Privacy & Cookies Policy
This Privacy & Cookies Policy explains what Personal Data we collect when you use Lucida AI, why we collect it, who we share it with, how long we keep it, and the rights you have over it. It forms part of the [Terms of Service](/terms), and words defined there have the same meaning here.
Spoken practice is central to the Service, so voice and conversation data get a section of their own. If you read nothing else, read section 4 and section 5.
1. Who We Are
Lucida AI Teknoloji AŞ, Emniyetevleri Mah. Sapphire Sit. No:1/1, 34443, Levent, Istanbul, Turkey, is the controller of the Personal Data described in this policy. Under the General Data Protection Regulation we are the “controller”; under Turkish Law No. 6698 on the Protection of Personal Data (KVKK) we are the “data controller” (veri sorumlusu).
You can reach us about anything in this policy at support@getlucida.com, or by post at the address above.
2. Scope
This policy applies to:
• the Application — the Lucida AI app, however you obtained it;
• the Website — getlucida.com; and
• the sign-up funnel we use to take you from an advertisement or a link through a short questionnaire to a Subscription.
It does not apply to a service operated by someone else that you reach from ours. A link is not an endorsement, and once you are on another party’s service that party’s own privacy notice governs what happens to your data there.
Words we use. The following have the meanings given, whether singular or plural. Where a word is also defined in the Terms of Service, the meaning is the same.
Account means the unique account created for you to access the Service or parts of it.
Affiliate means an entity that controls, is controlled by, or is under common control with a party, where “control” means ownership of 50% or more of the shares, equity interest or other securities entitled to vote for the election of directors or other managing authority.
Application means Lucida AI, the software application provided by the Company.
Company, and also “we”, “us” and “our”, means Lucida AI Teknoloji AŞ, Emniyetevleri Mah. Sapphire Sit. No:1/1, 34443, Levent, Istanbul.
Cookies are small files placed on your computer, mobile device or other device by a website, which can hold details of your activity on that site among other uses.
Country means Turkey.
Device means any device that can access the Service, such as a computer, a mobile phone or a tablet.
Identity Provider means a third-party service you already hold an account with and may choose to use to create an Account or sign in.
Personal Data means any information relating to an identified or identifiable individual.
Service means the Application or the Website or both, together with the features, content and functionality made available through them.
Service Provider means a natural or legal person that processes Personal Data on our behalf — a company or individual engaged by us to help deliver, operate, secure, support or analyse the Service.
Store means an application marketplace through which the Application is distributed.
Usage Data means data collected automatically, generated either by your use of the Service or by the infrastructure that runs it, such as how long a page was open.
Website means Lucida AI, accessible from getlucida.com.
You means the individual accessing or using the Service, or the company or other legal entity on behalf of which such individual is accessing or using the Service, as applicable.
3. What We Collect
Account data. Your email address and, where you give them, your first and last name. Where you sign in through an Identity Provider, we receive from it the identifier and the basic profile information you permit it to share with us, such as your name and email address; we do not receive your password for that service. Where you create an Account directly with us, we hold your credentials in a form designed not to reveal your password.
Profile and questionnaire responses. What you tell us about yourself so the Service can teach you: your target language, your self-described level, what you want to use the language for, how much time you have, and the other answers you give in the sign-up funnel or in the Application, including the age bracket you select.
Learning and usage data. What you do in the Service: lessons, exercises and sessions started and completed, scores, level assessments, corrections and feedback produced for you, streaks, and the features you use and when.
Voice and conversation data. What you say in a spoken session and what you type to the tutor, and the transcripts and other Activity Materials produced from them. Section 4 deals with this separately.
Purchase and subscription data. Which plan you bought, the billing period, the currency and the country used to price it, when you were charged, the status of your Subscription, refunds and chargebacks, and transaction identifiers. Where you buy through the Website, our payment Service Provider handles your card or wallet details and we receive confirmation of the transaction and limited information such as the card type and last digits — we do not receive or store your full card number. Where you buy through a Store, the Store handles payment entirely and tells us only that a Subscription exists and its status.
