Privacy Policy

1.1 Where this policy applies

This policy applies whenever you browse our website, sign up for the waitlist, register for or use an account, access the dashboard, or submit requests through our API and associated services.

1.2 What it explains

It sets out the categories of information we collect, the purposes for which we use it, the circumstances in which we share it, and the choices available to you.

2.1 Lucenta as controller

Lucenta acts as an independent data controller for personal data collected in connection with account registration, billing, and the operation of the Platform.

2.2 Lucenta as processor

When we handle API requests that contain personal data on behalf of our customers, Lucenta may act as a data processor. In that case, the processing is governed by our Data Processing Addendum ("DPA").

We collect information you give us directly, as well as technical and service data needed to operate, secure, and improve the Platform. This includes:

• Contact and profile details, such as your name, email address, company name, and job title.
• Account and authentication data, including sign-in activity and account preferences.
• Usage and operational data, such as API request metadata, billing events, routing diagnostics, and product analytics.
• Device and network data, including browser type, cookie identifiers, and IP-related information, which help us detect abuse and assess product performance.

4.1 Core purposes

We use information to deliver the Platform, verify users, route requests, monitor reliability, handle support requests, detect and prevent fraud or abuse, and meet our legal obligations.

4.2 Aggregated data

We may also use aggregated or de-identified data to study usage trends, improve system performance, and understand how customers use the Platform.

5.1 Grounds we rely on

Where applicable law requires a legal basis, we process personal data on the basis of contractual necessity, our legitimate interests, compliance with legal obligations, and your consent where required.

5.2 Legitimate interests

These include keeping the Platform secure, preventing fraud and abuse, maintaining service reliability, optimizing our infrastructure, and running our business.

6.1 Our routing role

Lucenta operates as a routing and exchange layer between customers and third-party model providers ("Providers"). To deliver the requested service, we may process request metadata, performance metrics, and billing signals.

6.2 No model training

Unless a product-specific agreement states otherwise, we do not use your prompts or outputs to train our own models.

6.3 Transmission to Providers

Your requests may be sent to the Provider selected to fulfill them, and that Provider's own terms and data practices will also apply. Lucenta does not control, and is not responsible for, the data handling practices of Providers.

6.4 Limited retention of request content

We may keep truncated request data, including prompts and outputs, for a limited period (typically 7 to 90 days, as configured for operations) and solely for service operation, security, debugging, abuse prevention, and product quality analysis. Billing and routing metadata may be kept longer as described in the retention section below.

6.5 Automated routing

Routing decisions may be made dynamically and by automated systems, based on availability, latency, reliability, pricing, operational efficiency, and other commercial factors described in our Terms of Service. This processing follows the roles and responsibilities set out in the DPA where applicable.

6.6 Integrity reviews

We may carry out automated or manual reviews of routing behavior, Provider integrity signals, unusual usage patterns, and infrastructure risk indicators for security, fraud prevention, compliance, and reliability purposes.

6.7 Protective measures

Where reasonably necessary to protect the Platform, our users, Providers, or third parties, we may suspend, limit, reroute, or end specific traffic flows, Provider connections, or service activity.

7.1 Subprocessors

Lucenta may engage third parties, including model providers and infrastructure vendors, to process data on our behalf. A current list of subprocessors is available on request at privacy@lucenta.ai.

7.2 Operational sharing

We may share information with infrastructure vendors, analytics services, payment processors, and model providers where needed to operate the Platform.

7.3 Roles of third parties

Depending on the processing activity, these third parties may act as processors, subprocessors, or independent controllers under their own terms and privacy practices.

7.4 Legal and protective disclosures

We may disclose information where required by law, to enforce our agreements, or to protect the rights, safety, and security of Lucenta, our users, or others.

7.5 No sale of personal data

We do not sell your personal data.

8.1 Cross-border processing

Lucenta is based in the United States, and your information may be transferred to and processed in countries other than your own, including the United States.

8.2 Safeguards

Where required, we rely on appropriate safeguards, such as Standard Contractual Clauses or equivalent mechanisms, to protect personal data transferred internationally.

8.3 Provider locations

Except where necessary for routing, legal compliance, sanctions screening, security controls, or infrastructure management, Lucenta does not independently determine the jurisdictions in which Providers operate or process data. Providers may process data according to their own infrastructure locations, operating environments, and legal obligations.

8.4 Customer responsibility

You are responsible for assessing whether the use of a particular Provider meets your own regulatory, contractual, or data localization requirements.

9.1 General principle

We keep personal data only as long as needed to provide the Platform, meet legal obligations, resolve disputes, and enforce our agreements.

9.2 Variable periods

Retention periods depend on the type of data, including account information, billing records, and API usage logs. Billing records, security logs, and abuse prevention data may be kept where reasonably necessary, including for service continuity and operational integrity.

9.3 Operational logs

Standard operational and routing logs are generally kept for up to 180 days.

9.4 Extended retention

Records relating to security incidents, abuse investigations, fraud prevention, and compliance may be kept longer where reasonably necessary to protect legal rights, enforce our policies, comply with applicable law, or preserve the integrity of the Platform.

We apply administrative, technical, and organizational measures designed to protect your information. However, no method of transmission or storage is completely secure, and we cannot guarantee absolute security.

11.1 Available rights

Depending on where you live, you may have the right to access, correct, delete, restrict, or object to the processing of your personal data, and to receive a portable copy of it. Where processing relies on consent, you may withdraw that consent at any time.

11.2 How to exercise them

You can exercise these rights by contacting us at privacy@lucenta.ai. We will respond in line with applicable data protection laws and may need to verify your identity before acting on your request.

11.3 Complaints

You also have the right to lodge a complaint with a competent data protection authority.

The Platform is not intended for children under 13 (or the higher minimum age set by local law), and we do not knowingly collect their personal data. If we learn that we have collected such data, we will take steps to delete it.

13.1 Why we use them

We use cookies and similar technologies to run our website, measure performance, and keep the Platform secure.

13.2 Types used

These may include strictly necessary cookies, authentication and session cookies, security cookies, performance and analytics cookies, and preference management tools. Some may be set by third-party analytics, infrastructure, or security providers that support the Platform.

13.3 Your choices

Where required by law, we will ask for your consent before placing non-essential cookies. You can manage or disable cookies through your browser settings or our cookie preference controls, and you may change or withdraw your preferences at any time.

We may update this Privacy Policy from time to time. Material changes will be posted on this page, and the "Last updated" date will be revised accordingly.