Privacy Policy

This Privacy Policy is provided by Lucas Intelligence, Inc., a Delaware corporation located at 1111b S Governors Avenue, STE 53983, Dover, DE 19904, United States ("we", "us", "our", or "Sones"). Lucas Intelligence, Inc. is the data controller responsible for your personal data.

Sones is a consumer AI assistant that works through messaging channels such as iMessage, WhatsApp, and SMS, plus our web app. Sones helps you manage messages, email, calendar, reminders, connected apps, personal memory, and natural-language automations. This Privacy Policy applies when you use our websites, apps, messaging experiences, integrations, automations, and other services that link to this Privacy Policy (together, the "Service").

This Privacy Policy does not address our privacy practices for job applicants, employees, contractors, or other employment-related individuals. It also does not apply to third-party websites, apps, or services that have their own privacy policies.

Google API Services Disclosure

Sones uses Google API Services to provide Gmail, Calendar, Contacts, Drive, Docs, Sheets, Slides, Tasks, and account-sign-in features when you choose to connect a Google account. This section describes how we access, use, store, and share information obtained from Google APIs.

Data We Access from Google APIs:

• Gmail API: Email messages, metadata (sender, recipient, subject, date), labels, attachments, filters, send-as identities, and vacation settings when you connect Gmail.
• Google Calendar API: Calendar events, event details (title, time, location, attendees), calendar metadata, settings, and sharing permissions for scheduling and calendar management.
• Google Drive API: File and folder names, contents, metadata, sharing permissions, comments, replies, and revisions for finding and managing files you can access.
• Google Docs API: Document text, formatting, tables, embedded objects, and revision information for reading, creating, editing, and monitoring documents you select.
• Google Sheets API: Spreadsheet and sheet metadata, cell values, formulas, formatting, and charts for reading, creating, and updating spreadsheets.
• Google Slides API: Presentation and slide metadata, text, objects, images, layouts, and formatting for reading, creating, and editing presentations.
• Google Tasks API: Task lists, task titles, notes, dates, completion status, and ordering for managing your tasks.
• Google Contacts API (People API): Contact names, email addresses, and related contact details so Sones can resolve recipients and attendees when you ask it to compose emails or schedule meetings by name.
• Google Profile: Your name, email address, and basic profile information provided during sign-in so we can create, authenticate, and maintain your account.

Access depends on the permissions you grant and your existing Google file and account permissions. Depending on the features you enable, Sones can access existing and historical data available through these APIs. New permissions require your authorization before use.

How We Use Google User Data:

• To analyze, organize, summarize, draft, search, and triage email messages when you request those features.
• To manage email labels, filters, vacation replies, archiving, Trash, and permanent deletion when you request or authorize those actions.
• To classify communications, identify important updates, generate briefings and summaries, extract deadlines, and surface information you ask Sones to find.
• To display, schedule, update, and manage calendar events, reminders, calendars, subscriptions, and sharing permissions.
• To send emails or calendar invitations on your behalf when you explicitly initiate or authorize those actions.
• To resolve recipient and attendee details when you ask Sones to contact someone or schedule with them.
• To find, read, create, edit, organize, copy, export, download, share, or delete Drive files and folders at your direction.
• To create and edit Docs, update spreadsheet values and formatting, and create and edit presentations for your requested tasks.
• To create, edit, complete, move, and delete tasks and task lists at your direction.
• To provide notifications, reminders, automations, and follow-ups based on your instructions and preferences, including monitoring document changes when you enable that feature.

Data Storage and Retention:

• We require encryption in transit and at rest for Google user data, including data held by our infrastructure providers.
• We retain Google user data only as long as necessary to provide the user-facing features you request, maintain security, comply with law, or resolve disputes.
• We can store Google source content, metadata, and synchronization records when needed for features you enable. These features include search, briefings, reminders, automations, summaries, memory, and document-change monitoring.
• Disconnecting a Google service stops new access, synchronization, and connected actions for that service. For Google Workspace connections managed through sones.ai, stored integration source records immediately become unavailable to Sones for new source queries and actions. We retain those hidden records until you delete your Sones account or request earlier deletion. Disconnecting one service leaves other connected services active.
• Disconnecting does not erase information already included in your conversation, saved summaries, memory, or downloaded files. These copies remain subject to the relevant deletion controls and this policy. Disconnecting Sones does not delete your original emails, documents, or other records held by Google.
• You can request deletion of your Google user data at any time by contacting privacy@meetlucas.ai. Disconnecting a service is separate from requesting deletion. Account deletion blocks further access and starts deletion processing. Removal from active systems and backups can take time, subject to legal, security, and backup requirements.

