1. Scope and controller
This Privacy Policy explains how LutinApp ("Lutin," "we," "us," or "our") processes personal data when you visit lutinapp.com or use Lutin's desktop, mobile, and cloud services (together, the "Service"). LutinApp is the controller for the processing described here unless another notice says otherwise.
2. Data we process
Account and profile data
We process identifiers and profile details such as your name, email address, account ID, profile image, authentication status, and subscription status.
Content you provide
We process prompts, conversations, generated responses, notes, documents, memories, tasks, schedules, attachments, feedback, and other content you create or ask Lutin to use. This content may include personal data about you or others.
Connected-service data
If you connect another service, we process the account and workspace details, authorization credentials, and content needed to perform the actions you request. The available data depends on the service and permissions you choose. You can revoke a connection through Lutin or the connected service.
Device and technical data
We process information such as IP address, browser and operating-system details, app version, device and runtime identifiers, push-notification tokens, timestamps, diagnostic events, and security logs.
Usage and analytics data
We process page visits, feature interactions, model and provider selections, token and cost measurements, performance data, and error details. We configure analytics to avoid sending the content of your account database, but URLs and diagnostic messages may contain information you provide.
3. Where data comes from
We receive data directly from you, automatically from your device and use of the Service, from our authentication provider, and from services you choose to connect.
4. How we use data
- Provide, synchronize, and maintain the Service.
- Authenticate accounts and keep devices, runtimes, and connected services secure.
- Send requested content to AI, search, and integration providers and return results.
- Deliver notifications, respond to support requests, and communicate service changes.
- Diagnose failures, prevent abuse, measure performance, and improve the Service.
- Comply with law and enforce our agreements.
5. AI and connected services
When you ask Lutin to use an AI model, search provider, or connected service, we send the prompt, relevant context, attachments, queries, or requested action needed to complete your request. The recipient may be selected automatically by our configured routing and availability rules, and a request may be retried with a fallback model or provider. If you use your own provider account, that provider also processes data under its agreement with you.
6. Cookies and analytics
We use necessary storage for site and account functions. PostHog helps us understand product usage and diagnose errors. Before analytics consent, limited events may be processed without persistent browser identifiers. If you accept analytics in our cookie banner, PostHog may use cookies or local storage and enable session recording. You can change your choice through the cookie preferences control or clear browser storage at any time.
7. Legal bases
Where applicable, we rely on:
- Contract, when processing is necessary to provide the Service you request.
- Legitimate interests, such as securing, operating, and improving the Service.
- Consent, including for persistent analytics storage and session recording where required.
- Legal obligations that apply to us.
8. When we disclose data
We disclose personal data only as needed:
- To service providers acting on our behalf. See our Subprocessors page.
- To AI providers, search providers, and integrations you choose to use.
- To professional advisers, authorities, or other parties when required by law or necessary to protect rights and safety.
- In connection with a merger, financing, acquisition, or sale of assets, subject to appropriate safeguards.
We do not sell personal data or share it for cross-context behavioral advertising.
9. International transfers
We and our providers may process data outside your country. Where required, we use contractual or other recognized safeguards for international transfers. Processing locations vary by provider and feature; our Subprocessors page provides more detail.
10. Retention and deletion
We keep personal data only for as long as needed to provide the Service, maintain security and business records, resolve disputes, and meet legal obligations. The period depends on the data, why we process it, and whether the related account or connection remains active. Contact us to request account deletion; we will explain the scope and timing of deletion and any information we must retain.
11. Security
We use technical and organizational measures intended to protect personal data. Our Security & privacy page explains our current controls and important limitations, including that Lutin does not currently claim end-to-end or zero-knowledge encryption.
12. Your choices and rights
Depending on where you live, you may have rights to access, correct, delete, restrict, object to, or receive a copy of your personal data, and to withdraw consent. You may also have the right to appeal a decision or complain to your local data-protection authority. To exercise a right, email [email protected]. We may need to verify your identity before completing a request.
13. Children's privacy
The Service is not directed to children under 13. Where local law requires a higher age to consent to data processing, a parent or guardian must provide valid consent. Contact us if you believe a child has provided personal data without appropriate permission.
14. Changes to this policy
We may update this policy as the Service or applicable law changes. We will publish the updated version here and change the date above. We will provide additional notice when required by law.
15. Contact us
Email:
[email protected]
Mail: LutinApp, 75 King George A' str., Limassol, Cyprus, 4047