Hello Lucia

Privacy Policy

Effective Date: May 6, 2026 · Last Updated: July 5, 2026

Hi — I’m Aviv Hadar. I run Lucia and this website, HelloLucia.ai, as a sole proprietorship. There’s no corporation behind the curtain: when this page says “Hello Lucia,” “Lucia,” “I,” “we,” or “me,” it all means the same thing — Aviv Hadar, sole proprietor, doing business as Hello Lucia.

Lucia helps property owners, hospitality operators, and their teams take better care of guests. That work naturally involves bookings, messages, and day-to-day property details, so I take the privacy of that information personally. This page explains what I collect, how I use it, and the choices you have — with as little legal jargon as I could manage.

If you and I have a separate written agreement (for example, a customer or data processing agreement), that agreement comes first for anything it covers.

1. Information I Collect

I collect only what’s needed to run, support, and improve Lucia.

Information You Share Directly

You might share personal information with me when you:

Give me your name, email address, or phone number
Tell me your company or property name and your role
Join the waitlist, request a demo, or reach out for onboarding or support
Send messages or fill out a form on the site
Set up an account and sign-in credentials
Share feedback, survey answers, or evaluation notes

Property and Operations Information

When Lucia is used to run a property or hospitality operation, I may process:

Property details and booking context
Guest arrival and departure information
Maintenance and concierge requests
Tasks assigned to owners or operators
Internal notes and message content
Communications via SMS, WhatsApp, or email
Images, attachments, and other media
Operational summaries, recommendations, and AI-generated responses

AI Interaction Information

To keep Lucia sharp, the service processes:

Prompts or questions submitted to Lucia
Model-generated responses and evaluation data
Quality review notes and feedback on answers
System-generated summaries, classifications, or recommendations

This information is used only to operate, improve, test, and secure Lucia. I don’t use customer operational data to train third-party foundation models unless you’ve expressly said that’s okay.

Information Collected Automatically

Like most websites, when you visit the site or use the service, some information is collected automatically:

IP address, browser type, and device type
Operating system and referring URLs
Pages visited, timestamps, and usage events
Diagnostic logs and error reports
Approximate location derived from your IP address
Data from cookies and similar technologies

2. How I Use Information

I use personal information to:

Provide, run, and improve Lucia
Respond to questions, demo requests, and support messages
Sign you in securely and keep accounts safe
Handle operational messages, tasks, requests, and property updates
Generate AI-assisted operational guidance
Test and improve the quality, safety, and reliability of Lucia
Keep an eye on performance and fix technical issues
Detect and prevent abuse, fraud, and security problems
Let you know about product updates and important service changes
Meet legal obligations
Build aggregated or de-identified analytics

In short: I use your information to run the service you asked for, and not for much else.

3. AI-Assisted Processing

Lucia uses AI to make sense of operational context and offer useful guidance. That can include:

Summarizing what’s happening at a property
Understanding what a message is asking for
Prioritizing tasks
Drafting responses for operators
Evaluating response quality
Improving reliability
Cutting down noise so people can focus on decisions that matter

AI suggestions are meant to support human decisions, not replace them. A real person stays responsible for reviewing recommendations and making the final call. AI-generated responses aren’t guaranteed to be complete, accurate, or right for every situation.

4. Guest and Operator Data

Sometimes I process personal information on behalf of a property owner or operator who uses Lucia. In those cases, they decide what data goes into Lucia and how it’s used. That can include:

Guest names and contact details
Reservation information and context
Arrival and departure notes
Maintenance and concierge requests
Communications involving staff, owners, or vendors

If a property owner or operator submitted your information to Lucia and you want to exercise your privacy rights, please reach out to them first — and I’ll help them respond however I can.

5. When Information Is Shared

I don’t pass your information around. It’s shared only in these situations:

Service Providers

I rely on trusted service providers to host, secure, and run Lucia, including:

Application hosting, databases, and storage
Security, authentication, and error monitoring
AI model execution
Routing for SMS, WhatsApp, and email
Analytics and product diagnostics

These providers can only use your information to do their job for Lucia, and they’re bound by confidentiality and security obligations.

People You or Your Property Authorize

Information may be shared with integrations, vendors, property teams, or other recipients a customer authorizes — like a maintenance vendor or concierge partner.

Legal and Safety Situations

I may disclose personal information if I believe in good faith it’s necessary to:

Comply with applicable law, regulation, subpoena, or court order
Protect the rights, property, or safety of Lucia’s users, guests, customers, or others
Investigate or prevent security incidents, fraud, or misuse
Enforce agreements and policies

If the Business Ever Changes Hands

If I ever sell or transfer the Lucia business, your information would transfer with it — with the same privacy commitments intact, and with an update to this page so you know.

6. Selling or Sharing Personal Information

I do not sell personal information. I also don’t share personal information for cross-context behavioral advertising as defined by California law. If that ever changes, I’ll update this Privacy Policy and give you every choice the law requires.