Data Sharing:

• We do not sell, rent, or lease Google user data to third parties.
• We share Google user data only with service providers necessary to provide or improve the user-facing features you request, such as cloud hosting, database, error monitoring, and analytics providers. These providers are bound by confidentiality and data protection obligations.
• We do not use Google user data for advertising purposes or share it with advertisers.

Limited Use Disclosure:

Sones's use and transfer of information received from Google APIs to any other app will adhere to the Google API Services User Data Policy, including the Limited Use requirements.

Google User Data Compliance Commitments

The commitments in this section apply to all data received through Google API Services, including any derived, aggregated, or anonymized data. If any other section of this Privacy Policy is broader, this section controls for Google user data.

• We only use Google user data to provide or improve user-facing features that are visible and prominent in Sones.
• We do not use Google user data to train generalized artificial intelligence or machine learning models.
• We do not use Google user data for targeted, personalized, retargeted, or interest-based advertising.
• We do not sell Google user data and do not transfer it to data brokers, information resellers, or advertising platforms.
• We do not use Google user data for lending purposes or to determine credit-worthiness.
• We limit transfers of Google user data to: (a) service providers acting on our behalf to provide or improve the user-facing features you request, such as cloud hosting, database, error monitoring, and analytics providers; (b) legal compliance; (c) security and abuse prevention; and (d) merger, acquisition, or sale-of-assets transfers only after we obtain your explicit prior consent where required by the Google API Services User Data Policy.
• We do not allow human review of Google user data except when you provide explicit affirmative agreement for a specific support request and specific messages, files, events, or data; when necessary for security and abuse prevention; when necessary to comply with law; or for aggregated internal operations permitted by applicable law.

If we change how we access, use, store, or share Google user data, we will update this Privacy Policy, notify affected users, and obtain affirmative consent before the new use begins where required.

Disconnecting and Revoking Access:

You can stop Sones from accessing a connected Google service by disconnecting it through the available account controls or asking Sones to disconnect it. You can disconnect all services for a Google account together. You can also:

• Revoke permissions directly at Google by visiting your Google Account permissions page and removing Sones.
• Contact us at privacy@meetlucas.ai to request account disconnection.

Disconnecting through Sones is separate from removing its permissions in your Google Account. If you revoke access at Google, Sones cannot make new authorized API requests with that grant. Revocation does not itself delete information Sones already received; the retention and deletion rules above still apply.

Our Collection and Use of Personal Data

The categories of personal data we collect depend on how you use Sones, which channels you use to message us, and which connected accounts or integrations you enable. We collect personal data directly from you, automatically through the Service, and from third-party services you connect or interact with through Sones.

Personal Data Provided by Individuals

We collect the following categories of personal data individuals provide to us:

Contact Information, including name, phone number, email address, mailing address, and communication preferences. We use this information to create and maintain your account, communicate with you, provide support, send service-related messages, and send marketing communications in accordance with your preferences.

Account and Profile Information, including your name, email address, phone number, account credentials, one-time passcodes, time zone, country or region, plan or subscription details, settings, privacy choices, and preferences. We use this information to administer your account, authenticate you, personalize Sones, operate billing where applicable, and provide support.

Assistant Messages and Content, including messages, prompts, instructions, replies, drafts, files, links, images, audio, voice notes, transcripts, documents, tasks, reminders, automations, and other content you send to Sones or ask Sones to process. We use this information to understand your requests, generate responses, complete tasks, maintain context, and provide the assistant features you use.

Memory and Preference Information, including saved facts, recurring routines, preferences, relationships, priorities, instructions, and other context Sones stores so it can personalize responses and proactively help you over time.