Device and technical data. This is the Usage Data referred to elsewhere in this policy: IP address, device type and model, unique device and installation identifiers, operating system and version, application version, browser type and version, language and region settings, referring page, the pages and screens you open, the time and date of your visit and how long you spend, and crash and diagnostic data.
Enquiries and correspondence. If you write to us or submit a form on the Website, we receive what you send — typically your name, your email address, your company where the form asks for it, and the content of your message — together with our replies.
We do not ask you for special categories of Personal Data — data revealing health, religious or philosophical belief, political opinion, trade union membership, sex life or sexual orientation, racial or ethnic origin, or criminal convictions — and the Service does not need any of it to teach you a language. Please do not put such information into a lesson, a spoken session or a message to us. If you do, you are choosing to provide it and it will be processed as part of the conversation data described in section 4.
4. Voice and Conversation Data
Spoken practice is the part of the Service that handles the most sensitive-feeling data, so this section sets out plainly what happens.
Microphone access. Spoken practice needs access to your Device’s microphone. You grant that access, and can withdraw it, through your Device’s operating system. Without it, spoken practice does not work; the rest of the Service does.
What happens during a session. Audio captured by your microphone is processed while you speak so that a reply can be generated and spoken back to you. A session is a continuous exchange rather than a single request.
Transcripts. A session produces a transcript of the exchange. We retain transcripts, and we do so deliberately — retention is what lets the Service correct you, track your level, and carry context from one session into the next. We may process this data ourselves or through Service Providers acting for us, and we may use it as described in section 5.
Text conversations with the tutor are treated in the same way as transcripts throughout this policy.
Accuracy. Speech recognition is imperfect. Accent, background noise, microphone quality and network conditions all affect it, and a transcript may not record accurately what you said. Where that matters to you — for example if a transcript records something you did not say — you can ask us to correct or delete it under section 10.
Other people’s voices. Do not bring another person’s voice into a session without their consent. If you do, you are providing their Personal Data to us, and section 5 of the Terms of Service and section 18 of those Terms apply to you for doing so.
Your choices. You can stop spoken practice at any time by withdrawing microphone access or by not using the feature. You can object to your written conversation data being used to improve our models under section 5. You can ask us to delete a transcript, or your Account and everything associated with it, under sections 9 and 10. The legal bases on which we process this data are in the table in section 6.
5. Improving Our Models, and How to Object
What we do. We use conversation data — transcripts, text exchanges with the tutor, and the other written Activity Materials produced around them — to make the Service better, including to train, tune and evaluate the models that power it. We may do this ourselves or through Service Providers acting for us.
On what basis. Outside the situations described below we rely on our legitimate interests in improving a product our users pay for. Where the law applicable to you requires your consent for this use, we rely on consent instead, we do not use your conversation data in this way unless you have given it, and you can withdraw it at any time.
How to object. If you are in the European Economic Area or the United Kingdom, Article 21(1) of the GDPR gives you the right to object at any time to processing based on legitimate interests, on grounds relating to your particular situation. Wherever you are, we will act on an objection to this use.
To object, write to support@getlucida.com from the email address associated with your Account and say that you do not want your written conversation data used to improve our models. We will apply it to your Account and confirm when we have. Where you have given consent, the same message withdraws it, and withdrawal does not affect the lawfulness of what we did before you withdrew it.
We will stop, unless we can demonstrate compelling legitimate grounds for the processing that override your interests, rights and freedoms, or unless the data is needed to establish, exercise or defend a legal claim. If we ever conclude that one of those applies to you, we will tell you why.
What objecting does not do. It does not stop us processing your data to deliver the Service to you — you still get corrections, feedback and personalisation, because those depend on the retention described in section 4 rather than on model improvement. It does not reach data that has already been aggregated or de-identified so that it no longer identifies you, which is dealt with in section 9. It does not delete anything on its own; if you want deletion as well, ask for it under section 10.
Relationship to the Terms. Section 8 of the [Terms of Service](/terms) grants us a broad licence over User Content and assigns Activity Materials to us. That licence is expressly limited by this policy: it does not entitle us to use your data in a way this policy says we will not. An objection made under this section therefore binds us notwithstanding those rights.
