Privacy Policy

NGA Dynamics Ltd (“we”, “us”, “our”) is the controller of personal data collected on this website and through the LUCY platform. We are registered in England and Wales and operate from Hull, UK.

Contact us about data protection matters at info@ngadynamics.co.uk.

Account and billing data: name, email address, organisation name, and payment information (processed by Stripe, we do not store card numbers).

Usage data: pages visited, features used, session timestamps, and error logs, used to operate and improve LUCY.

Business data you upload: client records, invoices, notes, messages, documents, and any other data your organisation stores in LUCY. This data belongs to you (see Section 5).

Security and audit records: when someone signs in to a workspace, or makes a change in it (for example creating, editing, deleting, exporting or refunding something, or changing who can do what), LUCY records who did it, when, what it was, the IP address and browser it came from, and the branch and department that person belongs to. Workspace owners and administrators can see this audit trail. We also record the devices you have signed in from and, if you choose “trust this device”, a random token for that browser so you are not asked for your two-factor code each time.

Communications: emails you send us, support requests, and feedback.

What LUCY Personal stores: your profile (name, username, photo, bio and links you choose to add), tasks, goals and routines, community posts, comments, likes, follows, and the messages you send and receive, including photos, videos and voice notes you upload. Your private content is encrypted before it is stored: journal entries, calendar plans, money entries and budget, the names and notes of your tasks, goals and routines, the text of your private messages, the photos, videos and voice notes you send in them, and the text of your reminders. Each member has their own key, and each conversation has a key shared only by its two members. This is encryption at rest, not end-to-end: our systems decrypt your content to show it to you, but it is not readable in our database, is never shown to other members, and is not used for advertising. Dates, times, status and other details needed to run reminders and sorting are not encrypted, and neither is the content you post to the community, which other members can see by design. Files sent in messages before this protection was added are encrypted by a background process, so older ones may take a little while to be converted. GIFs and stickers come from public libraries and are not private content. Pop-up notifications never contain the text of a message or a task name.

Who can see what: community posts are visible to other Personal members according to the visibility you choose. Messages are visible only to the two people in the conversation. You can block, mute and report other members.

Device and notification data: if you turn on notifications in the app we store a device token so we can send them. You can turn notifications off in your device settings. The app asks for camera, photo library and microphone access only when you choose to attach a photo or video or record a voice note.

AI planning (Personal Verified): when you press “Plan my day” or “Summarise my week”, your open and recently finished tasks, active goals, routines and upcoming calendar plans are sent to our AI provider to write the result. Your journal, messages and community activity are never included, and nothing is sent unless you press the button.

Moderation: when a member reports a post, message or person we keep the report, and an excerpt of the reported message, so our team can review it. If a member breaks our community rules we may suspend their posting, their messaging, or their access to Personal, for a set time or until lifted, and we keep a record of the suspension and its reason.

Deleting your data: you can delete your account at any time from Personal settings. This permanently removes your account, content, messages, journal, calendar and uploaded files, and cancels any Personal subscription. You can also edit or delete individual posts, messages, tasks, goals and routines yourself.

These apply to everything you keep in LUCY Personal, and they are promises, not marketing.

• We do not sell your data and we do not share it with advertisers or data brokers.
• Your personal content is not used for marketing. We do not build advertising profiles from your tasks, goals, journal, messages or posts.
• Marketing email is opt-in. We send you LUCY news and offers only if you tick the optional box at signup or switch it on in Settings > Privacy and data. It is off by default, you can switch it off at any time, and every marketing email has an unsubscribe link. Account, security, billing and support messages are not marketing and are sent regardless.
• Your content is not used to train AI models. The only AI feature that reads your information is AI planning (Personal Verified), which reads tasks, goals, routines and calendar plans only when you press the button, as described above.
• Our team does not read your private content. Journal entries and calendar plans are encrypted. We do not read your messages, except a message that another member reports to us, or where the law requires it. We keep access to the data that is needed to run and support the service to a small number of authorised staff.
• Who we share data with is limited to the providers in Section 6 who run the service for us (hosting, payments, email, push notifications and, for AI planning only, our AI provider), and only for that purpose.
• You are in control. You can download a copy of your data and delete your account from Settings > Privacy and data. Deleting removes your content within 30 days.

