Privacy Policy

This Privacy Policy explains how Luci ("Luci", "we", "us") collects, uses and protects personal data when you visit www.luci.mx, subscribe to or use the Luci platform (chat.luci.mx) or talk with an AI agent that a Luci customer has deployed. It also serves as our privacy notice under Mexico's Federal Law on the Protection of Personal Data Held by Private Parties (LFPDPPP). For any privacy matter, including exercising your rights, write to hola@luci.mx.

1. Data we collect

Website visitors

If you contact us or book a demo, we collect the data you give us: name, company, email, phone number and the content of your message. Our servers keep basic technical logs (IP address, browser, pages requested and date) for security and operation. The website does not use advertising or analytics cookies.

Business users of the platform

For companies that use Luci and their team members, we collect account data (name, work email, phone number, role and password, stored as a hash) and the configuration of their agents (prices, catalogs, rules and knowledge documents they upload).

Subscription, payment and invoicing

When a business subscribes to Luci at chat.luci.mx/contratar, we collect:

• Data about the person subscribing: name, email and password of the person who creates the account, the business name and the chosen plan.
• Tax data, if you request an invoice: RFC (Mexican tax ID), name or legal name, tax regime, tax postal code, CFDI use and invoicing email. If the subscribing business is an individual, this data is personal data.
• Anti-bot verification: when you sign up we use hCaptcha to check that you are not an automated program. To do so, hCaptcha processes your IP address and technical signals from your browser and device, and may use its own cookies. Its privacy policy and terms apply.

We do not store your card data. Luci's charges are processed by Stripe: you enter your card details directly in Stripe's form, and Stripe receives and safeguards them. Luci never sees or stores your card number or security code. To create your subscription we share with Stripe the subscriber's email and the order reference; from Stripe we only receive the payment confirmation and its basic details (amount, date, and payment and subscription status).

Who can see an account's billing. Anyone who is currently an administrator of the account can see its subscription, charges and invoices, pay, update the card, cancel or reactivate. In the Stripe portal, administrators see the brand and last 4 digits of the registered card, even if someone else registered it, and the email of the person who paid. Anyone who stops being an administrator loses that access.

Our customers' customers and job candidates

Businesses use Luci to serve their customers and job candidates through the channels they connect: WhatsApp, Instagram, Facebook, Telegram or email, among others. Each business chooses how to connect WhatsApp: through Meta's official WhatsApp Business API or by linking its number with a QR code. When someone writes to a business through one of those channels, Luci receives the conversation: name, phone number or username, messages, voice notes, images, and any files they send (for example payment receipts or résumés).

Candidates in hiring processes. If a business uses Luci for recruiting, its candidates may send through the chat documents such as an official ID (INE), CURP, NSS (social security number), driver's license, proof of address or certificates, and sometimes health data. Some of these are sensitive personal data: the hiring business decides which ones it asks for, must inform its candidates through its own privacy notice and obtain their express consent when the law requires it. Luci processes them only to provide the service to that business.

Who is accountable for this data? In plain words:

• The business owns the relationship with its contacts. It decides what the data is used for and is responsible for handling it lawfully and for making sure its own team uses it properly. Under the LFPDPPP, the business is the data controller.
• Luci is the information security layer. We encrypt and store that data securely, and use it only to provide the service the business hired, following its instructions. Never for our own purposes. Under the LFPDPPP, Luci is the data processor.

So if you are a customer or candidate of a business that uses Luci and want to access, correct or delete your data, the fastest way is to ask that business. You can also write to us at hola@luci.mx: we will pass your request on and help the business handle it.

From connected Google accounts (Google Calendar)

The Google Calendar integration is optional. We access Google Calendar data only for accounts that a user explicitly connects. If no Google account is connected, Luci accesses no Google user data. When connected, Luci requests the following scopes: calendar.readonly (to list the calendars available on the account) and calendar.events (to view, create, update, and cancel events).

From a connected calendar we read and store the calendar list (name and identifier) and the events needed for scheduling (title, start and end time, status and attendees), together with the OAuth tokens that allow Luci to act on the account.