Connected Account and Integration Data, including data from Gmail, Google Calendar, Google Contacts, Google Drive, Google Docs, Google Sheets, Google Slides, Google Tasks, Outlook, Superhuman, Notion, Slack, GitHub, Mercury, Vercel, Strava, WHOOP, and other services you choose to connect. Depending on the integration, this may include email content and metadata, calendar events, contacts, account profile data, files, document content, spreadsheet data, presentations, sharing permissions, comments, revisions, task records, repository or deployment information, health and fitness metrics, transactions, notes, or other information made available by that integration. We use this information only as needed to provide the features, automations, and actions you request.

Messaging Channel Information, including your phone number, messaging handle, delivery status, inbound and outbound message metadata, and channel identifiers associated with iMessage, WhatsApp, SMS, or other messaging services. We use this information to send, receive, route, troubleshoot, and secure Sones messages.

Sensitive Information, including any sensitive personal data that may appear in your messages, files, connected accounts, or requested tasks, such as health, financial, location, biometric, relationship, or other sensitive information. Sones does not require you to provide sensitive information unless it is necessary for a task you choose to request. We use sensitive information only to provide the Service, protect security, comply with law, or as otherwise permitted by your instructions. Where you choose to connect an integration that exposes health, biometric, or other special category data under GDPR Article 9 (such as a fitness tracker like WHOOP or Strava), connecting that integration constitutes your explicit consent under Article 9(2)(a) for us to process that data for the features you request.

Payment Information, including billing address, subscription details, payment status, and payment method identifiers. We use third-party payment providers, including Stripe, to process payments. We do not store full payment card numbers; payment providers process that information under their own privacy notices.

Feedback and Support Information, including support tickets, emails, chat messages, call recordings where permitted by law, bug reports, survey responses, and other information you provide when you contact us. We use this information to respond to you, diagnose issues, improve Sones, and maintain safety and quality.

Personal Data Automatically Collected

We and our service providers automatically collect information when you access our websites, web app, messaging experiences, and related services. We may use cookies, pixels, SDKs, local storage, logs, and similar technologies to collect this information.

Device and Network Information, including device type, manufacturer, model, operating system, IP address, browser type, Internet service provider, mobile carrier, language settings, unique identifiers, and approximate location derived from IP address.

Usage, Log, and Diagnostic Information, including pages viewed, features used, buttons clicked, referral URLs, timestamps, message delivery events, automation execution logs, integration connection status, error reports, crash data, performance metrics, and security logs.

Analytics and Attribution Information, including marketing source, campaign parameters, cookie preferences, and product analytics events. We use this information to understand how people find Sones, measure product performance, improve onboarding, debug issues, and evaluate the effectiveness of marketing.

Automatic data collection helps us operate and improve Sones, maintain security, remember preferences, troubleshoot technology problems, understand aggregate usage, and provide relevant product and marketing experiences. This website and app analytics discussion does not apply to Google user data obtained through Google API Services, which is governed by the Google sections above.

Personal Data from Other Sources and Third Parties

We may receive the categories of personal data described above from the following sources:

Connected Accounts and Integrations: When you connect a third-party account, we receive data and authorization tokens needed to provide the integration features you request. This may include Google, Microsoft, Superhuman, Notion, Slack, GitHub, Mercury, Vercel, Strava, WHOOP, and other connected services.

Notion: When you connect a Notion workspace, Notion lets you choose which pages and databases Sones can access. Sones can search and read those pages, databases, comments, and files, along with basic information about workspace members, such as names and, where Notion provides them, email addresses. At your request, Sones can create, update, move, archive, and restore pages; create and update databases and their entries; add, edit, and delete content and comments; and upload files to the pages you share. Sones cannot reach pages you do not share with it. We store the Notion authorization tokens encrypted. You can disconnect Notion at any time in your Sones account or in your Notion connection settings.

Slack: When you connect Slack, Sones gets access through your own Slack account. Sones can search and read the messages, channels, direct messages, members, files, canvases, pins, and reminders you can see, including members' names and, where Slack provides them, email addresses. At your request, Sones can send, edit, and delete your messages; add and remove reactions; pin and unpin messages; create and update canvases; and set reminders. Connecting Slack also adds the Sones app to that workspace. Sones receives messages people send to the app, or post where it was added, including coworkers who do not use Sones. It replies as the app. We store the Slack authorization tokens encrypted. You can disconnect Slack at any time in your Sones account or in your Slack settings.

