What we collect and why.

Lucida is a hiring-decision support tool. We process two distinct categories of personal data: customer data (the founder / hiring-team account, billing, workspace) and candidate data (résumés, contact details, interview answers, integrity signals during the application flow). This page tells you what we collect, why, who can see it, and how long we keep it.

This policy is written in plain English. If you have questions, email hello@lucida.team — we usually reply within one business day.

Quick summary

• We process candidate data only to score it against the rubric your company has published.
• We do not train models on your data. We do not sell data to third parties.
• Every candidate gets a shareable feedback report with their score and the reasoning — this is the artifact Lucida produces.
• Candidates can request deletion at any time by emailing hello@lucida.team.
• Data resides on a Contabo VPS (EU/Germany) with daily off-site backups to Google Cloud Storage.

1. Customer data (workspace admin accounts)

What we collect

• Email, first name, last name, hashed password (we never store plaintext passwords)
• Workspace name, subdomain, contact email (mandatory — used as the reply-to on candidate emails sent on your behalf)
• Payment metadata from Razorpay (transaction ID, amount, plan, timestamp) — we do NOT store card numbers; Razorpay does
• Cal.com URL (optional, used for round-2 scheduling)

What we do with it

• Authenticate your sessions via a JWT cookie (24h lifetime, SameSite=lax, secure in production)
• Send transactional email (candidate notifications, briefing-ready alerts) — via Resend
• Bill you according to your subscription plan — via Razorpay
• Track aggregate platform metrics for our own founder review (MRR, ARR, active workspaces) — never identifying a specific company publicly

How long we keep it

For the lifetime of your account, plus 90 days after closure. You can request earlier deletion in writing.

2. Candidate data (applicants to your jobs)

What we collect

• Email, first name, last name, phone (optional), current city (optional), LinkedIn URL (optional)
• The résumé file you upload (PDF, DOC, DOCX, up to 5 MB)
• Cover letter text (optional)
• Answers to the adaptive interview (10 role-specific questions)
• Where an employer switches on the optional screening step: your written answers to a short interview and its follow-up questions (AI-assisted), and/or your answers to a fixed-key knowledge check (not AI-marked). We never collect camera, microphone, face, eye-movement or other biometric data.
• Behavioral signals during the interview: paste detection, dwell time per question, tab-switch count. These are shown to the hiring team as an advisory note and are never used to compute your score.
• An IP-level fingerprint for rate-limiting and Cloudflare Turnstile verification

How we use AI to score it

Lucida uses Lucida AI to score every candidate against the rubric your company has published. Every score:

• Cites direct quotes from the résumé and interview answers as evidence
• Returns a per-dimension breakdown with reasoning
• Generates a candidate-facing feedback report with strengths and growth areas
• Stores the model version + prompt version on the record so we can reproduce + audit the decision later

Your team always has final discretion — the AI surfaces evidence, the human makes the hire decision. The score is not the decision.

We do not use candidate data to train models. Lucida AI is delivered via a third-party LLM provider listed in our subprocessors index; that provider does not retain prompts or completions for training. We may change the underlying provider with prior notice — the audit trail, citation requirements, and privacy posture above remain constant.

Who can see candidate data

• Your workspace's admin users (typically one founder)
• The candidate themselves — via the shareable feedback URL at /c/<tenant>/feedback/<id>
• Lucida's super-admin (the founder of Lucida) — for support and audit purposes, on an as-needed basis, with access logged
• The current Lucida AI provider — transiently, during the LLM call. See subprocessors index for the named vendor.

Candidate data is never visible across workspaces. The application layer enforces this with explicit WHERE tenant_id = X filters; the database layer enforces it with PostgreSQL Row-Level Security policies (see our Terms §4 (Data isolation)).

How long we keep it

• While the job is active, and afterwards until the data is deleted
• Screening answers and transcripts are deleted automatically 12 months after the screen (the written interview, its follow-ups, and knowledge-check answers). Scores and summaries derived from them stay with the application.
• Automatic deletion of a whole application 12 months after a job closes is on our roadmap but is not running yet. Until it is, the rest of an application stays until it is deleted on request.
• A candidate can request earlier deletion by emailing hello@lucida.team. We honor this within 30 days, except where contractually obligated to retain (e.g. an active hiring round).