From connected Google accounts (Gmail)

A business user can optionally connect a Gmail account as an email inbox in Luci. When connected, Luci requests the gmail.modify scope, plus email and profile to identify the account. We use it to read the messages that arrive in that inbox so they appear as conversations in Luci, and to send the replies the business writes from Luci. If no Gmail account is connected, Luci accesses no Gmail data.

2. How we use the data

We use personal data for these purposes, which are necessary to provide the service:

• Provide the platform: receive and answer conversations, run the AI agents our customers configure, assign conversations to their team and escalate to a human.
• Execute the actions the business enables: quotes, payment receipt validation (SPEI), document reading, appointment scheduling and follow-ups.
• Create and manage accounts and provide support, including through the platform's help chat, which is handled by an AI agent and can hand the conversation over to a person on the Luci team.
• Collect the subscription: process the payment, payment retries, suspension for non-payment, reactivation, cancellations and refunds.
• Invoice: validate tax data with the SAT (Mexico's tax authority) before charging, and issue, send, cancel and keep tax receipts (CFDI), credit notes and the global invoice to the general public.
• Keep the service secure, prevent automated sign-ups, fraud and abuse, and comply with legal obligations, including tax obligations.

Luci does not use its customers' information or their conversations to train or retrain AI models. Luci's agents run on AI models from third-party providers, under the terms described in section 4.

Google Calendar. After a business user connects their Google Calendar, Luci lists their available calendars so they can select one for scheduling. The business user can view existing events to check availability, and create, update, or cancel events when scheduling appointments with their customers. Calendar data is used only for these scheduling functions.

Gmail. Email from a connected Gmail inbox is used only to show those messages as conversations in Luci and to send the replies the business user writes or approves. Gmail data is used only for this inbox function.

Additional purposes, which are not necessary for the service: sending you news and commercial communications about Luci. You can opt out at any time by writing to hola@luci.mx or using the unsubscribe link in each email. We never use Google user data, or data about our customers' customers and candidates, for these purposes.

3. Google user data and Limited Use

The use of raw or derived user data received from Workspace APIs will adhere to the Google User Data Policy, including the Limited Use requirements.

In particular, for data obtained through Google APIs (Google Calendar and Gmail):

• We use it only to provide or improve the user-facing features described above, which are visible in the Luci interface.
• We do not transfer it to third parties, except as needed to provide those features, for security purposes, to comply with applicable law, or as part of a merger or acquisition with the user's prior consent.
• We do not use or transfer it for advertising, including personalized, retargeted or interest-based advertising.
• We do not sell it, and we do not use it to determine creditworthiness or for lending purposes.
• We do not use it to develop, improve or train generalized or non-personalized AI or machine-learning models.
• No person at Luci reads it, unless the user gives us affirmative consent for specific data (for example, in a support request), it is necessary for security purposes or to comply with applicable law, or the data is aggregated and anonymized for internal operations.

4. We do not share or sell personal data

We do not share or sell personal data. To make the service work, Luci relies on providers that process data on Luci's behalf, only to provide the service, under our instructions and with confidentiality and security obligations. They do not receive the data for their own purposes. Under the LFPDPPP they are Luci's processors (a "remission"), not a transfer, so they do not require your consent:

• Cloud: Google Cloud (servers, databases and file storage) and Cloudflare (DNS and network protection).
• Artificial intelligence models: Luci uses large language models (LLMs) and other AI models from external providers, hosted and operated in the United States, to generate the agents' responses, understand voice notes, images and documents, prepare and rank the knowledge base for search, and serve the platform's help chat. The models that generate responses and the ones that read voice notes, images and documents are used under paid offerings in which the provider does not use prompts or responses to train or improve its models; it only keeps them for a limited time to detect abuse and meet legal obligations.
• Invoicing: Facturapi, an electronic invoicing provider and authorized certification provider (PAC). It receives tax data to validate it with the SAT, stamp the CFDI and send them to the invoicing email.
• Email and verification: Brevo (transactional email) and Stytch (phone number verification for team members).
• Anti-bot verification: hCaptcha, at sign-up during subscription (see section 1).