6. Purposes and Legal Bases
We process Personal Data only where we have a legal basis for it. The table below maps each purpose to the basis we rely on under Article 6 of the GDPR and under Article 5 of the KVKK. Where more than one basis is shown, we rely on the one that applies to the processing in question.
What we do it for — GDPR Article 6 basis — KVKK Article 5 basis
Creating and administering your Account, authenticating you, and providing the Service to you — 6(1)(b) — performance of a contract — 5(2)(c) — necessary for the conclusion or performance of a contract
Running spoken and written practice sessions, producing corrections, assessments and feedback, and personalising later sessions from earlier ones — 6(1)(b) — performance of a contract — 5(2)(c) — necessary for the conclusion or performance of a contract
Taking payment, managing Subscriptions, renewals, refunds and chargebacks — 6(1)(b) — performance of a contract — 5(2)(c) — necessary for the conclusion or performance of a contract
Keeping the accounting, tax and transaction records the law requires us to keep — 6(1)(c) — compliance with a legal obligation — 5(2)(ç) — necessary for compliance with a legal obligation
Sending you service messages — security notices, billing notices, and notice of changes to the Service or to these documents — 6(1)(b) — performance of a contract; 6(1)(f) — legitimate interests in keeping you informed — 5(2)(c) — contract; 5(2)(f) — legitimate interests
Keeping the Service secure, preventing and investigating fraud, abuse of trials, promotions and refunds, and enforcing the Terms — 6(1)(f) — legitimate interests in protecting the Service, our users and our business — 5(2)(f) — legitimate interests
Improving the Service and the models behind it, as described in section 5 — 6(1)(f) — legitimate interests in improving the Service; 6(1)(a) — consent, where the law applicable to you requires it — 5(2)(f) — legitimate interests; Article 5(1) explicit consent, where required
Measuring how the Service, the Website and the sign-up funnel are used, and how effective our marketing is — 6(1)(f) — legitimate interests in understanding and improving what we offer; 6(1)(a) — consent, where the law applicable to you requires it for storing or reading information on your Device — 5(2)(f) — legitimate interests; Article 5(1) explicit consent, where required
Sending you marketing about our own products — 6(1)(a) — consent, where required; otherwise 6(1)(f) — legitimate interests — Article 5(1) explicit consent, and the rules on commercial electronic messages under Law No. 6563
Responding to your enquiries and support requests — 6(1)(b) — performance of a contract; 6(1)(f) — legitimate interests in answering people who write to us — 5(2)(c) — contract; 5(2)(f) — legitimate interests
Answering requests from public authorities and complying with other legal obligations — 6(1)(c) — compliance with a legal obligation — 5(2)(ç) — necessary for compliance with a legal obligation
Establishing, exercising or defending legal claims, and evaluating or carrying out a merger, acquisition, financing or sale of the business — 6(1)(f) — legitimate interests in protecting our legal position and our business — 5(2)(e) — necessary for the establishment, exercise or protection of a right
Where the table shows legitimate interests, we have considered whether our interest is overridden by your interests, rights and freedoms, and we process the data only where we conclude it is not. You can ask us about that assessment, and you can object to it, under section 10.
7. Who We Share With
We do not publish the names of our Service Providers. Article 13(1)(e) of the GDPR permits a controller to disclose recipients or categories of recipients, and Article 10 of the KVKK likewise permits describing the parties to whom data may be transferred; the obligations that attach to naming a processor belong in the contract we sign with it, not in a public notice we would have to reopen every time a provider changes. What follows is the complete set of categories. This concerns what we publish here. It does not cut down the right in section 10 to ask us who your own data has been transferred to, and where the law applicable to you entitles you to the identity of a recipient rather than its category, we will give you the identity.
Service Providers acting on our behalf. We may carry out any of the processing described in this policy ourselves or through Service Providers. Each processes Personal Data only on our documented instructions, under a written contract meeting the requirements of Article 28 of the GDPR and the KVKK, and is bound to confidentiality and to appropriate security measures. The categories are:
• Infrastructure — the computing, storage, networking and content-delivery services on which the Service runs.
