Privacy Policy

Account and Business Contact Information

When you create an account, request a demo, communicate with us, or otherwise interact with Lucy, we may collect:

• Name
• Business email address
• Company or organization
• Job title or role
• Account identifiers
• Authentication and security information, including login credentials
• Communication preferences

Customer Content

When you use Lucy, you or your organization may submit information to the Services, including:

• Documents and files
• Prompts and queries
• URLs
• Research materials
• Marketing or compliance materials
• Notes, annotations, and reviewer decisions
• Data submitted through our APIs
• Customer-specific instructions, configurations, or rules
• Outputs generated by Lucy from the information you submit

We refer to this information collectively as “Customer Content.”

Customer Content may contain personal information depending on what you or your organization chooses to submit.

Usage, Device, and Log Information

When you interact with Lucy, we may automatically collect:

• IP address
• Browser and device type
• Operating system
• Login and authentication activity
• Pages, features, and functions used
• API requests
• Timestamps
• Error and diagnostic information
• Security and audit logs

Support and Communications

If you contact us, we may collect your contact information and the contents of your communications with us.

Billing Information

If you purchase paid Services, we may collect billing and transaction information.

Payment-card information is processed by third-party payment providers. Lucy does not store full payment-card numbers.

Information from Third Parties

We may receive information about you from:

• Your organization, when it provisions or administers your account
• Single sign-on or authentication providers you choose to use
• Service providers that help us operate the Services

Public Regulatory and Market Information

Lucy processes information from public regulatory filings, government databases, and other publicly available sources as part of its financial data, research, analytics, and related Services.

We may use information to:

• Provide, operate, maintain, and improve the Services
• Create and administer user accounts
• Authenticate users and protect accounts
• Process Customer Content and generate requested outputs
• Provide financial data, search, research, analytics, and AI-enabled functionality
• Respond to requests and provide customer support
• Monitor performance, reliability, and usage
• Detect, investigate, and prevent fraud, abuse, security incidents, and unauthorized access
• Maintain audit and security records
• Send product updates, service notices, and other business communications
• Manage billing and contractual relationships
• Comply with applicable laws, regulations, legal processes, and contractual obligations
• Protect the rights, safety, and security of Lucy, our customers, and others

We seek to collect and retain only information that is reasonably necessary for the purposes described in this Privacy Policy and in our agreements with customers.

To improve the Services, we may use usage, device, and log information, as well as aggregated or de-identified information.

We do not use Customer Content to improve shared or general-purpose AI models except as expressly described in Section 3.

Customer trust is important to Lucy.

We process Customer Content only as reasonably necessary to:

• Provide the Services requested by the customer
• Perform searches, analysis, retrieval, and AI processing
• Generate requested outputs
• Provide technical support at the customer’s request
• Maintain the security, reliability, and performance of the Services
• Evaluate the quality or performance of the Services provided to that customer
• Troubleshoot errors or investigate customer-reported issues
• Follow documented customer instructions
• Comply with applicable law and contractual obligations

No Sale of Customer Content

Lucy does not sell Customer Content.

No Shared-Model Training

Unless the customer expressly agrees in writing or through an explicit opt-in mechanism, Lucy does not use Customer Content to:

• Train or fine-tune shared or general-purpose AI models
• Train models for the benefit of other customers
• Build datasets for sale or redistribution to third parties

Lucy may use Customer Content to evaluate, test, troubleshoot, or improve the quality, security, and performance of the Services provided to that customer, subject to applicable contractual restrictions.

Third-Party AI Providers

Where Lucy uses third-party AI or machine-learning providers to process Customer Content, we use contractual and technical safeguards designed to prevent those providers from using Customer Content to train their shared or general-purpose models.

Any retention of Customer Content by such providers is subject to the applicable provider configuration, our contractual arrangements, and any additional terms agreed with the customer.

Human Access

Lucy personnel may access Customer Content only where reasonably necessary to:

• Provide support requested by the customer
• Investigate technical or security incidents
• Prevent or investigate abuse
• Maintain or troubleshoot the Services
• Comply with applicable law

Access is limited to authorized personnel based on business need and is subject to appropriate access controls and logging.

Feedback

If you provide feedback on an output, such as a rating, comment, or correction, we may use that feedback to improve the Services.

We will not use the underlying Customer Content to train or fine-tune shared or general-purpose AI models unless the customer has expressly opted in.

Enterprise Agreements

Enterprise customers may have additional data-use, retention, security, confidentiality, AI-processing, or privacy terms under their agreement with Lucy.

If those terms conflict with this Privacy Policy, the applicable customer agreement will control with respect to Customer Content.

Lucy provides its Services primarily to businesses and other organizations.

When an organization gives you access to Lucy, that organization may:

• Administer your account
• Manage user permissions
• View certain account activity
• Control Customer Content submitted through its account
• Request access, correction, export, or deletion of Customer Content

Customer Content

Where personal information contained in Customer Content is processed on behalf of a business customer, Lucy generally acts as that customer’s service provider or processor and processes the information in accordance with the customer’s instructions and our applicable agreement.

Other Information

For information Lucy collects for its own business purposes, such as account administration, security, website analytics, customer support, billing, and business communications, Lucy may act as the business or controller responsible for that information.

Enterprise customers may request a Data Processing Addendum or other contractual privacy and security terms where appropriate.

We may disclose information in the circumstances described below.

Service Providers

We may disclose information to vendors and service providers that help us operate Lucy, including providers of:

• Cloud infrastructure, hosting, and storage
• AI and machine-learning services
• Authentication
• Security and monitoring
• Analytics
• Customer support
• Email and communications
• Billing and payment processing

We require service providers to process information only for authorized purposes and to protect it in accordance with applicable contractual obligations.

