← Back

Privacy Policy

This Privacy Policy explains how luca.ecosystem ("we", "us", "our") collects, uses, stores, and protects your personal data when you use lucAI and related services (the "Service"). We are committed to protecting your privacy in accordance with the General Data Protection Regulation (EU) 2016/679 ("GDPR"), the Romanian Law No. 363/2018 on the protection of natural persons with regard to the processing of personal data, and other applicable data protection legislation.

By using the Service, you acknowledge that you have read and understood this Privacy Policy.

1. Data Controller

The data controller responsible for your personal data is:

Field	Detail
Data Controller	Luca, operating under luca.ecosystem
Legal Representative	Parent/legal guardian of Luca (available upon request)
Email	Contact Form
Country	Romania (EU Member State)

As Luca is a minor under Romanian law, a parent or legal guardian acts as co-controller and legal representative for data protection purposes. You may contact our legal representative via the contact form (select "Privacy / Data Protection Request").

2. Data We Collect

We collect and process the following categories of personal data:

2.1 Account Data

• Email address — required for account creation and authentication
• Password — stored as a salted hash (we never see your plaintext password)
• Display name — optional, used for marketplace attribution

2.2 Usage Data

• Messages sent to lucAI — your prompts and AI responses during active sessions
• Knowledge base content — documents or text you upload for AI context
• Tool usage — which tools you use and how frequently

2.3 Technical Data

• IP address — collected by Cloudflare for security and rate limiting
• Browser and device information — standard server logs
• Usage patterns — rate limit counters, feature usage

3. Purposes and Legal Basis for Processing

Purpose	Legal Basis (GDPR Art. 6)
Account creation and authentication	Art. 6(1)(b) — Performance of a contract
Processing AI messages and generating responses	Art. 6(1)(b) — Performance of a contract
Knowledge base storage and retrieval	Art. 6(1)(b) — Performance of a contract
Rate limiting and abuse prevention	Art. 6(1)(f) — Legitimate interest
Service improvement and analytics	Art. 6(1)(f) — Legitimate interest
Marketplace tool publishing and attribution	Art. 6(1)(b) — Performance of a contract
Security monitoring and incident response	Art. 6(1)(f) — Legitimate interest
Compliance with legal obligations	Art. 6(1)(c) — Legal obligation

4. AI Disclosure

In accordance with the EU AI Act (Regulation (EU) 2024/1689), we inform you that:

• lucAI is an artificial intelligence system — you are interacting with AI, not a human
• AI-generated responses may contain inaccuracies, biases, or outdated information
• AI outputs should not be treated as professional advice (medical, legal, financial, or otherwise)
• Your messages are processed by a large language model hosted by Groq (see Sub-processors below)

5. Sub-processors

We share your data with the following third-party sub-processors who assist in providing the Service:

Sub-processor	Purpose	Location	DPA
Cloudflare, Inc.	Hosting (Workers, D1, KV, Pages), CDN, DDoS protection	United States / Global Edge	Cloudflare DPA
Groq, Inc.	AI inference (large language model processing)	United States	Groq Terms of Service

Both Cloudflare and Groq are certified under the EU-US Data Privacy Framework. Cloudflare additionally incorporates Standard Contractual Clauses (SCCs) as a fallback transfer mechanism.

6. International Data Transfers

Your data may be transferred to and processed in countries outside the European Economic Area (EEA), specifically the United States, where our sub-processors operate. We ensure adequate protection through:

• EU-US Data Privacy Framework — Cloudflare and Groq are certified
• Standard Contractual Clauses (SCCs) — adopted as supplementary safeguard
• Data minimization — we only transfer data strictly necessary for service provision

7. Data Retention

Data Type	Retention Period
Account data (email, password hash, display name)	While account is active + 30 days after deletion
Session tokens	Up to 30 days; rotated on use
Knowledge base content	While account is active + 30 days after deletion
Rate limit counters	24 hours (auto-expire)
Published marketplace tools	Retained until developer requests removal

AI conversation messages are processed in real-time and not stored permanently on our servers. Messages may temporarily reside in memory during active sessions only.

8. Your Rights (GDPR Art. 15-22)

Under the GDPR and Romanian data protection law, you have the following rights:

• Right of access (Art. 15) — Request a copy of all personal data we hold about you
• Right to rectification (Art. 16) — Correct any inaccurate personal data
• Right to erasure (Art. 17) — Request deletion of your personal data ("right to be forgotten")
• Right to restriction (Art. 18) — Restrict processing of your personal data
• Right to data portability (Art. 20) — Receive your data in a structured, machine-readable format
• Right to object (Art. 21) — Object to processing based on legitimate interest
• Right not to be subject to automated decision-making (Art. 22) — lucAI does not make automated decisions with legal effects about you
• Right to withdraw consent (Art. 7(3)) — Where processing is based on consent, withdraw at any time

To exercise any of these rights, use our contact form (select "Privacy / Data Protection Request"). We will respond within 30 days (extendable to 60 days for complex requests, with notification).

9. Right to Lodge a Complaint

If you believe your data protection rights have been violated, you have the right to lodge a complaint with:

Authority	Detail
Supervisory Authority	Autoritatea Națională de Supraveghere a Prelucrării Datelor cu Caracter Personal (ANSPDCP)
Website	www.dataprotection.ro
Email	anspdcp@dataprotection.ro

10. Children's Privacy

The Service is intended for users aged 16 and above. We do not knowingly collect personal data from children under 16. If we become aware that a child under 16 has provided us with personal data, we will take steps to delete such information promptly.

Users under the age of 16 must obtain parental or guardian consent before using the Service.

11. Data Security

We implement appropriate technical and organizational measures to protect your personal data, including:

• Passwords are hashed using PBKDF2 with random salts
• Session tokens are HMAC-SHA256 signed with rotating secrets
• All communications are encrypted via TLS (HTTPS)
• Rate limiting and brute-force protection on authentication endpoints
• Content Security Policy headers on all responses
• Cross-Origin Resource Sharing (CORS) restricted to known origins
• Input validation and sanitization on all user inputs

12. Cookies and Tracking

The Service uses localStorage for essential functionality (authentication tokens, UI preferences). We do not use tracking cookies, advertising cookies, or third-party analytics services that set cookies.

Cloudflare may set essential security and performance cookies as part of its CDN and DDoS protection services.

13. Changes to This Policy

We may update this Privacy Policy from time to time. Material changes will be communicated via the Service or by email (if you have provided an email address). Continued use of the Service after changes take effect constitutes acceptance of the updated policy.

14. Contact

For any questions about this Privacy Policy or to exercise your data protection rights:

Email	Contact Form
Subject line	"Data Protection Request — [your request type]"

We aim to acknowledge all requests within 3 business days and provide a substantive response within 30 calendar days.