Privacy Policy

1. Introduction

Ask Lucilla is committed to protecting your privacy and personal information. This Privacy Policy explains how we collect, use, disclose, and safeguard your information when you use Ask Lucilla and our text-message service. We do not sell your personal information.

2. Information We Collect

2.1 Account information

• Sign-in: your name, email address and profile information from Google, Apple, or the email address and password you register with
• Phone number: Ask Lucilla requires you to verify a mobile phone number
• Profile: username and profile picture (taken with your camera or chosen from your gallery)

2.2 Location

Ask Lucilla uses your device location only while the app is open. It does not request background location (Android ACCESS_BACKGROUND_LOCATION) and does not track you when the app is closed. With your permission, we use precise and approximate location to:

• show you the map and businesses and rewards near you;
• check, about every five minutes while the app is open, whether a reward is nearby so we can alert you;
• give the Lucilla assistant your approximate position when you ask it something, so answers are local (only if you have already granted location permission);
• verify a location or QR claim: at the moment you claim we record your GPS coordinates, their accuracy, and whether the device reports a simulated ("mock") location;
• follow your location while a "time at location" or multi-stop reward requirement screen is open;
• let business owners place rewards and reward zones on the map, and let hosts create community events;
• store the home area you set on your matching profile.

Location signals recorded with claims (such as accuracy, simulated-location flags and implausible movement between claims) are used to detect location spoofing and fraud, including to train our fraud-detection systems. If you share a location with us over WhatsApp, we record the coordinates and address you share. You can decline or revoke location permission at any time in your device settings; location-based rewards and the map will then be limited.

2.3 Microphone, voice notes and voice conversations

The microphone is used only when you choose to talk to the Lucilla assistant.

• Voice notes: when you hold to talk, the app records an audio clip, uploads it to our cloud storage, and our servers transcribe it using Google's Gemini models on Google Cloud Vertex AI. The transcript is then handled like a typed message. The copy on your device is deleted after upload.
• Voice conversations: when you start a live conversation, the app listens continuously on your device and uploads only the segments in which it detects speech. Each segment is transcribed as above, and the assistant's reply is converted to speech using Google Cloud Text-to-Speech.
• While the app is in the background (Android): a live conversation keeps running through an Android foreground service so you can keep talking with the screen off or in another app. While it runs, a notification is always shown with the current state (listening, thinking, speaking, paused) and Stop / Resume buttons. It starts only when you start a conversation, requires microphone and notification permission, pauses during phone calls or when another app takes audio, and ends when you tap Stop, swipe the app away, or close it. On iOS, a conversation pauses whenever the app goes to the background.
• Voice notes sent by WhatsApp or MMS: the audio is retrieved from our messaging provider and transcribed by Gemini; the transcript is saved with your conversation.
• Retention: uploaded audio clips are kept until you delete your account or ask us to delete them.

You can revoke microphone access at any time in your device settings.

2.4 Camera and photos

• QR codes: the camera scans reward QR codes and event tickets. Staff members use it to scan customers' codes at the counter.
• Proof for rewards: if a reward requires a photo or video, it is taken with your camera and uploaded and stored with the business's reward.
• Other uploads: profile photos, photos and media you post in event chats and store chats, and logos and media business owners add to their listings and reward cards.
• Photos and videos sent by text message: if you send us an image (for example a menu or flyer), we store it privately and process it with Gemini to read what it shows. It is shown only to the Lucilla assistant and to the business it concerns.

