Privacy Policy

This Privacy Policy describes how Lucitra, Inc. ("Lucitra," "we," "us," or "our") collects, uses, and protects your personal information when you use our website, our software development and research services, and Agent Teams, our agent platform (together, the "Services"). By using our Services, you agree to the practices described here.

1. Information We Collect

We collect information you provide directly when you contact us, create an account, or use our Services:

Account information: Name, email address, organization name, and role
API keys: Keys you generate for programmatic access
Agent configurations: Agent specs, governance policies, and orchestration settings you define
Audit records: Action logs and approvals generated by the platform
Usage analytics: Aggregate page views collected via Umami, a cookieless analytics tool that stores no cookies and no personal data
Communications: Support requests, feedback, and correspondence

2. Data Processing

When you use our Services:

Your configurations and policies are processed solely to operate your work
Your data is never used to train Lucitra's own models
Data is stored encrypted at rest in Google Cloud Platform
Processing occurs in US regions
You may delete your data at any time

3. How We Use Your Information

Provide, operate, and maintain the Services
Generate audit trails and approvals
Improve our work using anonymized, aggregated metrics, never individual configurations
Communicate about your account, updates, and support
Detect and prevent abuse, fraud, and security incidents
Comply with legal obligations

4. Data Retention

Work data: Retained while your account is active. You may delete it at any time.
Audit records: Retained while your account is active, as they are your audit trail.
Account data: Retained while active and for 30 days after deletion to allow recovery.
Usage analytics: Retained for 24 months in anonymized, aggregated form.

5. Sub-processors

We use third-party providers to operate our Services. The full register, including what data reaches each provider, where it is located, and which providers may sit in a path handling protected health information, is published at Sub-processors and kept current there rather than duplicated here.

We do not sell personal data. We tell customers before adding or replacing a sub-processor, and you can object.

6. International Data Transfers

Our Services are hosted in the United States. If you access them from outside the US, your information is transferred to and processed in the US. We rely on Standard Contractual Clauses approved by the European Commission and participate in the EU-US Data Privacy Framework to protect data transferred from the European Economic Area, the UK, and Switzerland.

If you are in the European Economic Area, the UK, or Switzerland, you have these rights under the GDPR:

Access: Request a copy of the personal data we hold
Rectification: Request correction of inaccurate data
Erasure: Request deletion of your data
Restriction: Request that we limit processing
Portability: Receive your data in a machine-readable format
Objection: Object to processing based on legitimate interests

To exercise these rights, contact privacy@lucitra.ai. We respond within 30 days.

8. CCPA Rights (California Residents)

California residents have these rights under the CCPA:

Know: Request the categories and specific pieces of personal information we collect
Delete: Request deletion of your personal information
Opt out: We do not sell personal information, and we do not share it for cross-context behavioral advertising
Non-discrimination: We will not discriminate against you for exercising your rights

9. Contact Us

If you have questions about this Privacy Policy or wish to exercise your data rights, contact us:

By email: privacy@lucitra.ai
Lucitra, Inc., 8080 Westpark Drive, STE 42557, Houston, TX 77063, United States