GitHub: When you connect GitHub, Sones gets access through your own GitHub account, to the repositories you can reach, including private repositories and those of organizations that allow it. Sones can list and read your repositories, their files, issues, and pull requests, and search their code, along with your GitHub username and, where you make it public, your email address. At your request, Sones can create issues, comment on issues and pull requests, and open pull requests. We store the GitHub authorization tokens encrypted. You can disconnect GitHub at any time in your Sones account or in your GitHub settings.

Messaging Platforms and Communications Providers: We may receive message content, delivery data, phone numbers, channel identifiers, and related metadata from messaging platforms and telecommunications providers that help deliver Sones through iMessage, WhatsApp, SMS, or similar channels.

Single Sign-On Providers: If you log in through a third-party account, such as Google or Microsoft, we receive authentication tokens and profile information needed to identify your account. We do not receive your password for those services.

Other Users and Contacts: Other people may provide information about you when they message Sones, include you in a task, invite you to a meeting, send you an email, share a document, or ask Sones to contact you.

Service Providers and Partners: Our service providers and partners may provide analytics, attribution, payment, fraud prevention, support, and operational information.

Public Sources and Social Media: We may receive information from public sources or social media when you interact with Sones or our content, depending on your settings with those services.

Inferences: We may generate inferences about your preferences, routines, priorities, likely task context, and assistant needs based on the information you provide and the ways you use Sones.

Additional Uses of Personal Data

In addition to the specific purposes above, we may use personal data to:

• Provide, maintain, personalize, and improve Sones and the features you request.
• Send, receive, draft, summarize, route, and manage messages, emails, reminders, calendar events, and app actions.
• Create and maintain your account, verify your identity, and authenticate sign-ins.
• Operate natural-language automations and perform actions you authorize.
• Store and apply memory, preferences, and context so Sones can help you consistently over time.
• Process payments, subscriptions, invoices, account credits, and customer support requests.
• Communicate with you by email, text message, messaging platform, phone, or other channels about your account, the Service, support, security, and marketing where permitted.
• Monitor, troubleshoot, test, secure, and debug the Service.
• Detect, prevent, investigate, or provide notice of security incidents, spam, abuse, fraud, or illegal activity.
• Conduct analytics, research, and product improvement, including de-identified or aggregated analysis and the training described in "AI Training and Data Usage Preferences" below, subject to the Google user data limits described above.
• Create aggregated or de-identified information that cannot reasonably be used to identify you, except that Google user data and data derived from Google user data remain subject to the Google API Services User Data Policy.
• Defend, protect, or enforce our rights, terms, contracts, and policies, resolve disputes, and comply with legal obligations.
• Facilitate business transactions, reorganizations, financing, mergers, acquisitions, or sale of assets, subject to the Google user data restrictions described above.
• Fulfill any other purpose for which you provide personal data or give consent.

Our Disclosure of Personal Data

We disclose or otherwise make personal data available in the following ways. For clarity, Google user data obtained via Google API Services is shared only as described in the Google API Services Disclosure and Google User Data Compliance Commitments sections above.

Messaging Platforms and Communications Providers: We disclose message content, phone numbers, delivery data, and related metadata to providers that deliver Sones through iMessage, WhatsApp, SMS, or similar channels. Your use of those channels is also subject to the terms and privacy practices of the platform or carrier involved.

Third Parties You Direct Us to Contact or Use: When you ask Sones to send an email, create a calendar event, message someone, update an app, create a task, or perform a similar action, we disclose the information needed to complete that action to the relevant recipient, app, account, or service.

Service Providers: We engage service providers to host infrastructure, store data, manage databases, provide authentication, process payments, deliver messages, provide analytics, monitor errors, prevent abuse, and support customers. For example, Stripe processes payments. Sones connects to third-party apps such as Google, Microsoft, and other services you choose to link through direct integrations with those providers, not through an intermediary.

AI Infrastructure Providers: We use third-party AI services, such as OpenAI, Anthropic, Google, and similar providers, to interpret requests, generate responses, summarize content, reason about tasks, and operate assistant features. We require these providers to process your content only to provide services to Sones. They are prohibited from using your content to train their own models. These restrictions also apply to Google user data and data derived from it. Google user data remains subject to the Google commitments above.