2.5 Conversations with the Lucilla assistant

The Lucilla assistant is an automated AI agent, not a person. It runs on Google's Gemini models through Google Cloud Vertex AI and answers in the app and by SMS and WhatsApp. When you use it, we collect:

• Your messages and the assistant's replies. In the app, your chat history is stored with your account; it also includes your earlier SMS/WhatsApp messages with us once your phone number is linked to your account. Every text message sent to or from our number is logged with the phone numbers involved.
• Your phone number and channel (SMS or WhatsApp), and whether you are using Lucilla as a customer or as a business.
• Location context: the city or area you mention, your approximate location, and your location at the time of a request.
• What you asked for and what we showed you: the type of place or offer you were looking for, the businesses we suggested and the one you picked. We keep a record of demand in an area (what people ask for, where) and a wishlist of things you asked for that we could not yet find, so we can tell you when they appear.
• Assistant memory: preferences you tell the assistant so it can answer better — for example dietary needs, party size, home area, budget, the kind of place you like, recent requests, interests, age range, gender, a short bio and your language. Text MEMORY to see what is saved and FORGET to delete it.
• Profiles for gigs, trades and activity partners if you use those features by text.

2.6 Rewards, claims and redemptions

• Rewards you claimed, when and where, redemption codes, and the codes a business redeemed
• Answers and actions you complete to meet a reward's requirements — polls, surveys, reviews and star ratings, photo or video proof, likes, comments, follows, and time at a location
• Event tickets you bought or claimed and their check-in status
• Taps on reward cards and your interactions with business listings
• Cashback you received, where a business offers it

2.6a Orders, bookings and payments

• Payments you make in the app — event tickets, booking deposits and food orders placed ahead for pickup — with the business, items, amounts, taxes, status, refunds and receipts
• When you pay by card, Stripe collects your card details and processes the payment for the business; we receive the payment status and amount, never your full card number
• When you use a deal at an online shop, the shop's own checkout tells us that an order used our deal code, so the sale can be attributed to the deal
• When you buy or sell USDC through Coinbase, Coinbase collects and verifies your identity and payment details under its own privacy policy

2.7 Wallet and transaction data

• Your wallet address on the Base blockchain (and on Arc, if you use it)
• Transfers you make in the app and your on-chain transaction history and balance, which we look up from the public blockchain
• USDC reward payouts, ticket purchases and refunds, USDC payments for bookings and orders, campaign funding and refunds, and the network fees you paid

We never receive your biometric data or your passkey. Wallet and send confirmations use your device's own fingerprint, face or screen-lock check; we only receive a confirmation that it succeeded.

2.8 Groups, matching and community events

If you create a matching profile, we collect your display name, photo, activities, availability, travel radius, goal, preferred group size, home location and areas, age, gender and same-gender preference, languages, an "about" line, and favourite places. If you ask to join a hosted event, we collect the answers the host asks for. Messages in matched groups and event chats are stored so members can read them.

2.9 Business accounts

If you operate a business on Ask Lucilla we additionally collect: business name, address, hours, contact details and social links as you provide them; menus, product and event details, and photos you upload or text to us; your staff roster (members' usernames or phone numbers and their roles); your reward campaigns and their configuration, funding and performance.

2.10 Political campaign rewards

Some rewards are offered by political committees. To claim one you must provide your full name, street address, city, state, postal code and confirm that you are a US person, as required for those rewards. See asklucilla.com/political.

2.11 Device, usage and notifications

• Push notification tokens (Firebase Cloud Messaging) so we can send reward and deal notifications. Android asks for notification permission the first time you open the map
• Usage analytics (Firebase Analytics) and crash reports (Firebase Crashlytics)
• App-integrity checks (Firebase App Check) to confirm requests come from the genuine app
• Device model, operating system and app version

Ask Lucilla does not access your contacts and contains no advertising SDKs.

3. How We Use Your Information

• Operate the app and the assistant: find businesses, deals, rewards and events near you, and answer your messages
• Verify and pay reward claims, issue and redeem codes and tickets, and process the payments you choose to make in the app (Section 2.6a)
• Match you with groups, activity partners and events you asked for
• Send the notifications and text messages described in Section 4
• Let businesses run campaigns and see how they perform, as described in Section 5
• Prevent fraud, multi-account abuse and location spoofing, and keep the platform safe
• Comply with legal obligations
• Evaluate and improve the service. Assistant conversations may be used, in de-identified form (your phone number is replaced with a one-way hashed identifier), to evaluate and improve the service — including automated AI review that labels exchanges and uses them as examples to improve how the assistant understands and routes requests. Deleting your account removes your conversations from this use (Section 9).

