Privacy Policy

1. Who we are

LucraAI is an AI-assisted hiring co-pilot operated by Lucra AI (CVR: 45943968), a Danish personally owned small business (Personligt ejet Mindre Virksomhed, PMV). “Lucra AI”, “we”, “us” and “our” in this policy refer to Lucra AI as the operator of the platform at lucraai.com.

• Operator: Lucra AI, CVR 45943968
• Website: lucraai.com
• Contact: privacy@lucraai.com

2. Our two roles, and what this policy covers

LucraAI handles personal data in two distinct roles, and your rights and our responsibilities differ depending on which applies.

As a data processor (candidate data). When a hiring company uses LucraAI to evaluate its candidates, that company decides why and how the candidate data is used. The company is the data controller. We process candidate data only on that company's documented instructions, under a Data Processing Agreement. We do not decide how candidate data is used and we do not use it for our own purposes. If you are a candidate, the controller of your data is the company interviewing you. They provide you with a separate candidate information notice, and you exercise your rights through them (we assist them in responding). Section 3 describes this processing.

As a data controller (account holders and website visitors). When you create or use a LucraAI account, or visit lucraai.com, we determine how that account and website data is handled. For this data we are the controller, and this policy is your primary notice under GDPR Articles 13–14. Section 4 describes this.

3. Candidate personal data (we act as a processor)

When a customer uses LucraAI to support hiring, we process the following candidate data on the customer's behalf:

• Candidate name and contact details
• CV contents
• Interview audio and transcript contents
• Job description contents (the customer's own documents)

What we do with it.We generate structured post-interview evaluation reports, pre-interview question sets, job descriptions, and — during a live-captured interview — real-time follow-up question suggestions for the interviewer, generated from the candidate's CV, the job description, and the interview transcript so far. These outputs are provided to the customer for its own hiring decisions.

How interview content reaches us. The interviewer may provide interview content to LucraAI in one of two ways, at their choice: (a) by pasting a transcript the customer produced with its own tools, or (b) by using LucraAI's live capture, which records interview audio during the interview, either in person (via the interviewer's device microphone) or from an online meeting, and transcribes it in real time. Where live capture is used, audio is streamed via our infrastructure provider (Railway) to our speech-to-text subprocessor (Soniox), processed within the EU, and the audio is not stored: neither by Railway, Soniox (whose real-time API does not retain audio or transcripts), nor by LucraAI. Only the resulting transcript is processed to generate the requested outputs. Live capture only begins after the interviewer confirms the candidate has been informed.

Human decides. All hiring decisions are made by a person at the customer. LucraAI provides information, not decisions. A candidate can request human review of any AI-assisted assessment.

No model training. Candidate data, including interview audio and transcripts, is never used to train AI models, not by us and not by our subprocessors.

Special-category data. We do not intentionally collect special-category data (health, religion, ethnicity, union membership, etc.). CVs and interview content can incidentally contain it. Where they do, it is processed only to the extent necessary to generate the requested output and is not retained beyond the schedule below.

Retention (candidate data). Periods run from the date the data was collected and reflect the controller's documented instructions. Where the customer has not instructed a shorter period, the following defaults apply:

On termination of the customer agreement, all remaining candidate data is deleted or returned within 30 days.

Candidate rights. If you are a candidate, you exercise your GDPR rights (access, correction, erasure, objection) through the company that interviewed you. We assist that company in responding to such requests.

4. Account and website data (we act as a controller)

For people who sign up for or use LucraAI, and for visitors to lucraai.com, we are the controller of the following:

• Account data: name, work email, organisation, and login credentials (authentication is handled by our auth provider, Clerk).
• Usage data: records of how the product is used (e.g. features accessed, actions taken), used to operate, secure, and improve the service.
• Communications: messages you send us (e.g. support or sales enquiries).
• Website/technical data: basic server and security logs (e.g. IP address, request timestamps) generated automatically by our hosting provider, and aggregate visit analytics (Vercel Web Analytics). See Section 10.
• Early-access signups: if you join our waitlist, we collect your name, work email, and company.

Legal basis. We rely on performance of a contract (to provide accounts and the service), legitimate interests (to secure, operate, and improve the service and to respond to enquiries), and consent where required (e.g. non-essential cookies or marketing).

