Privacy Policy
Version 1.5, July 2026.This policy reflects LucraAI's current data processing practices and is consistent with the candidate information notice and the Data Processing Agreement issued by Human AI Partners.
Last updated: July 2026
1. Who we are
LucraAI is an AI-assisted hiring co-pilot operated by Human AI Partners(CVR: 45943968), a Danish personally owned small business (Personligt ejet Mindre Virksomhed, PMV). “LucraAI”, “we”, “us” and “our” in this policy refer to Human AI Partners as the operator of the LucraAI platform at lucraai.com.
- Operator: Human AI Partners, CVR 45943968
- Website: lucraai.com
- Contact: vytautas.tamulevicius@lucraai.com
2. Our two roles, and what this policy covers
LucraAI handles personal data in two distinct roles, and your rights and our responsibilities differ depending on which applies.
As a data processor (candidate data). When a hiring company uses LucraAI to evaluate its candidates, that company decides why and how the candidate data is used. The company is the data controller. We process candidate data only on that company's documented instructions, under a Data Processing Agreement. We do not decide how candidate data is used and we do not use it for our own purposes. If you are a candidate, the controller of your data is the company interviewing you. They provide you with a separate candidate information notice, and you exercise your rights through them (we assist them in responding). Section 3 describes this processing.
As a data controller (account holders and website visitors). When you create or use a LucraAI account, or visit lucraai.com, we determine how that account and website data is handled. For this data we are the controller, and this policy is your primary notice under GDPR Articles 13–14. Section 4 describes this.
3. Candidate personal data (we act as a processor)
When a customer uses LucraAI to support hiring, we process the following candidate data on the customer's behalf:
- Candidate name and contact details
- CV contents
- Interview transcript contents
- Job description contents (the customer's own documents)
What we do with it. We generate structured post-interview evaluation reports, pre-interview question sets, and job descriptions. These outputs are provided to the customer for its own hiring decisions.
Who records vs. who processes. LucraAI does not capture or record live audio. The customer records and transcribes interviews using its own meeting platform (e.g. Microsoft Teams or Zoom). LucraAI processes the written transcript the customer provides, together with the CV.
Human decides. All hiring decisions are made by a person at the customer. LucraAI provides information, not decisions. A candidate can request human review of any AI-assisted assessment.
No model training. Candidate data is never used to train AI models, not by us and not by our AI subprocessor.
Special-category data. We do not intentionally collect special-category data (health, religion, ethnicity, union membership, etc.). CVs and transcripts can incidentally contain it. Where they do, it is processed only to the extent necessary to generate the requested output and is not retained beyond the schedule below.
Retention (candidate data).Periods run from the date the data was collected and reflect the controller's documented instructions. Where the customer has not instructed a shorter period, the following defaults apply:
| Data | Retention |
|---|---|
| Evaluation reports | Up to 12 months, then deleted |
| Raw interview transcripts | Deleted within 30 days |
| CVs | Up to 6 months from collection, then deleted, unless the customer instructs an earlier deletion. Retained as part of the customer's recruitment records. |
On termination of the customer agreement, all remaining candidate data is deleted or returned within 30 days.
Candidate rights. If you are a candidate, you exercise your GDPR rights (access, correction, erasure, objection) through the company that interviewed you. We assist that company in responding to such requests.
4. Account and website data (we act as a controller)
For people who sign up for or use LucraAI, and for visitors to lucraai.com, we are the controller of the following:
- Account data: name, work email, organisation, and login credentials (authentication is handled by our auth provider, Clerk).
- Usage data: records of how the product is used (e.g. features accessed, actions taken), used to operate, secure, and improve the service.
- Communications: messages you send us (e.g. support or sales enquiries).
- Website/technical data: basic server and security logs (e.g. IP address, request timestamps) generated automatically by our hosting provider, and aggregate visit analytics (Vercel Web Analytics). See Section 10.
Legal basis. We rely on performance of a contract (to provide accounts and the service), legitimate interests (to secure, operate, and improve the service and to respond to enquiries), and consent where required (e.g. non-essential cookies or marketing).
Retention (account/website data).We keep account data for the life of the account and delete it within 90 days of account closure, except where a longer period is required by law. Invoicing and transaction records are kept for 5 years from the end of the relevant financial year, as required by the Danish Bookkeeping Act (Bogføringsloven). Enquiry correspondence that does not lead to an account (e.g. sales or support messages) is kept for up to 12 months, then deleted.