4. Text Messages (SMS / WhatsApp) & Consent

Messages you ask for. When you text or WhatsApp our number, we reply. Replies to your messages and the transactional messages you ask for — codes, receipts, ticket, booking and order updates, and alerts you request — do not need any further consent.

Optional consent for proactive messages. When you add your phone number in the app, an optional box, unticked by default, asks whether Lucilla's agent may text or WhatsApp you on its own initiative. For customers this covers deal alerts nearby, a heads-up when something you asked for shows up, reminders, and group matches, plus reward emails. For businesses it covers messages when nearby people want what you offer, reminders, group matches and useful finds such as new suppliers, partners and deals, plus emails. The box says: “Optional — not needed to use Lucilla or to buy anything. Automated messages; frequency varies. Msg & data rates may apply. Reply STOP to opt out, HELP for help.” You can give the same consent at asklucilla.com/sms or by texting START. Leaving the box unticked never blocks replies to your own messages.

Message and data rates may apply. Message frequency varies. Reply STOP at any time to opt out, HELP for help, or START to opt back in. You can also mute a single category (for example, reply STOP DEALS). Businesses you claim rewards from can also send you their offers; you agree to that separately for each business, when you claim (Section 5.2).

We record when and how you opted in (including the wording you agreed to) and when you opted out. After STOP, we send no further messages except a reply to an emergency message. Promotional messages are not sent between 9 p.m. and 8 a.m. in your local time (estimated from your phone number) and are limited to two in any 24 hours and five in any 7 days; replies to your own messages and transactional messages such as codes and confirmations are not subject to those limits. Over WhatsApp we can only message you within 24 hours of your last WhatsApp message; otherwise we use SMS. WhatsApp messages are delivered through Meta.

No mobile information will be shared with third parties or affiliates for marketing or promotional purposes. Information sharing with subcontractors in support services, such as customer service, is permitted. All other use case categories exclude text-messaging opt-in data and consent; this information will not be shared with any third parties.

Your consent to receive text messages from Lucilla, and the mobile phone number you provide for that purpose, are never sold or rented and are not shared with third parties or affiliates for their own marketing. When you claim a business's reward, the contact details that business may receive come from your Lucilla account under the separate claim disclosure described in Section 5.2; they are not part of the SMS opt-in data or messaging consent described here.

The assistant is automated and is not an emergency service. If you describe an emergency, it replies with the local emergency number (and, in the US and Canada, the 988 crisis line where relevant), but it cannot send help or contact responders.

5. Data Sharing and Disclosure

5.1 What businesses see in the app

Inside Ask Lucilla, a business identifies its customers by their @username. For people who claimed its rewards, a business sees your username, city, the rewards you claimed, when you claimed them and the general area of the claim, and campaign statistics. It does not see your email address or phone number in the app. In addition:

• Event hosts see guests' names, photos and check-in status, and, for events that require approval, the name, age, gender, photo, "about" line, who vouched for the person, and answers to the host's questions.
• Staff who scan your code see the code and the reward it is for.
• Reviews, polls and survey answers you submit to meet a reward's requirements are provided to that business.

5.2 Claiming a reward: sharing with the business and its offers to you

Claiming a business's reward includes agreeing to hear from that business. This is a condition of claiming, and it is disclosed before you claim:

• Before your first claim, the app shows a disclosure with an Agree & Claim button. It explains that the business receives your @username, your contact details (name and email, and your phone number if you have added one) and the time and general area of your claim; that each business you claim from may send you its offers by email or text message; that businesses often keep their best rewards for customers who stay subscribed; that this is required to claim; and that you can unsubscribe from any business at any time.
• Every claim screen repeats this and names the specific business.
• What claiming records: that business's consent to contact you by email, and by text message only if your phone number is verified. It applies only to the business whose reward you claimed.
• Unsubscribing wins. If you have unsubscribed from a business, a later claim from that business never turns its messages back on.