Your rights. Under UK GDPR you can ask us to access, correct, delete, restrict or move your data, and to stop processing it, and you can withdraw consent (for example to marketing) at any time. Most of this is available directly in the app. For anything else, or to raise a concern, contact info@ngadynamics.co.uk. You can also complain to the Information Commissioner's Office (ico.org.uk).

Age. LUCY Personal is for people aged 16 or over. If we learn that someone younger has an account, we will close it and delete their data.

Your community content. What you post to the community is visible to other members according to the visibility you choose, and is subject to our Community Guidelines.

If your organisation uses LUCY in a health or social care context, for example, a care home, nursing home, or supported living service, you may store personal data about residents or service users that is classified as special category data under UK GDPR Article 9, including health information and care records.

In this context, your organisation is the data controller and NGA Dynamics Ltd is the data processor. We process this data only on your documented instruction and apply the same technical and organisational security measures as for all data.

You are responsible for:

• Identifying a valid Article 9 condition for processing health data (e.g. Art. 9(2)(h)).
• Maintaining an appropriate policy document under Schedule 1 of the Data Protection Act 2018.
• Restricting access to health records to authorised staff only, using LUCY's role-based access controls.
• Applying retention periods appropriate to your regulatory obligations (CQC, NHS records management, or equivalent).

Children and young people. Organisations such as schools, music and activity providers and charities may record information about children: names, dates of birth, emergency contacts, parents and guardians, allergies, medical conditions and additional needs, and the permissions a parent or guardian has given (for example for photos, trips or transport). In this context the organisation is the data controller and we are the processor. Health and welfare notes are stored separately from the main record and are only available to people the organisation lets see them. LUCY does not give children their own logins.

Identity checks. Organisations that need to verify who someone is (for example lenders, care providers and schools) can upload or collect copies of identity documents and record the result of checking them. These files are encrypted before they are stored and are shown only to people the organisation permits; each viewing is recorded. Organisations can also use an automatic ID check, in which the person photographs their document and takes a selfie, and a face match is made between the two. This is run for us by Stripe (see Section 6). A selfie used for face matching is biometric data, which is special category data: the organisation is the controller, must have a lawful basis and a condition under Article 9, and must tell the person before they take part. Stripe holds the photos and selfie only while the check runs; once the result is in, we ask Stripe to delete them. We keep the result of the check, the name and date of birth the document showed (encrypted), and the document's expiry date, for as long as the organisation keeps the person's identity record.

Staff vetting. Organisations can record that a staff member or volunteer has had a criminal record (DBS or equivalent) check, with the certificate type, its date, who issued it and a masked reference. We do not store the contents of a certificate.

To request a Data Processing Agreement (DPA) covering special category data, contact info@ngadynamics.co.uk.

We use personal data to:

• Create and manage your account and organisation.
• Process payments and manage billing.
• Provide, operate, and improve the LUCY platform.
• Send you service communications (account alerts, product updates), not marketing unless you opt in.
• Investigate and resolve support requests.
• Keep workspaces secure: detect misuse, and show owners and administrators who made which change.
• Meet our legal obligations under UK GDPR and the Data Protection Act 2018.

Our lawful bases are:

• Contract, to perform our agreement with you.
• Legitimate interests, operating and improving the platform, fraud prevention.
• Legal obligation, where required by law.
• Consent, for marketing communications.

If an organisation uses LUCY to hold information about you, that organisation decides why and how it is used, and it is the one to answer your requests. Many organisations publish a privacy request page at lucy-os.net/privacy/<their name>: you give your name, email and what you would like (a copy of your information, a correction, deletion, to restrict or object to its use), and we email you a link to confirm it is you. The organisation's clock of one calendar month to respond starts once you confirm; it can extend that by up to two further months for complex requests and must tell you why. To change or withdraw a consent you gave, use the consent form the organisation links to. We provide the tools to find, export and erase the information, and some records must be kept by law (for example invoices and loan records): these are kept but disconnected from your name where possible. If you cannot reach an organisation, contact us and we will pass your request on.

The business data you store in LUCY, clients, invoices, notes, messages, documents, belongs to you. We process it only to provide and improve the Service.

We do not sell your data, share it with third parties for advertising, or use it to train AI models without your explicit consent. On deletion of your account, your data is permanently deleted within 30 days, except encrypted recovery copies of a deleted workspace, which we keep for up to 90 days so a mistaken deletion can be reversed.