• Payment services — the services that take payment, hold your card or wallet details, and handle refunds and disputes.
• Analytics — the services that measure how the Service and the Website are used.
• Customer support tooling — the services through which we receive and answer what you write to us.
Other recipients, who are not acting as our Service Providers.
• Affiliates, where they need the data for a purpose in section 6, on terms consistent with this policy.
• A Store, where you bought a Subscription through one. The Store is the merchant for that purchase and tells us the status of your Subscription; we do not receive your payment details from it.
• An Identity Provider, where you choose to sign in through one. It learns that you signed in to our Service, and what it then does with that fact is governed by its own privacy notice.
• Professional advisers — lawyers, accountants, auditors and insurers — where they need the data to advise us, under a duty of confidentiality.
• Public authorities, courts and regulators, where we are required to disclose by law, or where disclosure is necessary to comply with a legal obligation, to enforce our agreements, to prevent or investigate wrongdoing, to protect the safety of any person, or to protect against legal liability.
• A buyer or successor, in connection with a merger, acquisition, financing, reorganisation, insolvency or sale of some or all of our business or assets, in which case we will give notice before your data becomes subject to a different privacy policy.
• Anyone else you ask us to share it with, or consent to us sharing it with.
Advertising and campaign measurement. The analytics category above includes measurement technologies on our sign-up funnel that report your interaction with it back to the provider that supplies them. In some jurisdictions — California in particular — that kind of transfer is treated as “sharing” personal information for cross-context behavioural advertising, whether or not money changes hands. Section 10 sets out the right to opt out of it and how to use that right, and section 11 explains what these technologies do.
8. International Transfers
We are established in Turkey. The Service Providers in section 7 are located in a number of countries, including within the European Economic Area, the United Kingdom, the United States and Turkey. Your Personal Data will therefore be transferred outside the country you live in, to countries whose data protection law may differ from your own.
Data protected by the GDPR or by UK law. Where Personal Data leaves the EEA or the United Kingdom, we transfer it on one of the following: an adequacy decision covering the destination country; the European Commission’s Standard Contractual Clauses, together with the UK International Data Transfer Addendum or the UK’s own International Data Transfer Agreement where UK data is involved; or another mechanism permitted by Chapter V of the GDPR. Where we rely on contractual clauses, we assess the law and practice of the destination country and apply supplementary measures where the assessment calls for them.
Data protected by the KVKK. Article 9 of the KVKK, as amended in 2024, permits a transfer abroad where the Personal Data Protection Board has adopted an adequacy decision for the destination country, sector or international organisation. Where there is no adequacy decision, we transfer on an appropriate safeguard under Article 9(3) — most often the standard contract announced by the Board, notified to the Authority as that provision requires — or, in the exceptional cases set out in Article 9(6), on one of the grounds listed there, which include your explicit consent given specifically for the transfer after being informed of its risks.
You can ask us for a copy of the safeguard we rely on for a particular transfer by writing to support@getlucida.com. We may redact commercial terms from what we send you.
9. Retention
We keep Personal Data for as long as we need it for a purpose set out in section 6, and no longer. In practice that means:
• Account, profile and learning data for as long as your Account exists, because the Service works by building on what came before.
• Transcripts, text exchanges and the other written Activity Materials described in section 4, for as long as they serve the purposes in section 6, subject to any deletion you request.
• Purchase and transaction records for as long as the law requires us to keep accounting and tax records of them, which is longer than the life of an Account and which we cannot shorten at your request.
• Records of fraud, abuse, termination and refunds for as long as we need them to enforce the Terms and to apply limits that exist once per Account — such as the money-back guarantee described in the [Refund & Cancellation Policy](/refund) — and to establish, exercise or defend legal claims.
• Enquiries and correspondence for as long as needed to deal with the matter and to keep a record of how it was dealt with.