3. Cookies + tracking

Lucida sets two cookies of its own:

• fastapiusersauth — your authentication session (JWT, 24h, httponly, SameSite=lax)
• lucida_csrf — anti-CSRF token (signed, 24h, SameSite=lax)

Analytics. Our public marketing, pricing and sign-in pages load Google Tag Manager, which feeds Google Analytics 4 (run by Allied BizTech). It runs in Google's Consent Mode with every storage type denied, and we do not currently offer an opt-in — so no analytics cookies are set and Google receives only anonymous, cookieless page-view pings. We do not use Facebook Pixel, Hotjar or any advertising tag.

Where analytics never runs. The tag is not loaded inside your workspace (/admin), on candidate feedback reports, screening and interview links, the 90-day confirmation link, or password-reset links — those URLs identify a person or act as a credential, so they are never sent to Google.

We use Sentry for error tracking — only stack traces and request metadata are collected, never form contents.

4. DPDPA compliance (India's Digital Personal Data Protection Act, 2023)

Lawful basis for processing

Customer data is processed on the basis of contract (you signed up for a Lucida workspace). Candidate data is processed on the basis of consent (you ticked the consent box on the apply form) and legitimate interest (your company has a contractual hiring need; you applied to that role). If a hiring team adds your résumé themselves (for example from a LinkedIn message or a referral) you did not tick that box: we score it for them under their legitimate interest, we do not email you unless they choose to, and if they do the email says your résumé was added and how to have it removed. You can also ask us directly at hello@lucida.team.

Your rights as a Data Principal

Under DPDPA 2023 §11–§14 you have the right to:

• Access — request a copy of the personal data we hold about you
• Correction — request we correct inaccurate or incomplete data
• Erasure — request deletion (subject to legal retention obligations)
• Grievance redressal — escalate complaints to our Grievance Officer (below)
• Nominate — designate someone to exercise your rights in the event you are incapacitated or deceased

Grievance Officer

Per DPDPA §10(7), Lucida's designated Grievance Officer is:

Dipesh Majumder
Email: hello@lucida.team (subject line: "Grievance — Privacy")
Response time: 7 business days

If you are not satisfied with our resolution, you may file a complaint with the Data Protection Board of India once it is constituted under DPDPA §18.

5. Security posture

• Encryption in transit: TLS 1.3 via Caddy + Let's Encrypt, with HSTS
• Encryption at rest: PostgreSQL data + uploaded résumés + nightly backups all encrypted; backups additionally encrypted with age before leaving the host
• Row-Level Security (RLS): Postgres-enforced workspace isolation (see Terms §4)
• CSRF protection: itsdangerous-signed double-submit tokens on every state-mutating request
• Upload validation: magic-byte sniff at upload time rejects HTML-disguised files
• Workspace-gated downloads: résumé files are never served via a public mount; every download checks the requesting user belongs to the file's workspace
• Daily backups: stored off-site in Google Cloud Storage, encrypted at rest by the provider, as a daily set plus a fortnightly long-term archive

We are not yet SOC 2 / ISO 27001 certified. We will pursue SOC 2 Type II when our customer base reaches the threshold where mid-market customers require it.

6. Data residency

Lucida's production servers are hosted on Contabo (Germany / EU). Daily backups are stored in Google Cloud Storage, outside India. The current Lucida AI provider (see subprocessors index) processes prompts transiently in their infrastructure.

If you are an Indian Data Principal and the cross-border transfer of your data is a concern, please contact the Grievance Officer above. DPDPA §16 cross-border transfer rules are evolving; we will adjust our infrastructure as the rules mature.

7. Changes to this policy

We will email all active workspace admins at least 30 days before any material change to this policy. Material changes include any expansion of what data we collect or how we use it. We will not retroactively apply new uses to historical data without explicit consent.

8. How to contact us

General privacy questions: hello@lucida.team
Grievance / DPDPA escalation: hello@lucida.team (subject "Grievance — Privacy")
Data deletion request: hello@lucida.team (subject "Deletion request")

We aim to respond within 7 business days for routine queries and within 30 days for deletion requests.