Analytics and Marketing Providers: We may disclose website and product interaction data to analytics, measurement, and marketing providers, such as Meta, to understand product usage, measure campaigns, and improve Sones. These practices do not use Google user data obtained via Google API Services.

Business Transactions or Reorganizations: We may disclose, transfer, or assign personal data in connection with a merger, acquisition, financing, reorganization, bankruptcy, receivership, or sale of assets. Any transfer of Google user data in connection with a business transaction will comply with the Google API Services User Data Policy.

Legal, Safety, and Rights Protection: We may disclose personal data to legal advisors, law enforcement, regulators, courts, or other third parties when we believe disclosure is necessary to comply with law, respond to lawful requests, protect rights and property, enforce agreements, prevent fraud, investigate abuse, protect safety, or defend legal claims.

With Your Consent or Direction: We may disclose personal data with other third parties when you consent or direct us to do so, such as when you authorize an integration, request a task, or permit us to share a testimonial.

Data Retention

We retain personal data for as long as reasonably necessary to provide the Service, maintain your account, operate memory and automations, comply with law, resolve disputes, enforce agreements, maintain security, and improve Sones. Retention periods vary depending on the type of data, the feature involved, your settings, whether your account remains active, legal requirements, and operational needs.

Disconnecting an integration or revoking its permissions stops new access; it does not itself request deletion of stored data. Google source records follow the disconnect and retention rules in the Google API Services Disclosure above.

When you delete your account, delete memory, or request deletion, we initiate deletion or de-identification from active systems as soon as reasonably practicable, subject to legal, security, backup, fraud-prevention, dispute, and accounting requirements. Residual copies may remain in encrypted backups until overwritten through our normal backup lifecycle.

Your Privacy Choices

Communication Preferences

Email Communication Preferences: You can stop receiving promotional email communications from us by clicking the unsubscribe link in those emails. You may still receive service-related emails, such as account, security, billing, transactional, or support messages.

Messaging Preferences: Sones works through messaging channels. You can control whether Sones may send proactive and transactional assistant messages in your account settings where that control is available. You can also reply STOP to promotional text messages where supported, block a WhatsApp conversation, adjust your device or messaging-app settings, or contact us for help.

Push Notification Preferences: If we provide push notifications, you can change notification preferences in your device settings or in the applicable app settings.

Account, Connected App, and Google Access Choices

You can update account details and manage available privacy settings in your Sones account. You can disconnect connected accounts and integrations through Sones settings where available or through the third-party service directly. For Google connections, you can also visit your Google Account permissions page to remove Sones.

Disconnecting an integration stops new access and connected actions for that integration. It does not erase previously processed data or data stored by the third-party provider. For Google connections, the Google API Services Disclosure above explains which source records become unavailable and which copies remain. You can separately request deletion of Sones-side integration data by contacting privacy@meetlucas.ai.

AI Training and Data Usage Preferences

Google user data: Google user data obtained through Google API Services is never used to train generalized AI or machine learning models, regardless of other settings, and remains subject to the Google User Data Compliance Commitments above.

Third-party AI providers: We use third-party AI providers to process your messages and generate responses. Those providers are prohibited from using your content to train their own models, including Google user data and data derived from it.

Sones product improvement: We may use your messages and other User Content as training data, only in research whose sole purpose is to improve Sones for everyone. We take steps to protect your privacy when we do. We do not use data that Sones indexes from your connected services, such as email, calendar events, and documents, to train AI or machine learning models. For non-Google data, we may also use de-identified or aggregated information that cannot reasonably be linked back to you to operate the Service, prevent abuse, and improve reliability.

Your choice: You can opt out of training at any time. Turn off "Improve Sones for everyone" on the Preferences page of your account. The setting is on by default. Turning it off stops future training use of your data and does not delete stored data. You may also contact privacy@meetlucas.ai with "AI Training Opt-Out" in the subject line if you would like additional restrictions on how your data is used.

Withdrawing Your Consent

Where we rely on consent to process personal data, you may withdraw that consent by using available product controls, following the instructions provided when consent was requested, disconnecting the relevant integration, or contacting us. Withdrawing consent does not affect processing that occurred before withdrawal or processing based on another lawful basis.