How your contact details reach a business. In the app, a business sees you only as described in Section 5.1. Your name, email address and phone number are made available to a business only through Lucilla's enterprise business dashboard and emailed campaign reports, and only while that business holds your consent (email for your email address; text messages, with a verified phone number, for your phone number).

Unsubscribe anytime. You can unsubscribe from any business in the app under You → Businesses you hear from, or by replying STOP to a text. Unsubscribing stops that business's messages through Lucilla and stops further release of your contact details to it; it does not recall details the business already received. Businesses that receive your contact details must use them lawfully (including CAN-SPAM, TCPA, CASL, GDPR, CCPA and PIPEDA where applicable), only for communications about their own business, must honor unsubscribes, and may not sell or share them with unrelated third parties. If you do not want to hear from a business, do not claim its reward — you can still browse its offers.

5.3 Messages we pass between people

• Questions to a business: if you ask the assistant a question for a business, we text the owner your question as coming from "a customer near you." Neither side sees the other's phone number.
• Masked text threads (for example with a business, a gig, or an activity partner): each side texts Lucilla and we forward the message. Phone numbers are never shared; forwarded messages are logged. Threads close after 48 hours. Reply BLOCK to report and stop a thread.
• Matches: a match needs both people to say yes. If both of you have app accounts, each is told the other's @username and you can message in the app.
• Groups: in groups formed by text, members never see each other's numbers and the host sees only a member count. In app groups, other members see your name, photo, "about" line and whether you are bringing a guest — never your phone number or email.
• Community events: a private venue's exact address is shown only to people who join; others see an approximate location.

5.4 Service providers

• Google — Firebase (authentication, database, storage, messaging, analytics, crash reporting, App Check), Google Cloud (including Vertex AI Gemini models for understanding messages, voice notes and images, Cloud Text-to-Speech, and Cloud Tasks), and Google Maps (maps and address lookup)
• Twilio — SMS, MMS and WhatsApp delivery
• Meta — WhatsApp messages, and Messenger and Instagram messages for businesses that connect them (Section 13)
• Circle — wallet infrastructure and network-fee sponsorship (Gas Station)
• Stripe — card payments for bookings and orders, processed for the business you pay
• Coinbase — buying and selling USDC (on-ramp and off-ramp), under Coinbase's own terms and privacy policy
• Resend — email delivery
• Blockchain data services — to read your public on-chain transaction history

5.5 Public blockchain

USDC transfers, reward payouts, ticket escrow, USDC payments and campaign funding are recorded on the Base blockchain (or Arc, where you use it), which is public and permanent. Wallet addresses are pseudonymous, but anyone can see the transactions made by an address.

5.6 Legal requirements

We may disclose information when required by law, to respond to valid legal process, or to protect the rights, property and safety of Lucilla, our users or others.

5.7 Data ownership & sale

• We do not currently sell your personal data to any third parties
• We may analyze anonymized or aggregated usage patterns, including demand in an area, to improve our services
• In the future, we may engage in partnerships that involve sharing aggregated, anonymized data — we will notify users in advance and update this policy accordingly
• We do not use your data for third-party advertising without permission

6. Blockchain & Cryptocurrency Disclosures

6.1 USDC and your wallet

Your Ask Lucilla wallet is a non-custodial smart wallet that you create and control with a passkey on your device, using Circle's modular wallet infrastructure. We never receive your passkey and cannot move funds out of your wallet. USDC moves on the Base blockchain (and Arc, if you choose it) between users' own wallets, businesses' wallets and Ask Lucilla smart contracts. Ask Lucilla is not a money services business: it does not hold merchants' sales proceeds or the sales tax collected for them. Apart from the specific flows below, we do not hold, transmit or exchange customers' funds on their behalf:

