What we collect and why.

Lucida is a hiring-decision support tool. We process two distinct categories of personal data: customer data (the founder / hiring-team account, billing, workspace) and candidate data (résumés, contact details, interview answers, integrity signals during the application flow). This page tells you what we collect, why, who can see it, and how long we keep it.

This policy is written in plain English. If you have questions, email hello@lucida.team — we usually reply within one business day.

Quick summary

• We process candidate data only to score it against the rubric your company has published.
• We do not train models on your data. We do not sell data to third parties.
• Every candidate gets a shareable feedback report with their score and the reasoning — this is the artifact Lucida produces.
• Candidates can request deletion at any time by emailing hello@lucida.team.
• Data resides on a Contabo VPS (EU/Germany) with daily encrypted backups to Backblaze B2.

1. Customer data (workspace admin accounts)

What we collect

• Email, first name, last name, hashed password (we never store plaintext passwords)
• Workspace name, subdomain, contact email (mandatory — used as the reply-to on candidate emails sent on your behalf)
• Payment metadata from Razorpay (transaction ID, amount, plan, timestamp) — we do NOT store card numbers; Razorpay does
• Cal.com URL (optional, used for round-2 scheduling)

What we do with it

• Authenticate your sessions via a JWT cookie (24h lifetime, SameSite=lax, secure in production)
• Send transactional email (candidate notifications, briefing-ready alerts) — via Resend
• Bill you according to your subscription plan — via Razorpay
• Track aggregate platform metrics for our own founder review (MRR, ARR, active workspaces) — never identifying a specific company publicly

How long we keep it

For the lifetime of your account, plus 90 days after closure. You can request earlier deletion in writing.

2. Candidate data (applicants to your jobs)

What we collect

• Email, first name, last name, phone (optional), current city (optional), LinkedIn URL (optional)
• The résumé file you upload (PDF, DOC, DOCX, up to 5 MB)
• Cover letter text (optional)
• Answers to the adaptive interview (10 role-specific questions)
• Behavioral signals during the interview: paste detection, dwell time per question, tab-switch count (used to flag suspicious patterns; never shared with the candidate)
• An IP-level fingerprint for rate-limiting and Cloudflare Turnstile verification

How we use AI to score it

Lucida uses Lucida AI to score every candidate against the rubric your company has published. Every score:

• Cites direct quotes from the résumé and interview answers as evidence
• Returns a per-dimension breakdown with reasoning
• Generates a candidate-facing feedback report with strengths and growth areas
• Stores the model version + prompt version on the record so we can reproduce + audit the decision later

Your team always has final discretion — the AI surfaces evidence, the human makes the hire decision. The score is not the decision.

We do not use candidate data to train models. Lucida AI is delivered via a third-party LLM provider listed in our subprocessors index; that provider does not retain prompts or completions for training. We may change the underlying provider with prior notice — the audit trail, citation requirements, and privacy posture above remain constant.

Who can see candidate data

• Your workspace's admin users (typically one founder)
• The candidate themselves — via the shareable feedback URL at /c/<tenant>/feedback/<id>
• Lucida's super-admin (the founder of Lucida) — for support and audit purposes, on an as-needed basis, with access logged
• The current Lucida AI provider — transiently, during the LLM call. See subprocessors index for the named vendor.

Candidate data is never visible across workspaces. The application layer enforces this with explicit WHERE tenant_id = X filters; the database layer enforces it with PostgreSQL Row-Level Security policies (see our Terms §4 (Data isolation)).

How long we keep it

• While your job is active + 12 months after the job is closed/archived
• After 12 months, candidate data for closed jobs is automatically purged unless you explicitly opt in to retention (e.g. for talent-pool re-engagement)
• A candidate can request earlier deletion by emailing hello@lucida.team. We honor this within 30 days, except where contractually obligated to retain (e.g. an active hiring round).

3. Cookies + tracking

Lucida uses two cookies:

• fastapiusersauth — your authentication session (JWT, 24h, httponly, SameSite=lax)
• lucida_csrf — anti-CSRF token (signed, 24h, SameSite=lax)

We do not use third-party analytics cookies (no Google Analytics, no Facebook Pixel, no Hotjar). We use Sentry for error tracking — only stack traces and request metadata are collected, never form contents.

4. DPDPA compliance (India's Digital Personal Data Protection Act, 2023)

Lawful basis for processing

Customer data is processed on the basis of contract (you signed up for a Lucida workspace). Candidate data is processed on the basis of consent (you ticked the consent box on the apply form) and legitimate interest (your company has a contractual hiring need; you applied to that role).

Your rights as a Data Principal

Under DPDPA 2023 §11–§14 you have the right to:

• Access — request a copy of the personal data we hold about you
• Correction — request we correct inaccurate or incomplete data
• Erasure — request deletion (subject to legal retention obligations)
• Grievance redressal — escalate complaints to our Grievance Officer (below)
• Nominate — designate someone to exercise your rights in the event you are incapacitated or deceased

Grievance Officer

Per DPDPA §10(7), Lucida's designated Grievance Officer is:

Dipesh Majumder
Email: hello@lucida.team (subject line: "Grievance — Privacy")
Response time: 7 business days

If you are not satisfied with our resolution, you may file a complaint with the Data Protection Board of India once it is constituted under DPDPA §18.

5. Security posture

• Encryption in transit: TLS 1.3 via Caddy + Let's Encrypt, with HSTS
• Encryption at rest: PostgreSQL data + uploaded résumés + nightly backups all encrypted; backups additionally encrypted with age before leaving the host
• Row-Level Security (RLS): Postgres-enforced workspace isolation (see Terms §4)
• CSRF protection: itsdangerous-signed double-submit tokens on every state-mutating request
• Upload validation: magic-byte sniff at upload time rejects HTML-disguised files
• Workspace-gated downloads: résumé files are never served via a public mount; every download checks the requesting user belongs to the file's workspace
• Daily backups: encrypted with age, pushed to Backblaze B2 (US East), 7-day rolling retention

We are not yet SOC 2 / ISO 27001 certified. We will pursue SOC 2 Type II when our customer base reaches the threshold where mid-market customers require it.

6. Data residency

Lucida's production servers are hosted on Contabo (Germany / EU). Daily backups are pushed to Backblaze B2 (US East). The current Lucida AI provider (see subprocessors index) processes prompts transiently in their infrastructure.

If you are an Indian Data Principal and the cross-border transfer of your data is a concern, please contact the Grievance Officer above. DPDPA §16 cross-border transfer rules are evolving; we will adjust our infrastructure as the rules mature.

7. Changes to this policy

We will email all active workspace admins at least 30 days before any material change to this policy. Material changes include any expansion of what data we collect or how we use it. We will not retroactively apply new uses to historical data without explicit consent.

8. How to contact us

General privacy questions: hello@lucida.team
Grievance / DPDPA escalation: hello@lucida.team (subject "Grievance — Privacy")
Data deletion request: hello@lucida.team (subject "Deletion request")

We aim to respond within 7 business days for routine queries and within 30 days for deletion requests.