensitive-data patterns, but it cannot reliably recognize every inappropriate detail. Share information you are authorized to share and that helps with your request. Contact privacy@lucylabs.ai if you discover something that should be removed or corrected.

Why we use it

Lucy Labs uses chat information to provide replies and maintain conversation context; inquiry and application information to respond and evaluate the relevant request; and permitted service information to diagnose problems, prevent abuse, assess quality and improve Lucy. Information collected for one purpose does not automatically become permission for unrelated use. Ordinary authorized AI processing does not require a separate approval for each reply.

The applicable basis depends on the activity and your relationship with us. Optional transcript emails and attaching a conversation are separate choices. You can contact privacy@lucylabs.ai about a use, withdraw an optional permission or ask us to explain the basis applicable to your information.

Where information goes

Cloudflare provides website hosting, request transit and bot protection. It processes request and service data needed for those functions. Cloudflare, Inc. is based in the United States. Its data processing addendum covers transfers of personal data from the European Economic Area under the EU-U.S. Data Privacy Framework and standard contractual clauses. Our own website analytics runs on a Lucy Labs server in Spain (see Analytics and browser services).

Lucy Labs uses its database and authorized operational tools to keep the context needed for service and follow-up. Those tools can include Notion for operational records, Google Workspace for email and application handling, and Odoo for relevant contact records. Access and purpose remain limited to the work those records support.

Our business mailing address is not a processing-location guarantee. External providers can process or retain information outside the location of Lucy Labs' primary systems. We describe the actual arrangements when they matter to an engagement instead of promising a fixed provider or region for every use.

AI processing and improvement

Lucy uses an external AI provider to generate replies from your message and relevant conversation history. Provider processing and retention depend on the actual account, settings and terms. A local or temporary conversation on Lucy Labs' systems does not establish provider zero retention.

Lucy Labs' own permitted evaluation and improvement is separate from an external provider using protected information to train its shared models. This page does not promise an enterprise API, a signed data processing agreement (DPA) with the provider or zero retention where those arrangements have not been verified. Ask privacy@lucylabs.ai for the current processing arrangements relevant to your use.

Linking conversations and inquiries

A session identifier helps Lucy continue a conversation. If you submit contact details or elect to attach a chat, records can be linked for that purpose. Linked and pseudonymous records remain protected information; they are not automatically anonymous. Choosing an email transcript authorizes that copy, not unrelated marketing or a separate application.

Browser continuation and clearing

The chat stores session information and conversation history in this browser so you can continue after a page reload. Someone using the same browser profile may be able to see that history. Clearing the local conversation or browser storage affects this device; it does not erase records already held by Lucy Labs, a provider or an email recipient. For retained-data requests, contact privacy@lucylabs.ai.

The browser limits restored continuation to 24 hours since the last confirmed chat activity and at most seven days from the conversation’s recorded start. The service can end continuation sooner. These browser limits do not establish the lifetime of an old server token. A new-conversation request reports revocation only when the service confirms it.

Retention and requests

Our visitor retention ceilings are twelve months for identifiable chat and contact information and twenty-four months for pseudonymous technical metadata. We retain information only for the applicable purpose; a ceiling is not a reason to keep every record. These limits are separate from desktop product and pilot periods.

A published period is not proof that every operational copy has an automated expiry control. A request can involve database records, operational tools, mail, logs and backups. We explain the scope completed and any remaining limit, rather than promise immediate deletion from every recipient or provider.

Your rights and requests

Email privacy@lucylabs.ai to ask about access, correction, deletion, restriction, portability, objection or optional permissions. Include enough information to locate the relevant record without sending additional sensitive information. We may need to verify that the request concerns you. We respond within one month and explain any applicable extension, lawful retention or recipient/provider limitation. Browser clearing is separate from this process.

You can also lodge a complaint with a data protection supervisory authority, such as the Spanish Agencia Española de Protección de Datos (www.aepd.es) or the authority where you live or work.

Applications

Applications sent to people@lucylabs.ai are routed to the existing People Operations group, configured to send copies to every member’s Gmail mailbox and retain a copy in its private Google Groups archive. Authorized team members, administrators and service providers handle this information for the application and its legitimate administration. Keeping it for future opportunities requires a separately explained purpose and choice. Contact people@lucylabs.ai about your application, or privacy@lucylabs.ai about its data handling.

How to contact us

• General inquiries: lucy@lucylabs.ai
• Applications: people@lucylabs.ai
• Privacy requests: privacy@lucylabs.ai

Lucy Labs, Inc.
1413 AVE PONCE DE LEON STE 401 PMB 1213
San Juan, PR 00907-4023
USA

Analytics and browser services

We measure how the site is used with Umami, an open-source analytics tool that Lucy Labs runs on its own server in Spain. The purpose is audience measurement: counting page visits and a few actions (opening the chat, starting a chat, sending the contact form, with its inquiry type, and clicking the "Become a design partner" and "Express your interest" buttons) so we can see which pages and campaigns are useful and improve the site. Umami does not use cookies or store anything in your browser. A script served from lucylabs.ai sends each page view and action to our servers, together with the technical information your browser sends with every request.

Before an event reaches Umami, we shorten your IP address, and the full address is not stored. Umami records the page, the referring site, approved campaign tags in the link (source, medium and campaign), your browser, operating system and device type, your language and your approximate location (country or region). To count visitors, it assigns a pseudonymous identifier that changes every day. We use these statistics only in aggregate: we do not build individual browsing profiles, track visitors across days, or link analytics to chat, contact or application records.

Detailed events and the daily identifiers are deleted from the analytics database after 60 days. Backups of that database are kept for 35 days and used only to restore the service, so a deleted event can remain in a backup for up to 35 more days; after any restore, expired records are deleted again. We keep anonymous aggregate statistics, such as daily counts per page, for 24 months so we can compare year over year. Only authorized Lucy Labs staff can see the analytics.

Our basis is our legitimate interest in measuring and improving this website. If your browser sends a Global Privacy Control or Do Not Track signal, we record none of these events. You can also object at any time by writing to privacy@lucylabs.ai.

Cloudflare also processes every request to the site as our hosting provider. Cloudflare bot protection can use necessary browser mechanisms. The chat uses browser storage for continuation. The site's fonts and scripts are served from lucylabs.ai itself; when you send a chat message, your browser loads Cloudflare's bot check from Cloudflare. These features do not justify an assurance that no third party receives data.

Request references and status can also be stored temporarily in this tab to avoid repeating an uncertain contact or transcript request. They do not authorize another send.

Changes to this notice

We update this notice when relevant practices change and identify the effective date. A changed notice does not expand an existing customer or pilot permission by itself.

Frequently asked questions