• Escrow: USDC for reward campaigns and paid event tickets is held by Ask Lucilla smart contracts and released only under the rules in the Ask Lucilla Terms. Lucilla's servers submit claim, check-in, refund and settlement transactions. The contracts are upgradeable and administered by a multi-signature wallet controlled by Lucilla, whose administrative functions can recover tokens held by the contracts.
• Enterprise business wallets: businesses that use Lucilla's enterprise dashboard may have a Circle wallet that Lucilla manages on the business's behalf; Lucilla initiates transfers from it (for example to fund campaigns or pay prizes and cashback) under the business's instructions and enterprise arrangement.
• Lucilla-funded campaigns and payouts: Lucilla may fund a campaign from a wallet it operates, in which case unclaimed funds return to Lucilla. Some payouts — equal-split and draw-style distributions, and cashback sent when an escrow payout cannot be completed — are sent by Lucilla's servers from a Lucilla-operated wallet or the business's managed wallet.
• Network fees: each blockchain transaction has a small network fee. You pay it in USDC from your wallet, or Ask Lucilla sponsors it through Circle's Gas Station; the app shows which applies before you confirm.

• USDC is a digital stablecoin pegged to the US Dollar, issued by Circle Internet Financial
• USDC transactions are recorded on the Base blockchain (Ethereum Layer 2), a public ledger. We cannot modify blockchain data once recorded

6.2 Cryptocurrency risks

• Peg risk: USDC is designed to maintain a 1:1 value with USD, but no guarantee exists that the peg will always be maintained
• Regulatory risk: cryptocurrency regulations vary by jurisdiction and may change. You are responsible for compliance with your local laws
• Irreversibility: blockchain transactions cannot be reversed once confirmed. Sending to a wrong address results in permanent loss
• Custody: you are responsible for safeguarding your device, passkey and recovery credentials
• Smart contract risk: smart contracts may contain bugs or vulnerabilities
• Network risk: blockchain networks may experience congestion, delays or outages

6.3 Not financial advice

Lucilla does not provide investment, financial, tax or legal advice.

7. Children's Privacy & Age-Based Access

Ask Lucilla is for adults. You must be 18 or older to create an account or use the Service. It is not directed to children, and we do not knowingly collect personal information from anyone under 18. If we learn a user is under 18, we will delete the account and associated data.

In-person matching with other people is limited to adults (18+). Event hosts may set a higher minimum age for their events, and businesses must verify age at the point of service where the law requires it.

8. Security

Lucilla runs on Google Cloud and Firebase and uses Circle for wallets; these providers maintain independent security certifications such as SOC 2 and ISO 27001. Data is encrypted in transit (TLS) and at rest by these providers. Access to production systems is restricted and logged. We also use secure sign-in (Google, Apple, email with phone verification), app-integrity checks, and device biometric confirmation for wallet transfers.

9. Data Retention & Deletion

We retain personal data as long as necessary to provide the service, comply with legal obligations, resolve disputes and enforce agreements.

9.1 Deleting your account

You can delete your Lucilla account in the app under You → Delete account, or request it at asklucilla.com/legal/rewards/delete-account. For web requests we email you a link to confirm; once confirmed, your account enters a 30-day grace period and is then deleted. Your Ask Lucilla account is separate from any Lucilla fitness app account, so deleting one does not delete the other. You can also ask us to delete your data by writing to support@asklucilla.com.

Deleting your account removes:

• your account, profile, login, and the data and files stored under your account;
• your conversations with the Lucilla assistant in the app and by SMS/WhatsApp, including message logs, session data, and demand and wishlist records;
• voice notes and voice-conversation audio, and photos and other media you texted us;
• assistant memory;
• leads and marketing-consent records held for businesses whose rewards you claimed;
• reward claims that did not pay out USDC, posts, chats and notifications.

What we keep: transaction and other records that applicable law requires us to keep — such as your wallet address(es), USDC transactions, reward claims that paid out USDC, and the identifying details linked to them — are moved to a locked retention store for as long as the law requires and then deleted. On-chain transaction records are public and permanent. You can also delete assistant memory at any time by texting FORGET, and stop all Lucilla texts by replying STOP.

