Privacy Policy

The Services are used in two distinct ways, and our privacy role differs accordingly:

• When we act as a “controller.” For information about our business customers, prospects, website visitors, and account holders — for example, when you create an account, contact us, or browse our site — Lucy AI decides why and how the data is processed, and this Policy governs that processing.
• When we act as a “processor” / “service provider.” When a business customer (“Customer”) uses the Services to operate a chatbot, voice agent, or to translate or transcribe documents, end users (such as the Customer's website visitors or callers) may submit content and personal information. We process that “Customer Content” on behalf of and under the instructions of the Customer, who is the controller of that data. In that case, the Customer's own privacy notice governs, and this Policy describes our practices as a processor. If you are an end user and have questions about how your data is handled, please contact the organization operating the chatbot or voice agent.

Our processing of Customer Content on behalf of Customers is governed by our agreement with that Customer and, where applicable, a Data Processing Agreement (“DPA”). To request a DPA, contact us at support@lucyhub.ai.

a. Information you provide to us.

• Account and contact data: name, business email, phone number, company name, role, billing details, and login credentials.
• Communications: messages you send us (support, sales, email), and feedback or survey responses.

b. Customer Content processed through the Services. Depending on the product, this may include:

• Chat content: messages typed by end users into a chat widget (including the WordPress plugin widget) and the AI responses returned.
• Voice content: audio of calls handled by voice agents, and any transcripts, recordings, or derived data.
• Documents and media: files submitted for translation or transcription, which may themselves contain personal or sensitive information about third parties.
• Derived data: transcripts, translations, summaries, sentiment scores, and analytics generated from the above.

c. Information collected automatically.

• Usage and device data: IP address, browser and device type, pages viewed, referring URLs, timestamps, and interaction events.
• Cookies and similar technologies: see Section 9.

d. Information from third parties. We may receive data from our Customers, integration partners, analytics providers, and publicly available sources, consistent with their own notices and our agreements.

We do not intentionally collect special-category or sensitive personal data from website visitors. However, Customer Content (e.g. documents submitted for translation, or chat/voice conversations) may contain such data; Customers are responsible for ensuring they have a lawful basis to submit it. See the Terms of Service.

We use the information described above to:

• provide, operate, maintain, and secure the Services;
• create and manage accounts and authenticate users;
• process chat, voice, translation, and transcription requests and return AI-generated results;
• process payments and manage subscriptions;
• provide customer support and respond to inquiries;
• monitor, analyze, and improve performance, reliability, and safety of the Services;
• detect, prevent, and investigate fraud, abuse, and security incidents;
• comply with legal obligations and enforce our agreements; and
• with your consent where required, send marketing communications about our Services.

Where the GDPR or similar laws apply, our legal bases are: performance of a contract (providing the Services you request); legitimate interests (securing and improving the Services, B2B marketing, fraud prevention), balanced against your rights; consent (e.g. certain cookies and marketing); and compliance with a legal obligation.

The Services use artificial intelligence and machine-learning models, including models tuned for Amharic, Afaan Oromo, Tigrinya, and English. Inputs are processed to generate outputs (responses, translations, transcripts).

AI outputs can be inaccurate or incomplete. We do not represent that translations, transcripts, or chatbot responses are error-free, and they should not be relied upon as professional, legal, financial, or medical advice. See the AI disclaimer in our Terms of Service.

We do not sell personal information. We disclose information only as follows:

• Service providers / sub-processors: cloud hosting and infrastructure providers, communications providers, payment processors, analytics providers, and AI/ML infrastructure providers that process data on our behalf under contract. Our backend services operate via infrastructure at backend.zemenu.org, which is operated by us. A current list of sub-processors is available on request at support@lucyhub.ai.
• Customers: where we act as processor, we return Customer Content and results to the relevant Customer.
• Legal and safety: to comply with law, legal process, or lawful government requests, and to protect the rights, property, or safety of Lucy AI, our users, or the public.
• Business transfers: in connection with a merger, acquisition, financing, or sale of assets, subject to this Policy.
• With your consent or at your direction.

