Privacy policy

Lupee Privacy Policy

Effective date: 13 November 2026

1. Summary in plain terms

• Lupee reads messages from chat channels you explicitly turn on, and only

those channels.

• It sends the text of those messages to a third-party AI provider so that the

model can find commitments in them. That is the whole point of the product, and we cannot do it without sending your message text to that provider.

• We are not end-to-end encrypted. We can technically read your message text

while we are processing it. Anyone who tells you a product like this is end-to-end encrypted is describing something else.

• Raw message text is deleted after 30 days. On a Team plan an administrator can

change that window for the whole workspace, shorter or longer, between one day and 12 months; on every other plan it stays at 30 days. Extracted commitments live longer, because they are the product.

• We do not sell your data. We do not use your message content to train

general-purpose AI models, and under our agreement with the AI provider your content is not used to train their models either (verify before publishing).

• You can delete everything, and deletion means deletion.

The rest of this document is the detail.

2. Who this policy covers, and who we are

This policy covers the Lupee web app, iOS app, Android app, API and the marketing site at https://lupee.app.

ILLUSNT LLC, 1209 Mountain Road Pl NE, Ste R, Albuquerque, NM 87110, USA, registered in the State of New Mexico, USA, is the data controller for the personal data described in section 3 except where section 5 says we act as a processor.

Contact: [OWNER TO CONFIRM: privacy contact mailbox, proposed privacy@lupee.app].

3. What data we collect

3.1 Account data

Email address, name and avatar if you provide them or if your identity provider gives them to us, the identity provider you used (email one-time code, Sign in with Apple, or Google), account creation date, plan and entitlement, language and timezone, and your settings including retention preferences.

Source: you, or Apple or Google when you use those sign-in methods. Sign in with Apple may give us a private relay email address rather than your real one.

3.2 Connection data

For each Workspace you connect: the platform, the workspace or server or chat identifier and name, the access tokens or bot credentials needed to talk to that platform, the scopes granted, the list of channels available, and which of them you have enabled.

3.3 Message content and metadata, for enabled channels only

For each channel you explicitly enable, we ingest:

• the text of messages posted while the channel is enabled
• the sender's platform user identifier and display name
• the channel and thread identifiers
• timestamps
• message links, so we can point you back to the source
• limited structural metadata such as whether a message is a reply, an edit or

a deletion

We do not ingest attachments, images, audio, video or file contents. We do not ingest channels you have not enabled. We do not backfill history from before the channel was enabled beyond the limited initial window your plan allows, and we tell you what that window is when you enable the channel.

Messages from people who are not Lupee users. A channel contains messages written by other people. When you enable a channel, their messages are ingested too. Where you enable a channel as part of an organisation, that organisation is the controller for that data and we are its processor. See section 5.

The party filter, which decides how much of a channel we keep. A channel, especially a busy community server, is mostly people talking to each other about things that have nothing to do with you. We have a filter that keeps a message only where your team is actually a party to it: your team wrote it, it mentions one of them, it replies to something one of them wrote, it sits in a thread one of them has posted in, or it is a direct message involving one of them. A message that satisfies none of those cannot produce a commitment for you, and it is not your business.

Two honest details about it. The filter always applies to the history we read when you first enable a channel, which is where most of the volume is. On the live stream of new messages it is a setting rather than a default, and where it is off we store messages your team is not a party to and delete them on the ordinary retention window. We are changing that default; until we have, this paragraph is what is true. The filter also depends on your team having linked their platform identities, because without that we do not know who your team is.

Verify before publishing: that the live default has been changed, and rewrite this paragraph when it has.

3.4 Derived data

Commitments and related records: the extracted obligation, who owes it, who it is owed to, the due date, a confidence score, its state, and a reference to the source message. Also your confirmations, rejections, edits, snoozes and completions, which we use as a quality signal for your own workspace.

Derived data can contain personal data, because a commitment is usually about a person.

3.5 Device and push data

Device model, operating system version, app version, locale, and a push notification token issued by Apple Push Notification service or Firebase Cloud Messaging, delivered through the Expo push service. We use the token only to deliver notifications to you.

Verify before publishing: whether notification payloads include message text or commitment text. If they do, say so here, because payload content passes through Apple or Google.

3.6 Usage telemetry and diagnostics

Events such as screens opened, features used, connectors added, extraction volumes, error rates, latency, and crash reports including stack traces and the device state at the time of a crash. Crash reports can incidentally contain fragments of data that were in memory. We configure our crash reporting tool to scrub known sensitive fields, but this is best effort.