Automatic Data Collection Preferences

You may be able to restrict cookies, pixels, and similar technologies through browser settings, device settings, cookie banners, and third-party tools. If you reject optional analytics cookies, essential cookies and limited cookieless analytics may still run so we can keep the Service secure, understand basic usage, and maintain functionality. Blocking these technologies may cause some features to work improperly.

Targeted Advertising Preferences

We may use advertising or measurement technologies on our websites to understand campaigns and show or measure relevant ads. These practices do not use Google user data obtained via Google API Services. We do not sell personal data for money. Some laws may define certain advertising or measurement practices as "sharing" or targeted advertising; you can contact us to exercise applicable opt-out rights and can use browser, device, platform, or industry opt-out tools.

You may be able to exercise additional control through the Digital Advertising Alliance at https://optout.aboutads.info/, the Network Advertising Initiative at https://optout.networkadvertising.org/, and mobile platform ad settings. Opt-outs may need to be set on each browser or device and may not apply to all advertising or analytics partners.

Modifying or Deleting Your Personal Data

You can access, update, export, or delete certain account information in your Sones account where those tools are available. You can also contact us using the details below to request access, correction, deletion, portability, restriction, objection, or other privacy rights available under applicable law. We may need to verify your identity before acting on a request, and we may not be able to fulfill every request in all circumstances.

Partner-Specific Preferences

Meta Pixel: We may use Meta Pixel for marketing attribution and campaign measurement on our public website. You can manage Meta ad preferences through Meta and can use browser, device, and industry opt-out tools where available. Meta Pixel does not receive Google user data obtained via Google API Services.

WhatsApp: If you use Sones through WhatsApp, message delivery and related platform data are processed through WhatsApp and are subject to WhatsApp's terms and privacy practices. You can block or mute Sones in WhatsApp or contact us for help with account messaging preferences.

Children's Privacy

Sones is a general consumer assistant and is not directed to children under 13. We do not knowingly collect personal data from children under 13. If you believe a child under 13 has provided personal data to us, please contact us at privacy@meetlucas.ai. If we learn that we have collected personal data from a child under 13 without appropriate consent, we will take reasonable steps to delete it. If you are located in the European Economic Area, United Kingdom, or Switzerland, the minimum age to use Sones is 16, unless your country has set a lower age under GDPR Article 8 (in which case the lower age applies).

Automated Processing

Sones uses automated systems, including AI models, to understand your messages, generate responses, summarize information, classify content, suggest actions, run automations, personalize memory, and help complete the tasks you request. These systems may create inferences about your preferences, routines, priorities, and task context.

We do not use Sones to make solely automated decisions that produce legal or similarly significant effects, such as decisions about credit, employment, housing, insurance, or eligibility for public benefits. Sones may still make mistakes, and you should review important outputs before relying on them or sending them to others.

Security of Personal Data

We use reasonable technical, administrative, and organizational safeguards designed to protect personal data, including access controls, encryption, monitoring, logging, token-management practices, and incident response processes. No security measure is perfect, and we cannot guarantee that personal data will never be accessed, disclosed, altered, or destroyed without authorization.

Third-Party Websites and Services

Our websites and services may link to or integrate with third-party websites, apps, plug-ins, platforms, messaging services, and other services. This Privacy Policy does not apply to those third parties. Their privacy practices are governed by their own policies and terms.

Region-Specific Disclosures

We may choose or be required by law to provide different or additional disclosures for residents of certain countries, regions, or states.

European Economic Area, United Kingdom, and Switzerland: If you are located in the European Economic Area, United Kingdom, or Switzerland, the Additional European Economic Area, United Kingdom, and Switzerland Privacy Disclosures below provide more information about lawful bases, international transfers, and privacy rights available to you.

United States State Privacy Laws: Residents of California, Virginia, Colorado, Connecticut, Utah, and other states with comprehensive privacy laws may have rights to know, access, delete, correct, port, opt out of certain targeted advertising or sale/sharing, limit certain uses of sensitive personal information, and avoid discrimination for exercising privacy rights. You can contact us to exercise applicable rights.

Updates to This Privacy Policy

We may update this Privacy Policy from time to time. When we make changes, we will change the Last Updated date above. If we make material changes, we will provide notice by email, prominent posting, in-product notice, messaging channel, or another appropriate method. For material changes in how we use Google user data, we will notify affected users and obtain affirmative consent before new uses begin where required.

