Privacy Policy

At Lucius AI Systems, Inc. ("Lucius AI", "we", "our", or "us"), we are committed to protecting your privacy. This Privacy Policy explains how we collect, use, disclose, and safeguard your information when you use our Forensic Tender Audit services (the "Service"). Please read this Privacy Policy carefully. If you do not agree with the terms of this Privacy Policy, please do not access the Service.

1. Information We Collect

1.1 Personal Information

We collect information that you provide directly to us, including:

• Name, email address, and contact information when you create an account
• Payment information processed through Stripe (we do not store credit card details)
• Company information, including name, industry, and tender preferences
• Communications with us, including support requests and feedback

1.2 Tender Documents

When you upload tender documents for analysis, we process these documents to provide our services. This includes:

• PDF files containing tender specifications and requirements
• Metadata associated with uploaded files (file names, sizes, upload dates)
• Analysis results and compliance matrices generated from your documents

1.3 Automatically Collected Information

We automatically collect certain information when you use our Service:

• Device information (IP address, browser type, operating system)
• Usage data (pages visited, features used, time spent)
• Cookies and similar tracking technologies

2. How We Use Your Information

We use the information we collect to:

• Provide, maintain, and improve our Service
• Process and analyze tender documents you upload
• Process payments and manage subscriptions
• Send you technical notices, updates, and support messages
• Respond to your comments, questions, and requests
• Monitor and analyze usage patterns and trends
• Detect, prevent, and address technical issues and security threats

3. Data Security & AI Processing

4. Data Sharing and Disclosure

We do not sell, trade, or rent your personal information to third parties. We may share your information in the following circumstances:

• Service Providers: We may share information with third-party service providers who perform services on our behalf (e.g., cloud hosting, payment processing, email delivery)
• Legal Requirements: We may disclose information if required by law or in response to valid requests by public authorities
• Business Transfers: In the event of a merger, acquisition, or sale of assets, your information may be transferred
• With Your Consent: We may share information with your explicit consent

5. Your Rights (GDPR Compliance)

If you are located in the European Economic Area (EEA) or United Kingdom, you have certain data protection rights:

• Right to Access: Request copies of your personal data
• Right to Rectification: Request correction of inaccurate or incomplete data
• Right to Erasure: Request deletion of your personal data ("right to be forgotten")
• Right to Restrict Processing: Request restriction of processing your personal data
• Right to Data Portability: Request transfer of your data to another service
• Right to Object: Object to processing of your personal data
• Right to Withdraw Consent: Withdraw consent at any time where we rely on consent

To exercise these rights, please contact us at contact@ailucius.com.

6. Data Retention

We retain your personal information for as long as necessary to provide our Service and fulfill the purposes outlined in this Privacy Policy, unless a longer retention period is required or permitted by law.

Tender documents you upload to your account stay in your workspace until you delete the tender or your account. Deleting a tender removes its document and our AI provider's cached copy of it straight away; our storage can still recover a deleted file for 7 days, after which it is gone. Separately, Google may keep recent AI requests in its own cache for up to 24 hours to speed up repeat analysis; that copy is encrypted, kept per project, and never used to train Google's models. A workspace admin can also set a retention period of 30 to 3,650 days, after which older tenders are deleted automatically every night. A document you try without an account is deleted after 7 days unless you save it to an account.

7. Cookies and Analytics

Signing in sets one cookie that keeps you signed in. Nothing else is set until you choose on the cookie banner.

If you accept, we use two analytics tools. PostHog records how the product is used, including session replays in which the text of your tender documents, your drafts and every form field are masked before they leave your browser. Google Analytics receives page views and conversion events through our own server, never through a Google script on the page, with an identifier kept in your browser so that a return visit counts once. Our server passes Google your IP address so it can work out your approximate location; Google Analytics does not store it. Before you choose, nothing is sent to Google Analytics: our server only notes that the cookie banner was shown and what you chose, with the page you arrived on, the site that sent you and your browser type, but no analytics identifier.

We also use Sentry to find errors in the app. When something breaks, Sentry receives a technical report: the page, the browser and the error. It sets no cookies. Under the same choice as PostHog, Sentry also keeps a short replay of the session, with all text masked and all images and media blocked, so we can see what went wrong.

If you arrive through a link that carries a referral code (a web address ending in ?ref= and a code), we pass that code along when you create an account, so the person or partner who shared the link is credited for your signup. The code identifies whoever shared the link, not you. If you accept, we keep it in your browser in a cookie called lucius_ref for up to 60 days, so the credit still applies if you sign up on a later visit. If you decline or do not choose, nothing is stored: the code is kept only while the page is open.

If you decline, PostHog and Sentry's replay do not run and nothing is sent to Google Analytics. Sentry's error reports still run, because they are how we keep the Service working. Accounts are covered by the Terms accepted at signup: product analytics and masked replays run for signed-in users unless they decline on the banner, which is shown to them as well. Your choice is kept for a year in your browser and can be changed by clearing the site's cookies.

8. Children's Privacy

Our Service is not intended for individuals under the age of 18. We do not knowingly collect personal information from children. If you become aware that a child has provided us with personal information, please contact us immediately.

9. International Data Transfers

Your information may be transferred to and maintained on computers located outside of your state, province, country, or other governmental jurisdiction where data protection laws may differ. By using our Service, you consent to the transfer of your information to our facilities and those third parties with whom we share it as described in this Privacy Policy.

10. Changes to This Privacy Policy

We may update our Privacy Policy from time to time. We will notify you of any changes by posting the new Privacy Policy on this page and updating the "Last Updated" date. You are advised to review this Privacy Policy periodically for any changes.

11. Contact Us

If you have any questions about this Privacy Policy, please contact us:

• Email: contact@ailucius.com
• General Inquiries: contact@ailucius.com