Privacy Policy

Effective October 4, 2026

This Privacy Policy describes how Lucitra, Inc. ("Lucitra," "we," "us," or "our") collects, uses and protects personal information when you visit lucitra.ai, use the visibility scan, contact us, work with us, or use Agent Teams (together, the "Services").

1. Who We Are

Lucitra builds AI products, AI systems and websites for businesses, under a written agreement with each client. We also make Agent Teams, software that runs on your own computer. The website does not have accounts, and nothing on it requires you to sign in.

2. Information We Collect

When you contact us. The contact form asks for your name and work email, and lets you add your company, your website, the services you are interested in and a note about what you want AI to do. With it we receive the page you sent it from, and the site that referred you and any campaign tags in the link that started this visit. If you accepted analytics, it also carries the same details for your first and latest visits, and your analytics identifier. If you email us, we receive your message and address.

When you run the visibility scan. The scan takes a domain and fetches that site's public pages. Its findings are shown on your screen and are not stored, and it asks for no name or email. Your IP address is used, in memory, to limit how many scans one address can run each hour, and is not stored.

When we prepare a report for a business. We may scan the public pages of a business we would like to work with, or of a website someone gave us in the contact form, and prepare a report from what we find. A report is reviewed by us before it is shared. When a report link is opened, we record that it was opened and when; we do not record the viewer's IP address or browser.

About people at businesses we contact. We keep business contact details (name, role, company and work email or profile) for people at companies we would like to work with, gathered from public sources or from the person, and we contact them ourselves about our services.

When you browse the site. If you accept analytics in the cookie banner, we use PostHog to record the pages you visit, how you move between them, and errors the site hits, with a random identifier for your browser. Until you accept, PostHog is not loaded, so nothing is stored or sent. You can change your choice under Cookie settings at the bottom of any page. See the Cookie Policy.

When we work together. In an engagement we work with the data and systems your agreement with us describes, in your environment. How we handle that data is set out in that agreement, which governs it in place of this policy.

3. How We Use It

Reply to you, scope work, and keep a record of our conversations
Prepare and share the reports described above
Understand which pages are useful and fix what breaks, when you have accepted analytics
Limit abuse of the scan and the contact form
Meet our legal, accounting and security obligations

We do not sell personal information, and we do not use it to train AI models.

4. Agent Teams

Agent Teams runs on your own computer, needs no account, and collects no product telemetry. It sends us nothing. The coding agents it runs talk to their own model providers, such as Anthropic or OpenAI, under your account and your terms with that provider.

5. SMS and Text Messaging

Lucitra does not send text messages. Agent Teams can text you about work you started, such as an action waiting for your approval or a task that finished or failed, only through a messaging account you connect yourself, such as your own Twilio account, or push notifications through ntfy. It is off until you connect one.

Your number stays with you. You type your own number into Agent Teams on your computer, and it is checked with a one-time code before anything else is sent. The number, the code and the messages go from your computer to the provider you connected, under your account and your terms with that provider. They never pass through Lucitra, and we never receive them.
Stopping. Revoke the channel in Agent Teams and nothing further is sent. Your provider's own opt-out handling, such as replying STOP, also applies.

If Lucitra later sends text messages through its own account, we will update this section before any are sent. What leaves your machine, and when, is listed in What leaves your machine.

6. Data Retention

Enquiries and business contacts: kept while we are in contact about work, and afterwards as long as we need them for legal and accounting records. Ask us to delete yours at any time.
Reports: kept until they expire or we revoke them, along with the record of when they were opened.
Analytics: kept by PostHog for the retention period of our PostHog plan. The address analytics is sent through, ph.lucitra.ai, keeps a request log, including your IP address, for 365 days.
Public scans: not kept.

7. Service Providers

We use these providers to run the Services:

Google Cloud and Firebase: hosting for the website, the scan and contact services, our database, and the customer relationship system we run ourselves (US)
PostHog: website analytics, only when you accept them (US)
Amazon Web Services: email delivery of a contact form submission when our customer relationship system is unavailable (SES), and the address analytics is sent through, ph.lucitra.ai (US)

8. International Transfers

The Services are run in the United States. If you use them from outside the US, your information is transferred to and processed in the US.

If you are located in the European Economic Area, the UK, or Switzerland, you have the following rights under the General Data Protection Regulation:

Right of access: Request a copy of the personal data we hold about you
Right to rectification: Request correction of inaccurate personal data
Right to erasure: Request deletion of your personal data
Right to restriction: Request that we limit processing of your data
Right to data portability: Receive your data in a structured, machine-readable format
Right to object: Object to processing based on legitimate interests, including being contacted about our services
Right to withdraw consent: Change your analytics choice at any time

To exercise these rights, contact us at privacy@lucitra.ai. We will respond within 30 days.

10. CCPA Rights (California Residents)

California residents have the following rights under the California Consumer Privacy Act:

Right to know: Request disclosure of the categories and specific pieces of personal information we collect
Right to delete: Request deletion of your personal information
Right to correct: Request correction of inaccurate personal information
Right to opt-out: We do not sell personal information. We do not share personal information for cross-context behavioral advertising.
Right to non-discrimination: We will not discriminate against you for exercising your privacy rights

11. Changes to This Policy

We will update this policy when what we collect or how we use it changes, and change the effective date at the top of this page.

12. Contact Us

If you have questions about this Privacy Policy or wish to exercise your data rights, contact us:

By email: privacy@lucitra.ai
Lucitra, Inc., Boston, MA, United States

Questions about this policy? Email privacy@lucitra.ai.

Name	Where	Purpose	Kept
`ph_<key>_posthog`	Cookie	A random identifier for your browser, and the current session	1 year
`ph_<key>_posthog`	Local storage	The same identifier, as a backup to the cookie	Until you clear it
`lucitra-last-touch`	Session storage	The link or campaign that started this visit, sent only with a contact form message	Until you close the tab
`lucitra-first-touch`	Local storage	The link or campaign of your first visit	Until you clear it
`lucitra-last-touch`	Local storage	The link or campaign of your latest visit	Until you clear it