Lucitra: agent teams on your own machine

This Privacy Policy describes how Lucitra, Inc. ("Lucitra," "we," "us," or "our") collects, uses, and protects your personal information when you use our agent infrastructure platform and related services (the "Services"). By using our Services, you agree to the practices described in this policy.

1. Information We Collect

We collect information you provide directly when you create an account, use our APIs, or contact us for support:

Account information: Name, email address, organization name, and role
API keys: Keys that you generate for programmatic access
Agent configurations: Agent specs, governance policies, and orchestration settings you define
Task metadata, if you claim a hosted account: references, status and timing for work you started — never your source, a diff, or a file
Usage analytics: API call frequency, feature usage patterns, and performance metrics collected via PostHog
Communications: Support requests, feedback, and correspondence

2. Data Processing

When you use our agent infrastructure platform:

Agent configurations and governance policies are processed solely for the purpose of operating your agent systems
Your data is never used to train Lucitra's own models
All data is stored encrypted at rest in Google Cloud Platform
Processing occurs in Google Cloud Run instances in US regions
You may delete your data at any time via the API or dashboard

3. How We Use Your Information

Provide, operate, and maintain the Lucitra platform
Route messages to a device you verified
Improve our infrastructure using anonymized, aggregated metrics (never individual configurations)
Communicate with you about your account, service updates, and support requests
Detect and prevent abuse, fraud, and security incidents
Comply with legal obligations

4. Data Retention

Agent data: Retained while your account is active. You may delete configurations and logs at any time.
Task metadata: Retained while your account is active, so history and usage survive across machines. Deleted with the account.
Account data: Retained while your account is active and for 30 days after deletion to allow recovery.
Usage analytics: Retained for 24 months in anonymized, aggregated form.

5. Sub-processors

We use the following third-party service providers to operate our Services:

Google Cloud Platform: Cloud infrastructure, compute, and storage (US regions)
Stytch: Authentication and identity management
PostHog: Product analytics (US-hosted)
AWS SES: Transactional email delivery

6. International Data Transfers

Our Services are hosted in the United States. If you access our Services from outside the US, your information will be transferred to and processed in the US. We rely on Standard Contractual Clauses (SCCs) approved by the European Commission and participate in the EU-US Data Privacy Framework to ensure adequate protection for data transferred from the European Economic Area, the UK, and Switzerland.

If you are located in the European Economic Area, the UK, or Switzerland, you have the following rights under the General Data Protection Regulation:

Right of access: Request a copy of the personal data we hold about you
Right to rectification: Request correction of inaccurate personal data
Right to erasure: Request deletion of your personal data
Right to restriction: Request that we limit processing of your data
Right to data portability: Receive your data in a structured, machine-readable format
Right to object: Object to processing based on legitimate interests

To exercise these rights, contact us at privacy@lucitra.ai. We will respond within 30 days.

8. CCPA Rights (California Residents)

California residents have the following rights under the California Consumer Privacy Act:

Right to know: Request disclosure of the categories and specific pieces of personal information we collect
Right to delete: Request deletion of your personal information
Right to opt-out: We do not sell personal information. We do not share personal information for cross-context behavioral advertising.
Right to non-discrimination: We will not discriminate against you for exercising your privacy rights

9. SMS and Text Messaging

Lucitra can text you about work you started — a request to approve or decline an action an agent is waiting on, or notice that a task finished or failed. It is optional, and off until you turn it on.

You provide the number yourself. You type your own mobile number into the Lucitra application. A one-time verification code is sent to it, and nothing else is sent until you type that code back, proving the handset is yours. We never upload, import, or purchase phone numbers, and no one can enter a number on your behalf.
We do not share or sell mobile numbers. Mobile phone numbers and SMS consent are never shared with or sold to third parties or affiliates for marketing purposes. A number is disclosed only to the messaging carrier that delivers your messages, solely in order to deliver them.
Message frequency varies and depends entirely on your own activity — typically a few messages per day at most, and only in response to work you started.
Message and data rates may apply.
Stopping takes one step. Revoke the channel in the application, or reply STOP. We keep a record that the number was once registered, so that “did this number ever receive anything” stays answerable, and send nothing to it again.
Where the number is kept. Lucitra runs on your own computer and your number is stored there. If you claim a hosted account so messages can reach you when that computer is closed, we hold the number in order to route to it — and nothing about the contents of your work.

10. Contact Us

If you have questions about this Privacy Policy or wish to exercise your data rights, contact us:

By email: privacy@lucitra.ai
Lucitra, Inc., Austin, TX, United States

Privacy Policy