10. Your Rights & Choices

You have the right to:

• Access: request a copy of your personal data
• Correction: update inaccurate information
• Deletion: delete your account and associated data (Section 9)
• Data portability: export your data in a machine-readable format
• Opt-out: disable location or notifications in device settings, reply STOP to texts, and unsubscribe from any business under You → Businesses you hear from (Section 5.2)

10.1 California residents (CCPA/CPRA)

• Right to Know: you can request details about the categories and specific pieces of personal information we have collected about you
• Right to Delete: you can request deletion of your personal information, subject to certain legal exceptions
• Right to Opt-Out of Sale: we do not sell your personal information. If this changes, we will provide a "Do Not Sell My Personal Information" mechanism
• Right to Non-Discrimination: we will not discriminate against you for exercising your privacy rights
• Right to Correct: you can request correction of inaccurate personal information
• Right to Limit Use of Sensitive Personal Information: you can limit how we use sensitive personal information (such as precise geolocation) to purposes necessary for providing services

To exercise these rights, contact us at support@asklucilla.com. We will respond within 45 days.

10.2 European users (GDPR)

If you are located in the European Economic Area, United Kingdom or Switzerland, you have the rights of access, rectification, erasure, restriction of processing, data portability, objection (including to direct marketing) and withdrawal of consent.

Legal bases for processing: contract (to provide the service), legal obligation (record-keeping), legitimate interest (fraud prevention, evaluating and improving the service with de-identified conversations, platform security), consent (location, microphone and text messages), and contract and consent for the business offers you agree to receive when you claim a reward (Section 5.2), which you can withdraw at any time.

To exercise these rights, contact support@asklucilla.com.

10.3 Canadian users (PIPEDA)

Canadian users have rights under the Personal Information Protection and Electronic Documents Act, including the right to access, correct, and withdraw consent for the collection and use of personal information.

10.4 Other jurisdictions

Residents of Virginia, Colorado, Connecticut, Nevada, and other states with consumer privacy laws have rights similar to those described above under their respective state laws. Contact us to exercise these rights.

11. International Users

Your data may be transferred to and processed in countries outside your residence, primarily the United States and Canada. We ensure appropriate safeguards are in place for international transfers, including standard contractual clauses where required.

12. User-Generated Content & Moderation

Ask Lucilla includes content from users and businesses: reviews, event and store chats, group messages, business listings and reward cards. When you report content or block someone, we record your account ID, what you reported or blocked, the reason and the time. Appeals for moderation decisions may be sent to social@lucilla.ca.

13. Connected Services You Link (Google, Meta, Point of Sale)

Business owners can link third-party services to their Ask Lucilla business account so that a listing, menu, calendar or inbox stays in step with the tools they already use. Each link is created by the owner through that provider's own sign-in (OAuth) and can be removed at any time from the Connectors screen or from the provider's own account settings. We store the access tokens that the provider issues, encrypted, and use them only for the features described below.

13.1 Google services

When an owner links Google Calendar, we read free/busy times and write bookings into the calendar the owner chooses; customers never see calendar contents, only availability. When an owner links Google Sheets, Google Docs or Google Drive, we read only the specific files the owner picks (or pastes a link to) in order to import a menu, price list, supplier order guide or listing photos; we do not scan the owner's Drive. When a business links its YouTube channel we read public video listings only. Ask Lucilla's use and transfer of information received from Google APIs adheres to the Google API Services User Data Policy, including the Limited Use requirements: Google user data is used only to provide the feature the owner asked for, is never sold, is never used for advertising, and is never read by a human except with the owner's consent, for security purposes, or as required by law.

13.2 Meta services (Facebook Messenger, Instagram, WhatsApp Business)

When an owner links a Facebook Page, an Instagram professional account or a WhatsApp Business number, messages that customers send to that business are delivered to the Ask Lucilla assistant so the business can answer them by text, and replies are sent back through Meta. We store message content and sender identifiers for that business only as long as needed to run the conversation and the business's order or booking records. We do not post to a business's page or send marketing messages unless the owner asks for it in the assistant. Data received from Meta is handled under Meta's Platform Terms in addition to this policy.