7. SMS Privacy Notice

For this A2P SMS campaign, messages are sent by Aviv Hadar, sole proprietor. Mobile phone numbers and SMS opt-in consent are used only to send operational support messages related to stays, property requests, concierge coordination, and maintenance issues. SMS opt-in consent and mobile information are not sold, rented, or shared with third parties or affiliates for marketing or promotional purposes. Reply STOP at any time to opt out, or HELP for help.

8. Cookies and Similar Technologies

The site uses cookies, pixels, local storage, and similar technologies to:

Keep the website running smoothly
Remember your preferences
Keep sessions secure
Understand site traffic and usage trends
Improve your experience
Diagnose technical issues
Measure performance and improve the product

You can manage cookies in your browser settings — just know that some features may not work quite right with cookies turned off.

9. How Long I Keep Information

I keep personal information only as long as it’s reasonably needed for things like:

Delivering the service and maintaining accounts
Keeping historical operation records
Legal compliance
Resolving disputes
Enforcing agreements
Security and audit records
Quality and reliability improvements

How long that is depends on the type of data, any contract terms, legal obligations, and operational needs. When data is no longer needed, it gets deleted, de-identified, or aggregated where practical.

10. Security

I use administrative, technical, and organizational safeguards to protect your information — things like access and authentication controls, logging, monitoring, and secure hosting. No system is perfect, but I protect information in line with how sensitive it is.

11. Where Information Is Processed

I’m based in the United States, and information may be processed in the United States and in other places where my service providers operate. If you use Lucia from outside the U.S., your information may be transferred to, stored in, or processed in countries with different data protection standards. Where the law requires it, I rely on legally recognized safeguards for those transfers.

12. Your Privacy Rights

Depending on where you live, you may have the right to:

Access the personal information I hold about you
Correct inaccurate or incomplete information
Ask me to delete your personal information
Request a copy or transfer of your data
Object to or restrict certain types of processing
Opt out of marketing communications
Opt out of the sale or sharing of personal information, where applicable
Limit the use of sensitive personal data, where applicable
Appeal a denied privacy request, as provided by law

To exercise any of these rights, email me at [email protected]. I may need to verify your identity first. You’ll never be treated differently for exercising your privacy rights.

13. California Privacy Notice

This section is for California residents, as required by the California Consumer Privacy Act (CCPA).

Categories of Personal Information Collected

Identifiers: Name, email, phone number, IP address — used for account setup, communication, authentication, and support
Customer records: Contact and account details — for service delivery and compliance
Commercial information: Demo requests, customer relationship details, product usage context — for onboarding and service delivery
Internet or network activity: Device type, browser data, usage logs — for security, analysis, and service improvement
Geolocation data: Location approximated from IP address — for security and localization
Audio, visual, or electronic information: Messages, images, or attachments — for operational workflows
Professional or employment information: Company or role details — for account management
Inferences: Product usage and operational summaries — for AI-assisted operational guidance
Sensitive personal information: Only if you volunteer it during operational communications — used for the services you asked for, safety, and context

I don’t use sensitive personal information to infer characteristics about you.

Sources of Personal Information

Personal information may come from:

You directly
Customers and their authorized users
Property operators, guests, or vendors interacting via connected channels
Service providers and authorized integrations
Automated website and platform technologies

Disclosure of Personal Information

The categories above may be shared with service providers, customer-authorized recipients, professional advisers, or legal authorities, as described in this Policy.

California Rights

Under California law, residents may have the right to:

Know what personal information is collected, used, disclosed, sold, or shared
Access their personal information
Delete certain personal information
Correct inaccurate data
Opt out of the sale or sharing of personal information
Limit the use of sensitive personal information
Exercise these rights without discrimination

To repeat the important part: I don’t sell personal information or share it for cross-context behavioral advertising.

14. European Economic Area, United Kingdom, and Similar Regions

If you’re in the EEA, United Kingdom, Switzerland, or another region with similar data protection rules, the legal bases for processing your personal information include:

Performance of a contract with you or your organization
Legitimate interests, such as running the service, improving reliability, and keeping things secure
Your consent, where applicable
Compliance with legal obligations
Protection of vital interests, when appropriate

You can request access, correction, deletion, restriction, or objection to processing, as well as portability of your personal data. You can also lodge a complaint with your local data protection authority.

15. Marketing Communications

If you request information, join the waitlist, or chat with me, you may occasionally receive marketing emails. You can opt out any time using the unsubscribe link or by emailing me directly. I may still send non-marketing messages about your account or the service — the important stuff.

16. Children’s Privacy

Lucia isn’t directed at children under 13, and I don’t knowingly collect personal information from children under 13. If I learn that’s happened without proper consent, I’ll delete it promptly.

17. Third-Party Websites and Services

The site may link to third-party websites, platforms, or integrations. I’m not responsible for their privacy practices, so please review their policies before sharing personal information with them.

18. Changes to This Privacy Policy

I may update this Privacy Policy from time to time. Updates get posted here with the “Last Updated” date above, and where the law requires it, I’ll give additional notice of material changes. Continuing to use the site or service after an update means you’ve seen the revised Policy.

19. Contact Me

For any privacy questions, or to exercise your rights:

Aviv Hadar
Sole Proprietor, doing business as Hello Lucia
Email: [email protected]