Server logs contain IP address, user agent, request path, timing and status codes.

3.7 Billing data

For web purchases, our payment processor collects and holds your payment method and billing details. We receive and store only billing metadata: a customer identifier, the plan, the amount, currency, country, tax status, the last four digits and brand of the card, invoice history and subscription state. We do not receive or store your full card number.

For purchases through the Apple App Store or Google Play, the store handles the transaction. We receive a transaction and entitlement record through RevenueCat, plus a store-issued anonymous identifier. We do not receive your payment method.

3.8 Support data

If you contact support we keep the correspondence and whatever you choose to include in it.

3.9 Website data

See section 13 on cookies.

3.10 What we do not collect

We do not collect special category data on purpose. Chat messages can of course contain anything, including health, political or other sensitive information. That is a reason to be careful about which channels you enable. We do not ask for or want government identifiers, biometric data, or precise location, and we do not collect precise location.

4. Why we process it, and our lawful basis under the GDPR

Where we rely on legitimate interests, we have weighed our interest against your rights. You can ask us for that assessment at [OWNER TO CONFIRM: privacy contact mailbox, proposed privacy@lupee.app], and you can object under section 10.

Consent is not on this list for message processing, and that is deliberate. For an employee, consent given to an employer is not freely given, because of the imbalance between them, so it is not a valid basis and offering it would be a pretence. For someone on the other end of a conversation who has no relationship with us at all, there is no moment at which they could be asked, and a request that arrives after their message has been read is a notification rather than a choice. Legitimate interests, held by the organisation that connected the channel, with a balancing test they have to be able to show, is the honest answer for both.

We have carried out a data protection impact assessment covering this processing, as Art. 35 requires for systematic monitoring of communications at this scale. It is an internal document rather than a published one, and business customers can ask for it at [OWNER TO CONFIRM: privacy contact mailbox, proposed privacy@lupee.app].

Where we rely on consent, you can withdraw it at any time. Withdrawal does not affect processing that already happened.

5. Controller and processor: who is responsible for what

This split matters, because it decides who you go to with a request.

We are the controller for: account data, connection data, billing metadata, device and push data, usage telemetry and diagnostics, support correspondence, and website data.

We are the processor for message content and metadata, and for the commitments derived from it, whenever you enable channels as part of an organisation, a team, a Slack workspace, a Discord server or any other group that is not purely personal. In that case the organisation is the controller, it decides which channels are enabled and for how long data is kept, and it is responsible for having a lawful basis and for telling the people in those channels. Our Data Processing Addendum at https://lupee.app/dpa governs that relationship and is offered to every business customer.

Where you use Lupee on your own, with no organisation behind you, there are two cases and they have different answers.

If you use it for work, which includes freelancing and running your own business, the household exemption in the GDPR does not apply to you. You are the controller of the message data in your own right and we are your processor, in exactly the same way as for a company. The DPA applies to you. This is the usual case.

If you genuinely use it for personal or household purposes only, the GDPR does not govern what you do with that data, but it still governs what we do. In that case we are the controller for the data of the other people in those conversations, our basis is legitimate interests under Art. 6(1)(f), and we limit the processing to what is needed to produce your commitment list.

If you are a person whose messages were ingested because someone else enabled a channel, and you want them removed, write to [OWNER TO CONFIRM: privacy contact mailbox, proposed privacy@lupee.app]. We will pass your request to the relevant controller and help them act on it, and we will act directly where we are entitled to.

6. What we send to the AI provider, and on what terms

To extract commitments we send message text and limited context to Anthropic's API, using their Claude models. This is the single most important disclosure in this policy.

What is sent. The text of messages from your enabled channels, within a recent time window, together with the display names or identifiers of the senders and the timestamps, and a system prompt describing the extraction task.

What is not sent. Your email address, your billing data, your access tokens, attachments, and messages from channels you have not enabled.

Redaction before the call. We run an automated redaction pass before the request leaves our infrastructure. It targets recognisable shapes: known API key prefixes, JSON web tokens, private keys, webhook URLs, secrets that carry a name such as token, secret or password, payment card numbers that pass the Luhn check, IBANs, social security numbers, recovery phrases, email addresses and phone numbers. A secret with no recognisable shape reads to it as ordinary text. Redaction is pattern-based and best effort. It will not catch everything, and it is not a substitute for not putting secrets in a channel you have enabled.