13.3 Point-of-sale, e-commerce and accounting services

When an owner links Square, Clover, Lightspeed, Shopify, WooCommerce, Toast, QuickBooks or Xero, we read the catalogue, inventory, hours and order or sales records needed to keep the listing accurate, to record customer orders in the business's own system, and to summarise sales back to the owner. For an online shop, we may also create a discount code or payment link in the shop's own checkout so a customer's Ask Lucilla deal applies there; the customer pays the shop directly. We never move money inside those systems and never store card numbers from them.

13.4 Messenger, Instagram and WhatsApp Business messages: the details

This section adds detail to Section 13.2 for businesses that connect a Facebook Page (Messenger), an Instagram professional account or a WhatsApp Business number, and for the people who message those businesses.

• What we receive. The messages a customer sends to the connected business account and the replies sent from it through Ask Lucilla; the sender identifiers Meta provides for that conversation (a page-scoped or Instagram-scoped ID, or the WhatsApp phone number, and a display name where Meta supplies one); message timestamps and delivery or read status; and metadata about attachments (such as type, size and the link Meta provides), plus the attachment itself where it is needed to answer the message, for example a photo of an item the customer asks about.
• Why. Only to let the business answer its own customers, who message that business first. We reply only inside the window Meta allows (within 24 hours of the customer's last message), and we do not use these conversations to message people who have not contacted the business.
• Where it is stored. On Google Cloud and Firebase, in the United States (us-east1 region), encrypted in transit and at rest (Section 8).
• How long we keep it. There is no automatic expiry yet. Messages and sender identifiers are kept until the business deletes them or disconnects the account and asks us to delete them, or until the person who sent them requests deletion — including by requesting account deletion at asklucilla.com/legal/rewards/delete-account or by writing to support@asklucilla.com. If we add automatic expiry, we will update this section.
• No sale. We do not sell this data, rent it, or use it for advertising, and we do not share it with other businesses. The connected business can see its own conversations; Meta processes the messages under its own terms because they travel through Meta's platforms.

13.5 Email and SMS invitations for staff

A business owner or manager can invite staff to help run the business account. To do that, the owner enters the staff member's email address or mobile number, and we send an invitation by email or SMS with a link to join (asklucilla.com/join); we send it again only if the owner re-sends it. Invitations expire after 14 days, and the link only works for someone who signs in with the same phone number or email the invitation was sent to. We store the address or number, the role offered, who sent the invitation and whether it was accepted, declined or expired, so the owner can see and cancel pending invitations. We use this contact only for the invitation and the staff account it creates; it is not added to marketing lists and is not sold. The invited person can decline the invitation, and can ask us to delete their details at support@asklucilla.com.

14. AI Agents You Connect

You can let an AI assistant you already use (for example Claude, ChatGPT or Meta AI / Muse) act on your Ask Lucilla account through our agent connection (an MCP server). You approve that connection yourself, on our sign-in page, and choose what the agent may do: read deals, claim deals, read or update your shop, place orders, or spend from your wallet. Every permission is a separate choice and can be revoked at any time from your account or by disconnecting the agent. Actions with a consequence (claiming, ordering, paying, changing a listing) always ask the agent to confirm with you first. When an agent acts, we receive the request from the agent provider together with the identity of the connected account; we do not receive your other conversations with that agent, and we do not share your Ask Lucilla data with the agent provider beyond the answer to the specific request. The agent provider's own privacy policy governs what it does with what it shows you.

15. Changes to This Policy

We may update this Privacy Policy periodically. We will notify you of significant changes via email or in-app notification. Continued use after changes constitutes acceptance.

16. Contact Us

For questions about this Privacy Policy, GDPR / PIPEDA / CCPA rights requests, and data-deletion requests:

• Email: support@asklucilla.com
• Website: asklucilla.com/legal/rewards
• Legal notices: Lucilla, Inc. (a Delaware corporation), c/o its affiliate 16699448 Canada Corporation, Toronto, Ontario, Canada, attention Sebastian Borjas, s.borjas@asklucilla.com

For abuse reports, moderation and support: social@lucilla.ca.