Contact Us

If you have questions or requests about this Privacy Policy or other privacy-related matters, please contact us at:

Email: privacy@meetlucas.ai
Subject Line Guidelines:

• "Data Request" for access, deletion, correction, or portability requests.
• "Google Data Request" for Google account disconnection or Google user data deletion requests.
• "AI Training Opt-Out" for model-improvement requests.
• "Privacy Complaint" for concerns about our practices.
• "GDPR Request" for EEA, UK, or Swiss privacy rights.

Response Time: We respond to privacy inquiries within the time required by applicable law.

Mailing address:

Additional European Economic Area, United Kingdom, and Switzerland Privacy Disclosures

These disclosures supplement the information above for individuals who access Sones or otherwise interact with us from the European Economic Area ("EEA"), United Kingdom ("UK"), or Switzerland.

Controller Details and Privacy Contacts

Lucas Intelligence, Inc. determines and is responsible for how personal data is used in connection with Sones. You can contact us at privacy@meetlucas.ai or by mail at the address above.

If you have a concern about our processing of personal data, you have the right to lodge a complaint with the Data Protection Authority where you reside, where you work, or where an alleged violation occurred. Contact details for applicable authorities can be found here:

• European Economic Area: https://www.edpb.europa.eu/about-edpb/our-members_en
• United Kingdom: https://ico.org.uk/global/contact-us/
• Switzerland: https://www.edoeb.admin.ch/en/contact-2

We would appreciate the chance to handle your concerns directly, so please contact us first if you are comfortable doing so.

Purposes and Legal Bases of Processing

When we process your personal data, we rely on one or more of the following lawful bases:

Contract: Where processing is necessary to provide the Service, administer your account, operate messaging and integrations, process payments, or take steps at your request before entering into a contract.

Legitimate Interests: Where processing is necessary for our legitimate interests or those of others, and those interests are not overridden by your rights and freedoms. Examples include maintaining security, preventing fraud and abuse, improving Sones, debugging services, conducting analytics, communicating about the Service, and enforcing our terms.

Consent: Where you consent to processing, such as connecting certain integrations, receiving optional marketing, enabling optional analytics cookies, or authorizing access to certain connected account data. You may withdraw consent at any time.

Legal Obligation: Where processing is necessary to comply with law, respond to lawful requests, maintain required records, handle taxes and accounting, or meet regulatory obligations.

Vital Interests and Public Interest: Where processing is necessary to protect vital interests or perform tasks carried out in the public interest, such as responding to emergencies or lawful government requests.

You are not required to provide personal data to us, but Sones depends on personal data to operate. If you choose not to provide certain information, disconnect an integration, or withdraw consent, we may not be able to provide some features.

We are based in the United States, and personal data may be processed in the United States and other countries that may have data protection laws different from those where you live. Where required, we use appropriate safeguards for international transfers, such as standard contractual clauses or other lawful transfer mechanisms.

Your Additional EEA, UK, and Swiss Privacy Choices

Subject to certain limitations, you may have the following rights:

Right to Access: The right to obtain confirmation of whether we process personal data about you, access that data, and receive information about how we process it.

Right to Portability: The right to receive certain personal data in a structured, commonly used, machine-readable format and transmit it to another controller where technically feasible.

Right to Rectification: The right to correct or update personal data that is inaccurate or incomplete.

Right to Restriction of Processing: The right to ask us to limit certain processing of your personal data.

Right to Object: The right to object to processing based on legitimate interests. You can object to direct marketing at any time.

Right to Withdraw Consent: The right to withdraw consent where processing is based on consent.

Right to Erasure: The right to request deletion of personal data where continued processing is not otherwise justified.

Rights Related to Automated Decision-Making: The right to obtain information about certain automated processing and to request human review where required by law.

To submit a request, contact privacy@meetlucas.ai. Before processing certain requests, we may need to verify your identity and confirm that the request relates to personal data we maintain. We may decline or limit a request where permitted by law, including where we cannot verify your identity, cannot locate your information, or must retain information for legal, security, fraud-prevention, or operational reasons.

Please note that if exercising a right limits our ability to process personal data, we may not be able to provide some or all Sones features.

This Privacy Policy is effective as of 12 November 2026 and applies to personal data collected by Lucas Intelligence, Inc..