No training, and it is a contract requirement as well as a promise. We do not use your message content to train or fine-tune any model, and we never will without asking you first. This is not only our policy. Discord's Developer Policy prohibits using message content obtained through its APIs to train machine learning or AI models, including large language models, without Discord's express written permission. Slack's API terms say, without qualification, that API data may not be used to train a large language model. Sending text to a model so that it can read one batch of messages and hand back what it found is inference, not training, and it is all this product does.

Retention at the provider. Under the provider's commercial API terms, inputs and outputs are not used to train their models. The provider may retain inputs and outputs for a limited period for abuse monitoring and legal compliance. Verify the current terms and the exact retention period before publishing, and state the number here. If you enable zero data retention, say so here instead.

Where it is processed. The provider processes API requests in its own regions, which today are outside the EU for standard API access. Verify before publishing. This means that turning on message processing involves an international transfer, covered by section 8.

No human review by us as a routine matter. We do not read your messages as part of normal operations. Engineers may access message data only in the narrow cases in section 9.

7. Who else we share data with

We share personal data with:

• Subprocessors who run parts of the service for us. The current list, with

what each one does, what it sees and where it runs, is at https://lupee.app/subprocessors. We keep it current and we give notice of changes as described in the DPA.

• The chat platforms you connect, because we call their APIs on your behalf

and, where you have enabled it, post replies into your threads.

• Professional advisers, such as accountants and lawyers, under duties of

confidence.

• Authorities, where we are legally required to. We will tell you unless we

are legally prevented from doing so, and we will push back on requests that are overbroad.

• An acquirer, if the business is sold, merged or restructured. We will tell

you before your data becomes subject to a different privacy policy.

We do not sell personal data. We do not share personal data for cross-context behavioural advertising. We do not use your message content or your commitments for advertising of any kind.

8. International transfers

We are established in the State of New Mexico, USA. Our subprocessors operate in several countries, including the United States.

When we transfer personal data out of the European Economic Area, the UK or Switzerland, we rely on:

• an adequacy decision, where one covers the recipient
• the European Commission's Standard Contractual Clauses (Decision 2021/914),

with the UK International Data Transfer Addendum for UK transfers and the Swiss adaptations for Swiss transfers

• where applicable, the recipient's certification under the EU-US Data Privacy

Framework and its UK and Swiss extensions

We carry out a transfer impact assessment for transfers to countries without an adequacy decision, and we apply supplementary measures, including encryption in transit, encryption at rest, and minimisation of what is sent.

EU data region: we do not have one. Our database and application hosting providers support EU regions and we intend to offer EU data residency, but it is not built and it is not available. If you need your data to stay in the EU, we are not the right product for you today. We would rather tell you that than sell you something on the strength of a roadmap.

When it does exist, it will cover storage and compute. The call to the AI provider will still leave the EU, because the provider does not offer an EU region for standard API access, and that call is not optional: it is how commitments are extracted. We will say so plainly here rather than let an EU region badge imply more than it delivers.

You can ask us for a copy of the transfer mechanism we use for a specific subprocessor at [OWNER TO CONFIRM: privacy contact mailbox, proposed privacy@lupee.app].

9. How long we keep data

What "raw message text is deleted after 30 days" does and does not mean. This is the sentence people most often read too generously, so here is exactly what happens. On the night a message passes the window, we null its text. What survives is the rest of the row: who wrote it, their platform username and display name, which channel and thread it was in, when it was posted, and the link back to it on the platform. Every commitment we extracted from that message also survives, and a commitment's title and detail are written in the words of the original message. So after 30 days we no longer hold the conversation, and we do still hold a record of who promised what to whom and when. That record is the product, and deleting it is what the delete function is for.

Some platforms cap the window below what your plan allows. The chat platforms impose their own limits on how long an app may hold their data, and those limits are contractual rather than a matter of data protection law. Slack permits only limited and temporary storage of another organisation's data and prohibits persistent copies, archives, indexes and long-term stores. Discord restricts retention of message content to what is necessary. Where a platform's limit is shorter than the window you have set, the platform's limit applies to data from that platform, and we will show you which sources are capped and at what. Where we cannot honestly meet a platform's rules, we do not support that platform: LinkedIn's rules, which allow a member's profile data to be held for 24 hours and their activity for 48, are the reason LinkedIn is permanently out of scope for this product.