In some cases your data goes through platforms that have their own relationship with you:

• Messaging channels. If you write through WhatsApp, Instagram, Messenger or another channel, that channel (for example, Meta) is the means by which you talk with the business, and it handles your messages under its own terms and privacy policy, which you accepted when using its app. Luci does not give it any additional data.
• Payments. When you pay by card, you enter your details directly with Stripe, which handles them under its own privacy policy and the card industry security standards (PCI DSS). Stripe may also use its own cookies to prevent fraud. Luci does not receive or store card data.

Reporting to the SAT. Every CFDI we issue is sent to the Tax Administration Service (SAT) through the PAC, because tax law requires it. This is a disclosure to an authority required by law, which does not require your consent.

Beyond the above, we would only disclose data when required by law or ordered by a competent authority. If we ever needed to transfer data in a way that requires your consent, we would ask for it first.

5. International transfers

Our servers are located in the United States (Google Cloud). The AI models listed in section 4 are hosted and operated in the United States. Other providers in that section, such as Stripe and hCaptcha, may process data in the United States, Canada or other countries where they have infrastructure. By using Luci, your data may be stored and processed outside Mexico, always with the security measures described in this policy.

6. Retention and deletion

• Account and configuration data: while the account is active and up to 90 days after the subscription ends. During that period the account can be reactivated with its data, or an export can be requested.
• Conversations and files (including candidates' documents): for as long as the business keeps them in its account or until it instructs us to delete them.
• Tax receipts (CFDI, their XML and PDF) and the tax data used to issue them: 5 years, as required by the Federal Tax Code. Payment and refund records: the same period.
• Tax data from a subscription that was never paid: we delete it once it is no longer needed to resolve that purchase attempt.
• Google data: while the Google account remains connected. When a user disconnects it in Luci, we stop accessing it and delete the stored OAuth tokens and the synchronized calendar and email data within 30 days. You can also revoke Luci's access at any time from myaccount.google.com/permissions.

7. Security

Luci is a security layer for our customers' information. We apply administrative, technical and physical measures to protect personal data against damage, loss, alteration, destruction or unauthorized use, access or processing. These include:

• Encryption in transit: connections to the website and the platform are encrypted (HTTPS with TLS), and unencrypted connections are redirected to an encrypted one.
• Encryption at rest: databases, server disks and files are stored encrypted on Google Cloud infrastructure.
• Passwords and cards: passwords are stored with a hashing algorithm, never in readable form, and Luci does not store card data: Stripe receives and safeguards it.
• Per-account access control: each business's information is tied to its own account and is only accessed by that account's users, with the permissions of the role their administrator assigns them.
• Our team's access: access to production servers is limited to authorized personnel, with individual accounts and through a controlled Google Cloud channel that is not open to the internet. To provide support, our team only enters a business's account when needed to handle its request.
• Backups: the production database has automatic daily backups and can be restored to an earlier point in time.

No system is infallible. If a security breach occurs that significantly affects your property or moral rights, we will inform you without delay so you can take the appropriate measures.

8. Your rights

You can request access to, rectification or deletion of your personal data, object to its use, revoke your consent, or limit its use or disclosure (ARCO rights). Send your request to hola@luci.mx with your name, the data or right involved, and a copy of an ID to verify your identity. We will reply within 20 business days and, if your request is granted, carry it out within 15 business days after our reply. Some data cannot be deleted while the law requires us to keep it (for example, data in a CFDI already issued). If you believe your rights have not been respected, you may go to the competent data protection authority in Mexico.

9. Changes to this policy

We will publish any change on this page and update the version and date at the top. If the change is significant, we will also notify registered users by email or within the platform.

10. Contact

For any matter related to this policy or your personal data, write to us at hola@luci.mx. Use of the platform is also governed by our Terms and Conditions. This policy is also available in Spanish; if there is a discrepancy, the Spanish version prevails.