Deleting your Account and your data. You can ask us to delete your Account and the Personal Data associated with it by writing to support@getlucida.com from the email address associated with the Account. Where the Service offers you a way to delete your Account from within it, using that has the same effect. We may ask you to confirm your identity first, so that nobody else can delete your Account. When we act on the request we delete or irreversibly de-identify the Personal Data we hold about you, except what we must keep under the bullets above or are otherwise required by law to keep, and we tell you what is being kept and why. Deleting your Account is not the same as cancelling a Subscription: if you hold one, cancel it as described in the [Subscription Policy](/subscription), because deleting an Account does not by itself stop a charge.
Copies of data held in backups are removed as those backups are cycled out, and while they remain they are not used for any purpose other than restoring the Service.
Aggregated and de-identified data. We may create aggregated, statistical and de-identified data from your use of the Service and from your content. Once data has been aggregated or de-identified so that it no longer identifies you and cannot reasonably be used to identify you, it is no longer Personal Data, it is our data, we may retain and use it for any purpose without restriction, and it falls outside a request you make to delete your data. This matches section 8 of the [Terms of Service](/terms).
10. Your Rights
How to exercise any right in this section. Write to support@getlucida.com from the email address associated with your Account, and tell us which right you want to use. We may ask you for information to confirm that the request is really yours — a request from someone impersonating you is itself a data protection problem — and we will use that information only to verify you. We do not charge for handling a request, unless it is manifestly unfounded or excessive, in which case we may charge a reasonable fee or decline it, and will explain why. If we decline a request, we will tell you the reason and how to challenge it.
Which rights you have depends on where you are. The three regimes below are the ones most likely to apply to our users; if another applies to you, we will honour the rights it gives you on the same terms.
If you are in the European Economic Area or the United Kingdom (GDPR)
You have the right to:
• be informed about how we process your data, which is what this policy is for;
• access the Personal Data we hold about you, and receive a copy of it;
• rectify data that is inaccurate, and have incomplete data completed — including a transcript that records something you did not say;
• erase your data, in the circumstances set out in Article 17;
• restrict processing, in the circumstances set out in Article 18, for example while we check the accuracy of something you have contested;
• data portability — to receive the data you provided to us, and the data generated by your use of the Service where we process it by automated means on the basis of contract or consent, in a structured, commonly used and machine-readable format, and to have it transmitted to another controller where that is technically feasible;
• object to processing based on our legitimate interests, on grounds relating to your particular situation, under Article 21(1). We will stop unless we can demonstrate compelling legitimate grounds that override your interests, rights and freedoms, or the data is needed for legal claims. Section 5 gives the route for objecting to model improvement specifically;
• object to direct marketing at any time, under Article 21(2). This right is absolute: if you use it, we stop, with no balancing exercise;
• withdraw consent at any time where we rely on it, without affecting the lawfulness of what we did before you withdrew it; and
• not be subject to a decision based solely on automated processing that produces legal effects concerning you or similarly significantly affects you. The Service assesses your language level and scores your work automatically in order to teach you; those assessments are not certified results, they produce no legal effect, and no third party is obliged to act on them.
You also have the right to lodge a complaint with a supervisory authority — in the EEA, the authority in the member state of your habitual residence, your place of work, or the place of the alleged infringement; in the United Kingdom, the Information Commissioner’s Office. We would rather you came to us first, at support@getlucida.com, but you are not obliged to.
If you are in Turkey (KVKK Article 11)
Article 11 of Law No. 6698 gives you the right to apply to us and:
• to learn whether your Personal Data is being processed;
• to request information about it, if it has been processed;
• to learn the purpose of the processing and whether the data is used in accordance with that purpose;
• to know the third parties in Turkey or abroad to whom the data is transferred;
• to request that incomplete or inaccurate data be corrected;
• to request the erasure or destruction of your data in the circumstances set out in Article 7;
• to request that a correction, erasure or destruction be notified to the third parties to whom the data was transferred;
• to object to a result reached to your detriment through analysis of your data exclusively by automated systems; and
• to claim compensation for damage you suffer because your data was processed unlawfully.
