Privacy Policy

This privacy policy explains how 0910608 B.C. Ltd. doing business as Lucy Media (“Lucy,” “us”, “we” or “our”) collects, uses, discloses and retains personal information in connection with the SMS-based social media posting service offered by Lucy (the “Service”). It should be read together with our Terms of Service.

The Service operates by text message, which means we necessarily handle information about you and your organization. We handle that information in accordance with the Personal Information Protection and Electronic Documents Act (PIPEDA) and Canada’s anti-spam legislation (CASL).

1. Information we collect

• Your mobile telephone number, which identifies your account.
• The photographs, instructions and other messages you send us, together with our message history with you, including previews we send, your replies, and your approvals. The message history is the record of what you authorized us to post.
• Access tokens issued to us by Instagram and Facebook when you connect an account. These are encrypted at rest and are used only to post the content you have approved.
• The answers you give during setup, including your business name, your timezone and your brand voice preferences, so that posts are written in your voice and messages respect your local hours.
• A description of how your business writes and what it offers, which we build from two sources you point us to: the website address you give us during setup, and your own recent posts on the Instagram and Facebook accounts you connect. We read each of these, and we keep only our summary — your tone, the subjects you post about, the products you name, and habits such as whether you use emoji. We do not keep copies of your web pages or of your posts.
• Where your business has a public Google listing that matches the website address you gave us, we keep your opening hours, the addresses of your locations, and our own summary of the themes customers raise in your public reviews. We do not keep the text of any review, and we do not keep or use the name or any other detail of any person who wrote one. Opening hours are re-checked from time to time so that they stay accurate.
• Billing information. Payments are processed by Stripe. We do not see or store your card number.
• If you joined using another business’s referral link, or you share your own, we record which account referred which, when that account first paid, and the credits applied to the referrer’s bill. A referrer is only ever told counts and amounts — never the name, number or any other detail of a business they referred.

2. How we use your information

We use your information to operate the Service: to generate and post your content, to text you previews for approval, to bill your subscription, to answer your questions, and to meet our legal obligations. The photographs and instructions you send are processed by an artificial intelligence writing service under contract with us for the sole purpose of drafting your posts.

The descriptions in section 1 are used for one purpose: so that the posts we draft sound like you and reflect what your business actually offers. You see every post as a preview and nothing is published until you approve it.

We do not sell your information. We do not use your photographs or messages to advertise to anyone, and we do not use them to train artificial intelligence models.

3. Service providers

We disclose your information only to the service providers required to operate the Service, and each receives only what its role requires: Twilio (text messaging), Stripe (payments), Meta Platforms (posting to Instagram and Facebook, and reading your own posts on the accounts you connect), Google (looking up your public business listing, where you have one; the request contains your business name and website address), our artificial intelligence writing provider, and our hosting provider. Our servers are located in Toronto, Canada.

4. Retention

• Photographs and message history are retained for as long as you are a client. The photographs you send form a library that Lucy draws on when preparing future posts, which is why they are not deleted on a fixed schedule while your subscription continues. You may ask us to delete any of them at any time.
• Access tokens are deleted as soon as they cease to be usable: immediately when you cancel, and when we detect that access has been removed at the platform.
• The summaries described in section 1 are kept while you are a client, and are refreshed from time to time so that they stay accurate.
• All other personal information is deleted within 30 days of cancellation, other than the minimal billing records we are required to retain for tax purposes.
• We keep nightly backups of our database for up to 3 days, so information deleted from our systems can remain in a backup for up to 3 more days before the backup itself is deleted. Backups are used only to recover from a failure.

5. Text messaging and consent

You consent to receive messages from us by texting us first, which is the only way to begin. Subscribing does not start any messages, and we do not text anyone who has not texted us.

During setup we ask separately whether you wish to receive service reminders, such as notice that a social media connection is about to expire. You may decline, and declining does not affect the Service in any other respect. You may reply QUIET at any time to stop those reminders, or NOTICES to resume them.

You may reply STOP at any time to stop all messages, or HELP for assistance. We identify ourselves in our messages, we do not send marketing messages, and we do not send messages we have initiated between 9pm and 9am in your local timezone.

6. Your rights

You may ask what personal information we hold about you, ask us to correct it, and ask us to delete it, subject to the retention described in section 4. Requests may be sent to hello@lucy.media and we will respond within 30 days. If you are not satisfied with our response you may contact the Office of the Privacy Commissioner of Canada.

7. Deletion of your information

You may have your information deleted at any time. Email hello@lucy.media and we will confirm within 30 days. Deletion covers your photographs, your message history, your brand voice preferences, and the access tokens we hold for Instagram and Facebook.

Replying STOP stops all messaging immediately but does not by itself delete your information; if you also cancel your subscription, your information is deleted on the schedule in section 4.

You may additionally remove our access from your Facebook settings, under Business integrations. Doing so ends our access at the platform immediately, and our daily check then records the connection as revoked and deletes the token we hold.

8. Security

Information is encrypted in transit. Access tokens are additionally encrypted at rest. Access to personal information is limited to what operating the Service requires.

9. Changes to this policy

We may update this policy. If a change is material we will tell you by text before it takes effect, and the amended policy will be posted at lucy.media with an updated effective date.

10. Contact

0910608 B.C. Ltd. doing business as Lucy Media, Vancouver, British Columbia, Canada. Write to us at hello@lucy.media, or text Lucy. Our toll-free number does not accept voice calls.

— Lucy Media · hello@lucy.media

11. WhatsApp, voice notes and video

This section was added on 31 October 2026. It applies when you use these features, and it adds to sections 1 to 10.

• WhatsApp. You can use the Service on WhatsApp, at the same number. When you message us there, WhatsApp, which is operated by Meta Platforms, carries the messages between us, and we receive your WhatsApp number and whether our messages were delivered and read. We use the read status only to send, at most, one reminder about a post preview you have not answered, within 24 hours of your last message and never between 9pm and 9am in your local timezone.
• Messages we start on WhatsApp. WhatsApp lets a business reply freely only within 24 hours of your last message. After that, the service notices described in section 5 reach you by text message, or as a short WhatsApp message whose wording Meta has approved in advance. We never begin a conversation you have not started.
• Voice notes. If you send a voice note, the recording is sent to OpenAI, our speech-to-text provider, which turns it into text for us. We keep that text like any other message. We do not keep the recording, and we delete it from our messaging provider once it has been turned into text. Under its terms for business customers, OpenAI does not use what we send it to train its models.
• Video. The video clips you send, and the video we edit from them for your approval, are kept and deleted in the same way as photographs (section 4). To edit a video we take still frames from it, which our artificial intelligence writing provider uses to choose the moments and write the captions.
• Text on photographs. When you ask us to put text on a photograph, we keep your original photograph as well as the version with text, so that either can be used.
• Service providers. In addition to those listed in section 3: Meta Platforms, also as the operator of WhatsApp when you message us there; and OpenAI, for turning voice notes into text.