Privacy Policy

1. Information Collection

We collect personal information when you:

• Create a LuraFlow account
• Process payments through PayPal or Stripe
• Contact our support team
• Use our platform services

Types of information we collect:

• Name, email, phone number
• Billing address and payment information
• IP address, browser information (analytics)
• Service usage data and logs
• API keys and authentication tokens

2. How We Use Your Data

• Provide and improve our services
• Process payments and subscriptions
• Send service notifications and updates
• Comply with legal obligations
• Prevent fraud and security threats
• Provide customer support

Connected Apps and Lura Assistant

Connecting Google Workspace or Microsoft 365 is optional and separate from signing in. You choose the available capabilities and authorize them with the provider. A connection belongs to your user account in the current workspace; it does not give coworkers access to your personal account. Availability depends on your workspace and provider approval.

We use your provider identity, email address, permission grants and encrypted access and refresh tokens to operate the connection. Selected file and calendar identifiers, display names, approval details and action receipts support the tools you request. Google Drive access is limited to files selected for this app or created by it. Microsoft file permissions cover your own files more broadly, but Lura reads only the files you select. Calendar tools use calendars you own and select. Separately enabled Gmail or Outlook access searches a bounded date range and reads messages you select; it does not copy your entire mailbox or ingest attachments.

When you ask AI about a selected source, your question and a bounded excerpt are sent to the AI processor configured for your workspace, currently OpenAI or Anthropic, to produce that answer. Connecting an account alone does not send its contents to an AI processor. Lura does not use connected-account content to train general-purpose models, build an advertising profile, or sell data. Provider content is treated as information, never as permission to perform an action. Document creation, calendar events and email sending require review of the exact details and a separate approval. Provider acceptance of a message does not establish delivery to its recipient.

Source previews are fetched for the requested operation; this feature does not maintain a full file or mailbox mirror. Source-question plaintext is not stored as chat history. A completed source answer is encrypted for brief recovery, becomes unavailable after two minutes, and is cleared by the maintenance sweep. Connection metadata, resource selections, encrypted approved-action details and audit receipts can remain after that answer expires. Regular Assistant conversations have their own persistent chat history; archiving a conversation hides it from the active list and does not delete it.

Disconnecting in Connected apps removes the active stored credentials, selected resources and cached source answers, and stops further use of that connection. It does not undo completed actions or delete files and messages held by Google or Microsoft. Google provider revocation is a separate option; an unconfirmed revocation is shown as pending and tools stay disabled. Review Microsoft consent in My Apps or with your organization administrator. Audit records and existing backups may remain after local disconnection. Backup and AI-processor retention are separate from the short live answer cache; the two-minute period is not a promise to erase those copies. Contact [email protected] for access, deletion and retention requests.

Google-derived data is used and shared only for the user-facing functions described here, subject to the Google API Services User Data Policy and its Limited Use requirements. Transfers to AI processors serve your specific requested answer; they do not authorize unrelated use or model training. Human access is limited to your explicit support authorization, security investigations, or applicable legal obligations.

3. Payment Processing

When you pay via PayPal or Stripe:

• Your payment details are sent directly to PayPal/Stripe (not stored by us)
• We receive your email and transaction ID
• We do NOT store your credit card details
• PayPal's and Stripe's privacy policies apply to their use of your data

4. Data Retention

• Account data: Retained while account is active + 30 days after deletion
• Payment records: Retained for 7 years (legal requirement)
• Analytics data: Retained for 12 months
• Support communications: Retained for 2 years

5. Security

We use industry-standard security measures:

• HTTPS encryption for all data in transit
• Bcrypt password hashing for stored passwords
• Security logging, access checks and controlled release verification
• Secure API token management
• Access controls and authentication

6. Third Parties We Share With

• PayPal & Stripe: Payment processing
• Google Analytics: Anonymized usage analytics
• Resend: Transactional emails only
• DigitalOcean, Hetzner, Vultr: Cloud hosting infrastructure
• Oracle Cloud: Platform hosting infrastructure
• OpenAI or Anthropic: The configured AI processor receives the question and selected-source excerpt only when you request an AI answer, as described in Connected Apps and Lura Assistant above.
• Legal authorities: If required by law

7. Your Rights

You have the right to:

• Access your personal data
• Request correction of inaccurate data
• Request deletion of your data
• Object to processing of your data
• Opt-out of non-essential communications
• Data portability (export your data)

To exercise these rights, email us at: [email protected]

8. Cookies & Tracking

• Session cookies: Required for login persistence
• Analytics cookies: Anonymized usage tracking (Google Analytics)
• Authentication tokens: JWT tokens for API access

You can control cookies through your browser settings. See our Cookie Policy for details.

9. International Data Transfers

Your data may be processed and stored in countries other than your country of residence. By using LuraFlow, you consent to the transfer of your information to countries outside your country of residence, which may have different data protection rules.

10. Changes to Privacy Policy

We may update this privacy policy from time to time. We will notify you of any significant changes via email. Your continued use of LuraFlow constitutes acceptance of the updated privacy policy.