We operate in the United States and Ethiopia and may process data in either location and in countries where our service providers operate. If you are located in the EEA, the UK, or another region with cross-border transfer restrictions, your information may be transferred to and processed in countries that may not provide the same level of protection as your home jurisdiction. Where required, we rely on appropriate safeguards such as the European Commission's Standard Contractual Clauses (and the UK Addendum) for such transfers. To request more information or a copy of the relevant safeguards, contact support@lucyhub.ai.

We retain personal information only as long as necessary for the purposes described in this Policy, including to provide the Services, comply with legal obligations, resolve disputes, and enforce agreements.

• Account data is retained for the life of the account and for a limited period afterwards where we need it to meet legal, tax, or dispute-resolution obligations.
• Customer Content is retained according to the Customer's configuration and our agreement with the Customer, and is deleted or returned on termination as described in the DPA.
• Voice recordings and transcripts are retained for the period configured by the Customer and are deleted or returned on termination.

When retention is no longer required, we delete or de-identify the information.

We use technical and organizational measures designed to protect personal information, including encryption in transit and, where appropriate, at rest, access controls, and monitoring. You can read more about our approach on our security page. No method of transmission or storage is completely secure, and we cannot guarantee absolute security.

Our websites use cookies and similar technologies for essential functionality, to remember preferences, and to understand usage and improve the site. You can control cookies through your browser settings and, where provided, our cookie banner.

The WordPress chatbot widget uses local browser storage to remember a visitor's conversation across page reloads on the Customer's site; this data stays on the visitor's device and is associated with the conversation processed by the Services.

Depending on where you live, you may have some or all of the following rights regarding your personal information: to access, correct, delete, restrict or object to processing, port your data, and withdraw consent. You also have the right not to receive discriminatory treatment for exercising these rights.

• EEA/UK (GDPR/UK GDPR): you may exercise the rights above and lodge a complaint with your local supervisory authority.
• California (CCPA/CPRA): you may request access, deletion, and correction, and may opt out of any “sale” or “sharing” of personal information. We do not sell or share personal information as those terms are defined under California law.
• Virginia (VCDPA) and other US state laws: residents of Virginia and certain other states have access, correction, deletion, portability, and opt-out rights, including for targeted advertising and profiling.
• Ethiopia: we handle personal data in accordance with applicable Ethiopian data protection law.

To exercise any right, contact us at support@lucyhub.ai. We will verify your request and respond within the timeframe required by applicable law. If we act as a processor on behalf of a Customer, we will refer your request to that Customer or assist them in responding.

The Services are intended for business use and are not directed to children. We do not knowingly collect personal information from children under the age of 16. If you believe a child has provided us personal information, contact us and we will take appropriate steps to delete it.

Our Services and websites may link to or integrate with third-party sites and services (for example, the WordPress plugin runs on a site you control, and our site links to LinkedIn and Instagram). We are not responsible for the privacy practices of those third parties; their own policies govern.

When a site owner installs and configures the Lucy AI Chatbot plugin with a valid Integration ID, a chat widget appears on that site. When a visitor sends a message, the message is transmitted to Lucy AI's backend (backend.zemenu.org) to generate a response. No data is sent unless the plugin is configured and a visitor actively uses the widget. For data submitted through the widget, Lucy AI acts as a processor on behalf of the site owner (the controller); the site owner is responsible for providing notice to and obtaining any required consent from its visitors.

We may update this Policy from time to time. We will post the updated version with a new “Last updated” date and, where required, provide additional notice. Your continued use of the Services after the effective date constitutes acceptance of the updated Policy.

Lucy Software Solutions PLC (Lucy AI / LucyHub)

Email: support@lucyhub.ai
United States: Arlington, Virginia, USA
Ethiopia: Addis Ababa, Ethiopia

For privacy-specific requests, please mark your message “Privacy Request.”