We share personal data only with:

• Supabase, our database provider (data hosted in EU-West).
• Stripe, payment processing, and, when an organisation uses the automatic ID check, Stripe Identity: it receives the photographs of the document and the selfie, makes the face match and returns the result, and we ask it to delete what it collected as soon as the result arrives.
• Postmark and Twilio, transactional email and SMS delivery (and the email service you connect, such as Gmail).
• OpenAI and Anthropic, AI features such as Ask LUCY, AI insights, content and outreach drafting, voice transcription and lead scoring. Prompts may include business data you have stored in LUCY, and for Lead Discovery, public business information found on company websites.
• Google, when you connect Gmail, Calendar or Sheets, or use business listing search (Places) or Analytics; and Google Fonts, which loads the fonts on our pages.
• LiveKit, Firebase Cloud Messaging and web push services, calls and push notifications.
• Apify, public web data collection for trend features. ipwho.is, to show approximate locations for the sign-in sessions on your own security page.
• Legal authorities, where we are required to do so by law.

All sub-processors are contractually bound to protect your data in accordance with UK GDPR.

Our sub-processors may process data outside the UK and EEA. Where this occurs, we ensure adequate safeguards are in place (Standard Contractual Clauses or an equivalent mechanism approved by the ICO).

We keep your account data for as long as your account is active. On deletion:

• Business data is removed from the live service within 30 days; a recovery copy of a deleted workspace is kept for up to 90 days and then destroyed.
• Billing records are retained for 7 years as required by HMRC.
• Security and access logs are retained for 90 days.
• The audit trail of changes in a workspace (who did what, when, from where) is kept for as long as the workspace exists, so owners can look back, and is deleted with the workspace. It cannot be edited or deleted by anyone in the meantime.
• Privacy requests that nobody confirms by email are deleted after 14 days. Confirmed requests are kept as the organisation's record of how it responded.
• Trusted-device records last for the period the workspace owner chooses (up to 30 days) and can be removed by you at any time in Settings.
• Identity documents are kept by the organisation for as long as it needs them and can be removed by its administrators; they are removed with the person's record if it is erased.

If you operate in a regulated sector with specific retention obligations (e.g. care records), you should export and retain records before deleting your account.

Under UK GDPR, you have the right to:

• Access the personal data we hold about you.
• Rectify inaccurate data.
• Erase your data (“right to be forgotten”) in certain circumstances.
• Restrict processing in certain circumstances.
• Port your data in a machine-readable format.
• Object to processing based on legitimate interests.
• Withdraw consent at any time where consent is the lawful basis.

To exercise any right over information we hold as controller, contact info@ngadynamics.co.uk. We will respond within one calendar month. You also have the right to complain to the Information Commissioner's Office (ICO) at ico.org.uk.

We use essential cookies only: to keep you signed in, to prove you have passed two-factor authentication, to remember a device you chose to trust so you are not asked for your code each time, to ask you to confirm your password before sensitive actions, and for security (CSRF). We do not use tracking or advertising cookies without your consent.

See our Cookie Policy for full details.

We protect your data using:

• TLS encryption in transit for all connections.
• Encryption at rest (AES-256-GCM) for identity documents, the credentials vault, notes about people (client and session notes), and the tokens for services you connect.
• Workspace owners can limit which features each person, department and branch can use, and can switch on separation so that people in one branch see only their own branch's records. Records without a department are handled by owners and administrators.
• An audit trail of changes that cannot be edited or deleted, visible to owners and administrators.
• Extra confirmation (re-entering your password) before sensitive actions such as erasing a person's data.
• Row-level security (RLS) in our database, every query is scoped to your organisation.
• HMAC-signed cookies and webhook signatures.
• Two-factor authentication for accounts, which owners can require, with an option to trust a device for a limited time.
• Row-level security on tenant data in the database, with every request scoped to your organisation. Server-side service credentials are kept out of the browser and are never sent to clients.

We may update this Privacy Policy from time to time. We will notify account owners by email at least 14 days before material changes take effect. The “last updated” date at the top of this page always reflects the current version.

info@ngadynamics.co.uk
NGA Dynamics Ltd · Hull · United Kingdom