Privacy Policy

Lucy runs over text messages, which means we handle information about you and your business. This policy explains what we collect, why, and what happens to it — in line with Canada's PIPEDA and anti-spam (CASL) rules.

What we collect

• Your phone number — it identifies your account.
• Messages and photos you text us — the working material for your posts, plus our message history with you (previews, replies, approvals), which we keep as the record of what you authorized.
• Social account connections — when you connect Instagram or Facebook, we store the access tokens the platforms give us. These are encrypted at rest and used only to publish what you approve and read post performance.
• Billing — payments are processed by Stripe; we never see or store your card number.
• Timezone and brand-voice preferences — the answers you give at onboarding, so posts sound like you and messages respect your local quiet hours.

What we do with it

We use your information to run the service: generate and publish your posts (photos and notes are processed by an AI writing service under contract with us), text you previews and reports, bill your subscription, and meet legal obligations. We do not sell your information, and we do not use your photos or messages to advertise to anyone.

Who it's shared with

Only the service providers needed to operate Lucy: Twilio (text messaging), Stripe (payments), Meta (publishing to Instagram/Facebook), our AI text-generation provider, and our hosting provider (servers located in Toronto, Canada). Each receives only what its role requires.

How long we keep it

• Photos: deleted 90 days after the related post is published (or after you last used them).
• Social access tokens: revoked and deleted immediately when you cancel or disconnect an account.
• Everything else: deleted within 30 days of cancellation, except minimal billing records we must keep for tax law.

Text messaging and consent

You opt in by texting Lucy first. Reply STOP at any time and all messaging stops immediately; reply HELP for help. We identify ourselves in our messages and never message you between 9pm and 9am in your local timezone unless you're mid-conversation with us.

Your rights

You can ask what information we hold about you, ask us to correct it, or ask us to delete it (subject to the legal retention above). Email hello@lucy.media — we respond within 30 days. If you're not satisfied, you may contact the Office of the Privacy Commissioner of Canada.

Data deletion

You can have your data deleted at any time, no questions asked:

• Text STOP to Lucy's number — messaging stops immediately, and if you cancel your subscription your data is deleted on the schedule above.
• Email hello@lucy.media and ask us to delete your account data. We confirm within 30 days.

Deletion covers your photos, message history, brand-voice preferences, and any Facebook or Instagram data we hold for you, including access tokens (which we also revoke with Meta). If you connected Instagram or Facebook through Lucy, you can also remove Lucy from your Facebook Settings → Business integrations — we treat that as a disconnect and delete the related tokens. The only thing we keep is the minimal billing record tax law requires.

Security

Data is encrypted in transit; social tokens are additionally encrypted at rest on servers dedicated to this service. Access is limited to what operating Lucy requires.

Changes

If this policy changes materially, we'll tell you by text before the change takes effect.

— Lucy Media · hello@lucy.media