Lucy may maintain a separate list of material subprocessors or service providers.

At Your Direction

We may disclose information when you or your organization instructs us to do so, including through:

• Integrations
• Data exports
• APIs
• Customer-selected third-party services

Legal and Regulatory Requirements

We may disclose information when we reasonably believe in good faith that disclosure is required by:

• Applicable law or regulation
• Subpoena
• Court order
• Governmental request
• Other legal process

Where legally permitted and appropriate, we will make reasonable efforts to notify the affected customer before disclosing Customer Content in response to a legal request.

Protection of Rights and Security

We may disclose information where reasonably necessary to:

• Protect Lucy, our customers, or others
• Investigate fraud or abuse
• Enforce our agreements
• Prevent or respond to security incidents
• Protect legal rights or property

Corporate Transactions

We may disclose information in connection with a:

• Merger
• Acquisition
• Financing
• Reorganization
• Sale of assets
• Bankruptcy
• Similar corporate transaction

Any transfer will be subject to applicable confidentiality and legal protections.

A successor receiving information covered by this Privacy Policy will be required to handle that information in accordance with applicable law and the commitments that apply to the transferred information.

No Sale or Sharing of Personal Information

Lucy does not sell personal information for monetary or other valuable consideration as those terms are defined under applicable U.S. privacy laws.

Lucy does not share personal information for cross-context behavioral advertising or targeted advertising.

Lucy does not knowingly sell or share personal information of individuals under 16 years of age.

If our practices change in a manner that creates a legal right to opt out, we will update this Privacy Policy and provide the required privacy choices before the change takes effect.

We use cookies and similar technologies to:

• Authenticate users and maintain sessions
• Remember preferences
• Protect the security of the Services
• Understand how the website and Services are used
• Diagnose technical issues
• Improve performance and reliability

Essential Cookies

Certain cookies are necessary for Lucy to function properly and cannot be disabled through the Services.

Google Analytics

We may use Google Analytics to understand how visitors use lucydata.ai.

Google Analytics may collect information such as:

• Pages visited
• Time spent on pages
• Referring pages
• Approximate location derived from IP address
• Device and browser information

Where configured by Lucy, advertising-related functionality such as Google Signals and ad personalization is disabled.

You may learn more about Google’s data practices through Google’s published privacy documentation and may use Google’s available browser opt-out tools.

Your Controls

You may block or delete cookies through your browser settings.

Disabling essential cookies may affect the functionality of the Services.

Global Privacy Control

Where required by applicable law, Lucy recognizes valid Global Privacy Control (“GPC”) signals as requests to opt out of activities subject to a legally required opt-out.

Because Lucy does not currently sell or share personal information for targeted or cross-context behavioral advertising, such signals generally do not change our current practices.

We retain personal information and Customer Content only for as long as reasonably necessary for the purposes described in this Privacy Policy, our customer agreements, and applicable legal requirements.

Our standard retention periods are:

Customer Content Deletion

Following account termination or a verified deletion request, Customer Content will generally be removed from active production systems within 30 days unless:

• The customer agreement provides otherwise
• Retention is required by law
• Retention is necessary to resolve a dispute
• Retention is reasonably necessary for security, fraud prevention, or enforcement purposes

Residual copies may remain temporarily in encrypted backups after deletion from active systems.

Such backup copies remain protected, are not used for ordinary business purposes, and are deleted or overwritten according to Lucy’s normal backup-retention procedures.

We may retain information longer where required by law, necessary to resolve disputes, enforce agreements, or address security or fraud concerns.

When information is no longer required, we take reasonable steps to delete, de-identify, or securely dispose of it.

We maintain administrative, technical, and organizational safeguards designed to protect information against unauthorized access, acquisition, disclosure, alteration, loss, or destruction.

These safeguards may include:

• Encryption in transit
• Encryption at rest
• Authentication and access controls
• Role-based access controls
• Logging and monitoring
• Secure software-development practices
• Vulnerability management
• Infrastructure and application security controls
• Incident-response procedures
• Backup and recovery procedures

No system can be guaranteed to be completely secure.

Customers are responsible for protecting their account credentials and appropriately configuring access to their organization’s accounts.

If a security incident involving personal information occurs, we will investigate and provide notifications as required by applicable law and our contractual obligations.

Enterprise customers may receive additional security commitments under an applicable security addendum, Data Processing Addendum, or other written agreement.

Marketing Communications

You may unsubscribe from marketing emails at any time by:

• Using the unsubscribe link in the email; or
• Contacting privacy@lucydata.ai

We may continue to send service-related, security, billing, or transactional communications while you maintain an account or business relationship with Lucy.

Cookies

See Section 6.

Account Closure

You or your organization’s administrator may request closure of your account by contacting us.

U.S. Privacy Rights

Depending on your state of residence, the nature of your relationship with Lucy, and whether the applicable state law applies, you may have the right to:

• Know what personal information we collect, use, and disclose
• Access personal information
• Correct inaccurate personal information
• Delete personal information
• Obtain a portable copy of certain personal information
• Opt out of the sale or sharing of personal information
• Opt out of targeted advertising or certain profiling activities
• Appeal certain decisions regarding privacy requests
• Exercise privacy rights without unlawful discrimination

Lucy does not currently sell personal information, share personal information for cross-context behavioral advertising, or use personal information for targeted advertising.

These rights are subject to applicable legal exceptions.

For example, certain rights may not apply to:

• Publicly available information
• De-identified information
• Information we are legally required to retain
• Information needed for security or fraud prevention
• Information processed by Lucy solely on behalf of a business customer