Privacy Policy

This policy explains what Lucidrail collects, why, and the choices you have. It covers the Service at lucidrail.ai. The short version: your data and work are yours, we don't sell your personal information, and we don't train foundation models on your private content.

1. What we collect

• Account information — your email and the basic profile details you give us when you sign up.
• Content you provide — the companies, agents, goals, issues, documents, messages, and other data you and your agents create or upload.
• Connected credentials — model provider keys and other secrets you choose to connect. These are encrypted at rest and used only to run the features you enable.
• Voice and call data — when you use voice or phone features, the call audio, transcripts, and call metadata (such as phone numbers and call times) needed to place, answer, and act on your calls.
• Connected Google Workspace data — if you connect a Google account, the Gmail, Calendar, Drive, Docs, and Sheets data your agents read to do the work you asked for. Section 5 covers this in detail.
• Usage and technical data — logs, model token usage and cost, and basic request metadata used to run, secure, and meter the Service.
• Payment data — handled by our payment processor (Stripe). We store your plan and subscription status, not your full card details.

2. How we use it

• to provide, secure, and improve the Service;
• to run your agents and the integrations you turn on;
• to meter usage, apply budget caps, and bill paid plans;
• to reach you about your account, security, and support; and
• to comply with the law and enforce our Terms.

We don't sell your personal information, and we don't use your private content to train foundation models.

3. Who processes data for us

We rely on a small set of trusted providers to run the Service. Each handles only its part:

• Anthropic and any other model providers you connect — AI model inference.
• Neon — managed Postgres database (data storage).
• Fly.io — application compute.
• Vercel — web hosting and content delivery.
• Resend — transactional email (sign-in and account emails).
• Stripe — payment processing for paid plans.
• LiveKit and Twilio — real-time voice and phone, where you use those features.

When you bring your own provider keys, that provider processes whatever your agents send it under its own terms.

4. Voice and phone calls

Calls get special handling. When you use voice or phone features, your agents place and answer calls, and we process the audio, transcripts, and call details to do it. If a call is recorded or transcribed, we play a spoken notice at the start so everyone on the line knows before it happens. Recordings and transcripts are your content: we keep them under the retention schedule below, you can delete them, and we don't use them to train foundation models. Getting the consent the law requires before recording or contacting someone is your responsibility — see the Terms.

5. Google Workspace data

Lucidrail's use and transfer of information received from Google APIs to any other app will adhere to the Google API Services User Data Policy, including the Limited Use requirements.

Connecting a Google account is optional, and nothing below happens unless you connect one. When you do, here is exactly what we touch and why.

• Gmail — to list or count your messages we read only the sender, subject, and date. We do not read message bodies. We send mail only when you or an agent you run asks us to, and we compose that message ourselves rather than reading your existing mail.
• Calendar, Drive, Docs, and Sheets — we read the events, files, documents, and spreadsheets your agent opens to carry out the task you gave it, and we create or edit them when you ask. File contents are read in excerpts, not mirrored wholesale.

Where it goes. To answer you, your agent sends what it read to the AI model provider that powers that agent — Anthropic by default, or another provider if you configure one. We do not send your Google data anywhere else, we never sell it, we never use it for advertising, and we do not use it to train foundation models.

What we keep. We don't hold a standing copy of your mailbox or Drive. Short excerpts of what an agent read are written into that run's log so you can see what your agent did, and anything an agent writes into a Lucidrail comment or document is stored as your content. Run logs are deleted when you delete the agent that produced them or close your account, and are covered by the retention schedule in section 7. Content an agent wrote into a comment or document is removed when you delete that item.

Who can see it. Your Google data is scoped to your company and no other customer can reach it. We don't read it. The narrow exceptions are the ones the Google API Services User Data Policy allows: with your explicit permission, when it's necessary for security or to fix a problem you reported to us, or when the law requires it. If you report a problem and choose to share the run with us, that report can include excerpts of what the agent read — that sharing is off by default and only happens when you click to share it.

Turning it off. Disconnect the Google plugin in Lucidrail at any time, or revoke our access directly from your Google Account permissions page. Revoking stops all future access immediately.

6. Security

We encrypt data in transit, seal stored secrets with strong encryption, scope every request to one company, keep secrets out of logs, and record changes in a tamper-evident audit trail. See our Security page for the controls that are live today. No system is perfectly secure, but we take reasonable steps to protect your data.

7. How long we keep data

We keep your data while your account is active, under a documented retention schedule that covers different record types — including call recordings and transcripts. Before anything is permanently deleted, we first copy it to secure cold storage, so a purge is deliberate and recoverable during its window. You can export or delete your data anytime; when you delete content or close your account, we remove it within a reasonable period, except records the law requires us to keep (for example, billing records).

8. Cookies and analytics

We use a small number of essential cookies to keep you signed in. We may use privacy-aware analytics to understand how the public site is used; these don't identify you personally and can be blocked by your browser.

9. Your privacy rights

Depending on where you live, you may have the right to access, correct, export, or delete your personal data, and to object to certain processing. We honor these requests wherever you are, and we won't discriminate against you for making one. To exercise a right, email privacy@lucidrail.ai. And to be clear: we don't sell your personal information.

10. Children

The Service isn't directed to children, and we don't knowingly collect data from children.

11. Changes to this policy

We may update this policy. If we make material changes, we'll let you know and update the effective date above.

12. How to reach us

Privacy questions? Email privacy@lucidrail.ai.