Privacy Policy

1. Who We Are

LUCY is operated by PT Perorangan, Indonesia. When you use LUCY, PT Perorangan is the data controller responsible for your personal data under Indonesian law (Undang-Undang Perlindungan Data Pribadi / UU PDP).

2. What We Collect

We collect only what we need to provide and improve the service.

Information you give us directly

• Your name or nickname (used by your assistant when addressing you).
• Your assistant's name and chosen voice, so we can personalise the experience consistently.
• A short personal bio — work, goals, or context you choose to share. This is the foundation of your assistant's memory.
• Your language preference and morning briefing settings (time and timezone).
• Payment information — collected and stored by Paddle, our payment processor. We do not store your full card details.

Information generated through use

• Telegram user ID — the unique number Telegram assigns to your account. This links your subscription to your bot.
• Bot token hash — a one-way hash of your Telegram bot token. We never store the token itself in readable form.
• Conversation logs — messages exchanged with your assistant, used to maintain memory and context across sessions.
• Usage patterns — when you message, which features you use, and how your assistant responds over time. Used to improve the service.

Information we do not collect

• Your real name, address, or government ID — unless you voluntarily share these in conversation.
• Your device information, IP address, or location — beyond what Telegram's infrastructure provides.

3. How We Use Your Data

• To power your assistant. Your bio, name, and conversation history are the foundation of your assistant's memory. Without them, the service cannot function as described.
• To deliver morning briefings. If you opt in, your timezone and preferred time are used to send your daily digest.
• To manage your subscription. We share minimal billing data with Paddle to process payments and handle renewals.
• To improve the service. Aggregated, anonymised usage patterns help us understand what works and what doesn't.
• To communicate with you. We may email you about your account, billing, or important service updates. We do not send unsolicited marketing.

4. What We Never Do

• We never sell your personal data. Not to advertisers, data brokers, or any third party. Ever.
• We do not share your conversations with third parties except the AI infrastructure providers required to operate the service, who are bound by strict data processing agreements.
• We do not use your conversations to train public AI models that could expose your personal context to other users.
• We do not use your data for advertising or build advertising profiles about you.

5. How Long We Keep Your Data

While your subscription is active, we retain your data to provide continuous service. Your assistant's memory depends on this.

When you cancel your subscription:

• Your account data is retained for 30 days in case you return.
• After 30 days, all personal data — including your bio, conversation logs, and assistant configuration — is permanently deleted.
• Anonymised, aggregated usage statistics may be retained indefinitely as they contain no personal information.

You can also request immediate deletion at any time, regardless of your subscription status (see Your Rights below).

6. Your Rights

Under Indonesian data protection law (UU PDP), you have the following rights:

• Access — request a copy of the personal data we hold about you.
• Correction — ask us to correct inaccurate or incomplete data.
• Deletion — request that we permanently delete your personal data. We will action this within 14 days.
• Portability — receive your personal data in a machine-readable format.
• Objection — object to how we process your data in certain circumstances.
• Withdrawal of consent — where processing is based on consent, you may withdraw it at any time without affecting prior processing.

To exercise any of these rights, email hello@meetlucy.id with your request. We will respond within 14 days.

7. Security

We take reasonable technical and organisational measures to protect your data, including:

• Encryption of data in transit (TLS) and at rest.
• One-way hashing of your Telegram bot token — we store only a hash, never the token itself in readable form.
• Access controls limiting who can view user data internally.

No system is perfectly secure. If we become aware of a breach affecting your personal data, we will notify you promptly.

8. Third-Party Services

LUCY relies on a small number of third-party services to operate:

• Telegram — the messaging platform through which your assistant communicates with you. Telegram's own privacy policy applies to your use of their platform.
• Paddle — our payment processor. Paddle acts as the merchant of record and handles payment data under their own privacy policy.
• AI infrastructure providers — the underlying models that power your assistant. These providers are contractually prohibited from using your data for any purpose other than delivering the service.

9. Children

LUCY is not intended for anyone under 18 years of age. We do not knowingly collect data from children. If you believe a child has provided personal data through our service, please contact us and we will delete it promptly.

10. Changes to This Policy

We may update this policy from time to time. We will notify you by email at least 14 days before material changes take effect. The date at the top of this page reflects when the policy was last revised.

11. Governing Law

This Privacy Policy is governed by the laws of the Republic of Indonesia, including the Undang-Undang Perlindungan Data Pribadi (UU PDP No. 27 Tahun 2022). Any disputes arising from this policy are subject to Indonesian jurisdiction.