Retention (account/website data). We keep account data for the life of the account and delete it within 90 days of account closure, except where a longer period is required by law. Invoicing and transaction records are kept for 5 years from the end of the relevant financial year, as required by the Danish Bookkeeping Act (Bogføringsloven). Enquiry correspondence that does not lead to an account (e.g. sales or support messages) is kept for up to 12 months, then deleted. Early-access waitlist signups are kept for up to 12 months, then deleted.

5. Subprocessors

We use the following subprocessors to provide the service. All agreements below are active.

Note: Clerk processes account-holder data (the login identity of people who use LucraAI), not candidate data.

6. International transfers

Where personal data is transferred outside the EU/EEA (to Anthropic, Vercel, and Clerk in the USA), the transfer is protected by appropriate safeguards: EU Standard Contractual Clauses (Anthropic and Clerk) and EU–U.S. Data Privacy Framework certification (Vercel and Clerk). EU-region data (Neon, and Soniox interview content) is hosted within the EEA; Soniox's regional deployment keeps interview audio and transcripts within the EU for both processing and storage. Soniox is incorporated in the United States; where any personal data is processed by the US entity (for example limited operational, security, or support processing, or system/billing metadata), that transfer is protected by EU Standard Contractual Clauses, incorporated by reference in Soniox's Data Processing Agreement. Interview audio and transcripts themselves are processed within the selected EU region and do not leave it. Railway, the infrastructure provider that relays live interview audio in transit, runs that relay on EU West (Amsterdam) infrastructure; Railway Corporation itself is US-incorporated, and any processing by the US entity (for example account, billing, or operational data) is protected by EU Standard Contractual Clauses, Module Three, under Railway's Data Processing Agreement. Live interview audio passes through the EU-region relay only, is not stored, and does not leave the region.

7. Your rights

Under the GDPR you have the right to:

• Access the personal data we hold about you;
• Rectify inaccurate or incomplete data;
• Erase your data (“right to be forgotten”);
• Data portability: receive your data in a structured, commonly used, machine-readable format;
• Object to processing based on legitimate interests;
• Withdraw consent at any time where processing is based on consent (e.g. non-essential cookies or marketing), without affecting prior processing.

For account/website data (where we are the controller), contact us at privacy@lucraai.com. For candidate data (where we are the processor), contact the company that interviewed you. We will support them in responding.

You also have the right to lodge a complaint with the Danish supervisory authority, Datatilsynet (www.datatilsynet.dk).

8. Security

We protect personal data with measures including:

• Files (CVs, job descriptions) stored in private blob storage that is not publicly accessible;
• Encryption in transit (TLS) and at rest (provider-level);
• Access control on the application (authentication via our auth provider, Clerk);
• Candidate PII excluded from system telemetry and logs.

9. AI transparency and the EU AI Act

LucraAI is built GDPR by design and to be EU AI Act ready. We do not claim any certification.

• AI assists, human decides. LucraAI does not rank, score-to-decide, or filter candidates automatically. It produces information that a person reviews. The human makes every hiring decision.
• No emotion or biometric analysis. We do not perform facial, emotion, or other biometric analysis.
• AI-generated content is labelled. Content generated with AI assistance (e.g. job descriptions) is identified as such, in line with the EU AI Act's AI-generated-content transparency requirements.

10. Cookies

lucraai.com sets one strictly necessary cookie. This is the authentication session cookie used by our auth provider, Clerk, which is required for signed-in users to use the product. This cookie is exempt from cookie-consent requirements because it is essential to a service you have requested.

We measure visits to lucraai.com using Vercel Web Analytics. It does not use cookies. It identifies a visit using a one-way hash generated from the incoming request, which is discarded within 24 hours and cannot be used to track an individual visitor across sites or over time. It reports aggregated figures such as visit counts, top pages, and visitor location at country level. It does not build a profile of any individual visitor.

Because no cookie is set, this analytics use falls outside the cookie-consent rules in the ePrivacy Directive. We rely on legitimate interest (GDPR Article 6(1)(f)) as the legal basis for this minimal, aggregated processing (understanding how many people visit LucraAI and roughly where from). This disclosure satisfies the GDPR transparency requirement for that processing. No separate consent or cookie banner is required. We do not use advertising, cross-site tracking, or behavioural-profiling cookies or scripts.

11. Changes to this policy

We may update this policy from time to time. When we make material changes we will update the “Last updated” date and, where appropriate, notify account holders.

12. Contact

Lucra AI (CVR: 45943968)

privacy@lucraai.com

Supervisory authority: Datatilsynet (www.datatilsynet.dk)