5. Subprocessors
We use the following subprocessors to provide the service. All four agreements below are active.
| Subprocessor | Purpose | Location & safeguards |
|---|---|---|
| Anthropic | AI processing | USA — transferred under EU Standard Contractual Clauses. The commercial API does not use customer data to train AI models |
| Neon (database) | Database hosting | EU (eu-central-1) — covered by Databricks DPA v3, which includes EU SCCs |
| Vercel | Hosting, file storage, and privacy-friendly web analytics | USA — EU–U.S. Data Privacy Framework certified. Model training is disabled for this account |
| Clerk | Authentication / account-holder identity | USA — transferred under Clerk's Data Processing Addendum, which incorporates EU Standard Contractual Clauses (Modules 1–3). Clerk is also self-certified under the EU–U.S. Data Privacy Framework |
Note: Clerk processes account-holder data (the login identity of people who use LucraAI), not candidate data.
6. International transfers
Where personal data is transferred outside the EU/EEA (to Anthropic, Vercel, and Clerk in the USA), the transfer is protected by appropriate safeguards: EU Standard Contractual Clauses (Anthropic and Clerk) and EU–U.S. Data Privacy Framework certification (Vercel and Clerk). EU-region data (Neon) is hosted within the EEA.
7. Your rights
Under the GDPR you have the right to:
- Access the personal data we hold about you;
- Rectify inaccurate or incomplete data;
- Eraseyour data (“right to be forgotten”);
- Data portability: receive your data in a structured, commonly used, machine-readable format;
- Object to processing based on legitimate interests;
- Withdraw consent at any time where processing is based on consent (e.g. non-essential cookies or marketing), without affecting prior processing.
For account/website data (where we are the controller), contact us at vytautas.tamulevicius@lucraai.com. For candidate data (where we are the processor), contact the company that interviewed you. We will support them in responding.
You also have the right to lodge a complaint with the Danish supervisory authority, Datatilsynet (www.datatilsynet.dk).
8. Security
We protect personal data with measures including:
- Files (CVs, job descriptions) stored in private blob storage that is not publicly accessible;
- Encryption in transit (TLS) and at rest (provider-level);
- Access control on the application (authentication via our auth provider, Clerk);
- Candidate PII excluded from system telemetry and logs.
9. AI transparency and the EU AI Act
LucraAI is built GDPR by design and to be EU AI Act ready. We do not claim any certification.
- AI assists, human decides. LucraAI does not rank, score-to-decide, or filter candidates automatically. It produces information that a person reviews. The human makes every hiring decision.
- No emotion or biometric analysis. We do not perform facial, emotion, or other biometric analysis.
- AI-generated content is labelled.Content generated with AI assistance (e.g. job descriptions) is identified as such, in line with the EU AI Act's AI-generated-content transparency requirements.
10. Cookies
lucraai.com sets one strictly necessary cookie. This is the authentication session cookie used by our auth provider, Clerk, which is required for signed-in users to use the product. This cookie is exempt from cookie-consent requirements because it is essential to a service you have requested.
We measure visits to lucraai.com using Vercel Web Analytics. It does not use cookies. It identifies a visit using a one-way hash generated from the incoming request, which is discarded within 24 hours and cannot be used to track an individual visitor across sites or over time. It reports aggregated figures such as visit counts, top pages, and visitor location at country level. It does not build a profile of any individual visitor.
Because no cookie is set, this analytics use falls outside the cookie-consent rules in the ePrivacy Directive. We rely on legitimate interest (GDPR Article 6(1)(f)) as the legal basis for this minimal, aggregated processing (understanding how many people visit LucraAI and roughly where from). This disclosure satisfies the GDPR transparency requirement for that processing. No separate consent or cookie banner is required. We do not use advertising, cross-site tracking, or behavioural-profiling cookies or scripts.
11. Changes to this policy
We may update this policy from time to time. When we make material changes we will update the “Last updated” date and, where appropriate, notify account holders.
12. Contact
Human AI Partners (CVR: 45943968), operator of LucraAI
vytautas.tamulevicius@lucraai.com
Supervisory authority: Datatilsynet (www.datatilsynet.dk)