Privacy Policy

This privacy policy explains how 0910608 B.C. Ltd. doing business as Lucy Media (“Lucy,” “us”, “we” or “our”) collects, uses, discloses and retains personal information in connection with the SMS-based social media posting service offered by Lucy (the “Service”). It should be read together with our Terms of Service.

The Service operates by text message, which means we necessarily handle information about you and your organization. We handle that information in accordance with the Personal Information Protection and Electronic Documents Act (PIPEDA) and Canada’s anti-spam legislation (CASL).

1. Information we collect

• Your mobile telephone number, which identifies your account.
• The photographs, instructions and other messages you send us, together with our message history with you, including previews we send, your replies, and your approvals. The message history is the record of what you authorized us to post.
• Access tokens issued to us by Instagram and Facebook when you connect an account. These are encrypted at rest and are used only to post the content you have approved.
• The answers you give during setup, including your business name, your timezone and your brand voice preferences, so that posts are written in your voice and messages respect your local hours.
• A description of how your business writes and what it offers, which we build from two sources you point us to: the website address you give us during setup, and your own recent posts on the Instagram and Facebook accounts you connect. We read each of these, and we keep only our summary — your tone, the subjects you post about, the products you name, and habits such as whether you use emoji. We do not keep copies of your web pages or of your posts.
• Where your business has a public Google listing that matches the website address you gave us, we keep your opening hours, the addresses of your locations, and our own summary of the themes customers raise in your public reviews. We do not keep the text of any review, and we do not keep or use the name or any other detail of any person who wrote one. Opening hours are re-checked from time to time so that they stay accurate.
• Billing information. Payments are processed by Stripe. We do not see or store your card number.
• If you joined using another business’s referral link, or you share your own, we record which account referred which, when that account first paid, and the credits applied to the referrer’s bill. A referrer is only ever told counts and amounts — never the name, number or any other detail of a business they referred.

2. How we use your information

We use your information to operate the Service: to generate and post your content, to text you previews for approval, to bill your subscription, to answer your questions, and to meet our legal obligations. The photographs and instructions you send are processed by an artificial intelligence writing service under contract with us for the sole purpose of drafting your posts.

The descriptions in section 1 are used for one purpose: so that the posts we draft sound like you and reflect what your business actually offers. You see every post as a preview and nothing is published until you approve it.

We do not sell your information. We do not use your photographs or messages to advertise to anyone, and we do not use them to train artificial intelligence models.

3. Service providers

We disclose your information only to the service providers required to operate the Service, and each receives only what its role requires: Twilio (text messaging), Stripe (payments), Meta Platforms (posting to Instagram and Facebook, and reading your own posts on the accounts you connect), Google (looking up your public business listing, where you have one; the request contains your business name and website address), our artificial intelligence writing provider, and our hosting provider. Our servers are located in Toronto, Canada.

4. Retention

• Photographs and message history are retained for as long as you are a client. The photographs you send form a library that Lucy draws on when preparing future posts, which is why they are not deleted on a fixed schedule while your subscription continues. You may ask us to delete any of them at any time.
• Access tokens are deleted as soon as they cease to be usable: immediately when you cancel, and when we detect that access has been removed at the platform.
• The summaries described in section 1 are kept while you are a client, and are refreshed from time to time so that they stay accurate.
• All other personal information is deleted within 30 days of cancellation, other than the minimal billing records we are required to retain for tax purposes.
• We keep nightly backups of our database for up to 3 days, so information deleted from our systems can remain in a backup for up to 3 more days before the backup itself is deleted. Backups are used only to recover from a failure.

5. Text messaging and consent

You consent to receive messages from us by texting us first, which is the only way to begin. Subscribing does not start any messages, and we do not text anyone who has not texted us.

During setup we ask separately whether you wish to receive service reminders, such as notice that a social media connection is about to expire. You may decline, and declining does not affect the Service in any other respect. You may reply QUIET at any time to stop those reminders, or NOTICES to resume them.

You may reply STOP at any time to stop all messages, or HELP for assistance. We identify ourselves in our messages, we do not send marketing messages, and we do not send messages we have initiated between 9pm and 9am in your local timezone.

6. Your rights

You may ask what personal information we hold about you, ask us to correct it, and ask us to delete it, subject to the retention described in section 4. Requests may be sent to hello@lucy.media and we will respond within 30 days. If you are not satisfied with our response you may contact the Office of the Privacy Commissioner of Canada.

7. Deletion of your information

You may have your information deleted at any time. Email hello@lucy.media and we will confirm within 30 days. Deletion covers your photographs, your message history, your brand voice preferences, and the access tokens we hold for Instagram and Facebook.

Replying STOP stops all messaging immediately but does not by itself delete your information; if you also cancel your subscription, your information is deleted on the schedule in section 4.

You may additionally remove our access from your Facebook settings, under Business integrations. Doing so ends our access at the platform immediately, and our daily check then records the connection as revoked and deletes the token we hold.

8. Security

Information is encrypted in transit. Access tokens are additionally encrypted at rest. Access to personal information is limited to what operating the Service requires.

9. Changes to this policy

We may update this policy. If a change is material we will tell you by text before it takes effect, and the amended policy will be posted at lucy.media with an updated effective date.

10. Contact

0910608 B.C. Ltd. doing business as Lucy Media, Vancouver, British Columbia, Canada. Write to us at hello@lucy.media, or text Lucy. Our toll-free number does not accept voice calls.

— Lucy Media · hello@lucy.media