Verify before publishing: that the per-source retention ceiling is built. Until it is, one workspace-wide window applies to every source, which is a gap we have recorded rather than a design we have chosen.

The retention window is configurable on a Team plan. Changing it is a Team plan control, exercised by a workspace administrator for the whole workspace, anywhere from one day to 12 months. Their choice overrides an individual member's preference. On every other plan the window stays at the 30 day default, and there is no per-member setting.

Shortening retention does not delete the commitments already extracted. It deletes the raw text they came from, which means the source message text will no longer be visible in the app. The item keeps the coordinates of its source message, and where the platform gives us a permalink the deep link still works. Discord does. Slack and Telegram do not, so an item from those is found again by channel, author and timestamp rather than by a link.

Deletion. Deletion runs at two scopes: the whole workspace, and your own account. When you use either, we delete the records from live systems within 30 days, and they leave the encrypted backups as those age out, within a further 90 days. Turning a channel off is not a deletion. It stops anything further being read from that channel, and the text already stored from it is deleted on the ordinary retention window rather than immediately, so the way to remove it sooner is a workspace deletion. Some records survive deletion where the law requires it, principally billing records, and where we need them to defend a legal claim. Aggregated statistics that cannot identify you may be kept.

Engineer access. A small number of engineers can technically access stored message data. Access is limited to named individuals, is logged, and is used only to investigate a fault you have reported, to respond to a security incident, or where the law requires it.

10. Your rights under the GDPR and UK GDPR

If the GDPR or UK GDPR applies to you, you have the right to:

• Access a copy of the personal data we hold about you
• Rectification of inaccurate data
• Erasure, in the circumstances the law provides
• Restriction of processing
• Portability of data you gave us, in a machine-readable format
• Object to processing based on legitimate interests, including profiling.

If you object to direct marketing we will stop, always and immediately

• Withdraw consent where we rely on it
• Not be subject to a decision based solely on automated processing that

produces a legal or similarly significant effect. Lupee does not make such decisions. Extraction is automated, but it produces a suggestion a person reviews, and nothing happens until they act on it. No entitlement is granted or withheld and no consequence attaches to anyone from the output on its own.

We should be precise about the thing next to it, though, because it is not the same thing. Lupee does carry out some automated evaluation of people: it records that a named person owes something, and it can tell you that a promise made to you six days ago has gone quiet. That is profiling in the sense the GDPR uses the word, even though it does not reach the automated decision rule above. It carries a right to object under Art. 21, which is the bullet above this one, and where we are the processor that objection goes to the organisation that connected the channel. If a customer ever wires a Lupee output into a decision about a person's pay, promotion, discipline or contract, that is their decision and their obligation under Art. 22, and we say so in the Data Processing Addendum.

• Complain to a supervisory authority. You can complain in the EU member

state where you live, work, or where the issue happened, or to the UK Information Commissioner's Office if you are in the UK. We would rather you came to us first.

How to exercise them. Most of this is self-service in Settings: export your data, delete your workspace, delete your account. For anything else, email [OWNER TO CONFIRM: privacy contact mailbox, proposed privacy@lupee.app]. We respond within one month. We can extend by two further months for complex requests, and we will tell you within the first month if we do. We may ask you to verify your identity, and we will not ask for more than we need to do that.

There is no charge, unless a request is manifestly unfounded or excessive, in which case we may charge a reasonable fee or refuse, and we will explain why.

Requests about message data we process for an organisation. If we are the processor, we will forward your request to the controller and support them in answering it, rather than acting on it ourselves.

If you are not a customer and your messages are here because somebody else connected a channel. This is the hardest case and we have a written procedure for it rather than an improvisation. Write to [OWNER TO CONFIRM: privacy contact mailbox, proposed privacy@lupee.app] and tell us which platform, which server or workspace, which channel if you know it, and the username you post under. We will look, we will pass your request to the organisation that connected that channel, and we will tell you that we have. What we will not be able to do is name that organisation without their agreement, because that is their information rather than ours. If that is not a satisfactory answer, you can complain to your national data protection authority without going through us, and we will cooperate with them.

Where we are entitled to act ourselves we will, and there are two ordinary cases where we are: the channel has since been switched off or the workspace deleted, so there is no live instruction to conflict with, and the retention window has passed so the text is already gone. In the second case we will tell you exactly what survives, because a purge is not the same as a deletion and we will not describe it as one.

11. Your rights under the CCPA and CPRA

If you are a California resident, you have the right to:

• Know what personal information we collect, the sources, the purposes, and

the categories of third parties we disclose it to. Sections 3, 4 and 7 answer this.

• Access the specific pieces of personal information we hold
• Delete your personal information, subject to legal exceptions
• Correct inaccurate personal information
• Opt out of sale or sharing. We do not sell personal information and we do

not share it for cross-context behavioural advertising, so there is nothing to opt out of. We have not sold or shared personal information in the preceding 12 months, and we do not sell or share the personal information of anyone we know to be under 16.

• Limit the use of sensitive personal information. We do not use sensitive

personal information for purposes beyond those permitted without a limitation right.

• Non-discrimination. We will not deny you service, charge you a different

price, or give you a lower quality of service for exercising a right.

Categories collected in the last 12 months, using CCPA labels: identifiers; customer records; commercial information; internet or network activity; geolocation limited to coarse country from IP; and the contents of electronic messages where you have enabled a channel, which California treats as sensitive personal information. We use message content only to provide the service you asked for and for the purposes in section 4.

How to exercise them. Email [OWNER TO CONFIRM: privacy contact mailbox, proposed privacy@lupee.app], or use Settings. We confirm receipt within 10 business days and respond within 45 calendar days, extendable by a further 45 days with notice. An authorised agent may act for you with written permission and we may still ask you to verify your identity directly.

Residents of other US states with comparable laws, including Virginia, Colorado, Connecticut, Utah and Texas, have similar rights and can use the same contact and the same process.

12. Children

Lupee is not for children. We do not knowingly collect personal data from anyone under 16, or under 13 in jurisdictions that set that as the floor. If you believe a child has given us personal data, email [OWNER TO CONFIRM: privacy contact mailbox, proposed privacy@lupee.app] and we will delete it.

Note that chat channels can contain messages from minors even when every account holder is an adult. That is a further reason to be careful about which channels you enable, and it is one of the things the controller in section 5 is responsible for considering.

13. Cookies and the website

The marketing site at https://lupee.app uses:

• Strictly necessary cookies, for security, load balancing and remembering

your cookie choice. These do not need consent.

• Authentication cookies and local storage in the web app, to keep you

signed in. Also strictly necessary.

• Analytics, to count visits and understand which pages work. In the EU, the

UK and anywhere else that requires prior consent, these are off until you accept them in the consent banner, and you can change your mind at any time through the cookie settings link in the footer.

We do not use advertising cookies or third-party tracking pixels for behavioural advertising.

Browser "Do Not Track" signals have no agreed meaning and we do not act on them. We do honour the Global Privacy Control signal where the law requires it.

Verify before publishing: the exact cookie table, with name, provider, purpose and duration for each cookie actually set. Regulators expect that table, not a general description.

14. Security

We describe our security practices at https://lupee.app/security. In summary: data is encrypted in transit with TLS and at rest by our infrastructure providers, access to production is limited and requires multi-factor authentication, secrets are held in a managed secret store and never in source control, and we log administrative access.

We do not hold SOC 2, ISO 27001 or any other security certification today. See the security overview for what we do instead and what is on the roadmap. We will not claim a certification we do not have.

No system is perfectly secure. If you find a vulnerability, write to [OWNER TO CONFIRM: security mailbox, proposed security@lupee.app].

If a personal data breach affects you and is likely to result in a high risk to your rights, we will tell you without undue delay. Where we are a processor, we will notify the controller without undue delay and support their notification.

15. Contact, DPO and representatives

15.1 General privacy contact [OWNER TO CONFIRM: privacy contact mailbox, proposed privacy@lupee.app] ILLUSNT LLC, 1209 Mountain Road Pl NE, Ste R, Albuquerque, NM 87110, USA

15.2 Data Protection Officer. [OWNER TO CONFIRM: data protection officer or named privacy contact], [OWNER TO CONFIRM: privacy contact mailbox, proposed privacy@lupee.app]. If you are not required to appoint a DPO under Article 37, delete this subsection and keep a named privacy contact instead. Do not call someone a DPO unless you have appointed one properly.

15.3 EU representative. If we are not established in the EU, our Article 27 representative is [OWNER TO CONFIRM: EU Article 27 representative]. UK representative: [OWNER TO CONFIRM: UK Article 27 representative]. Delete whichever does not apply.

16. Changes to this policy

We update this policy when the product or the law changes. For a material change we give at least 30 days' notice by email or in-app before it takes effect, and we say what changed. Older versions are at https://lupee.app/privacy/archive.