An application under Article 11 is made to us under Article 13 and the Communiqué on the Procedures and Principles of Application to the Data Controller. Write to support@getlucida.com, or to Lucida AI Teknoloji AŞ at the address in section 1, identifying yourself and stating clearly what you are asking for. If we reject your application, if you are not satisfied with our answer, or if we do not answer within the period the law allows, you may complain to the Personal Data Protection Board (Kişisel Verileri Koruma Kurulu).
If you are in California (CCPA/CPRA)
Subject to the exceptions in the California Consumer Privacy Act as amended by the California Privacy Rights Act, you have the right to:
• know what personal information we have collected about you — the categories collected, the sources, the business or commercial purposes for collecting it, the categories of third parties we disclose it to, and the specific pieces we hold. Sections 3, 6 and 7 answer this at the category level; write to us for the specific pieces;
• delete the personal information we hold about you, subject to the exceptions the statute allows and the retention described in section 9;
• correct inaccurate personal information;
• opt out of the sale or sharing of your personal information, including sharing for cross-context behavioural advertising as described at the end of section 7. To use this right, write to support@getlucida.com with the subject line “Do Not Sell or Share My Personal Information”, and we will apply it to the identifiers we can associate with you;
• limit the use and disclosure of sensitive personal information to what the statute permits without your direction; and
• not be discriminated against for using any of these rights. We will not deny you the Service, charge you a different price, or give you a lower quality of service because you exercised a right under this section.
You may use an authorised agent to make a request on your behalf; we will ask for proof that you authorised them, and may ask you to confirm the request directly. Residents of other US states with comparable privacy laws have equivalent rights, and we handle those requests through the same address and in the same way.
11. Cookies, Tracking and Consent
What we use. On the Website and the sign-up funnel we use cookies, browser storage such as local and session storage, and small measurement files sometimes called pixels or web beacons. In the Application we use the equivalent device-level mechanisms, including software development kits provided by our analytics Service Providers and the advertising and device identifiers your operating system exposes to apps. This section calls all of them “cookies and similar technologies”.
Cookies are either session cookies, which are deleted when you close your browser, or persistent cookies, which stay on your device until they expire or you remove them.
What they are used for. Two categories:
• Strictly necessary. Signing you in and keeping you signed in, securing the session, preventing fraudulent use of accounts, balancing load across our infrastructure, and holding the answers you have given as you move through the sign-up funnel so that a form does not lose them. Without these the Service does not work, and we do not use them for anything else.
• Analytics and measurement. Recognising a browser or app installation across visits by means of an identifier, recording which pages and screens are opened, how long a session lasts, and how you arrived — the referring page, and the campaign parameters in a link you clicked. We use this to understand how the Service is used, to find what is broken, and to measure whether our marketing works. On the sign-up funnel, measurement technologies of this kind also report your interaction with the funnel back to the provider that supplies them, which is the transfer described at the end of section 7 and covered by the opt-out right in section 10.
Your controls. Your browser can block or delete cookies, and can be set to tell you when one is offered; the help pages of your browser explain how. Your Device’s operating system settings let you reset or limit the advertising identifier available to apps, and let you withdraw the Application’s permissions. Blocking strictly necessary cookies will break parts of the Service — you may not be able to sign in. Where the law applicable to you makes your consent a condition of storing or reading non-essential information on your Device, you may also write to support@getlucida.com and tell us your choice, and we will apply it.
12. Children
The Service is for adults. You must be at least 18 years old to create an Account or use the Service, as section 2 of the [Terms of Service](/terms) requires, and the Service is not directed at anyone younger.
We do not knowingly collect Personal Data from anyone under 18. If we learn that we have, we will delete the Account and the data associated with it. If you are a parent or guardian and believe a child in your care has given us Personal Data, write to support@getlucida.com and we will deal with it.
13. Security
We take measures designed to protect Personal Data against loss, misuse, unauthorised access, disclosure and alteration. Traffic between your Device and the Service is encrypted in transit. Access to Personal Data inside the company is limited to people who need it for a purpose in section 6, and is controlled by authentication and access rules. Our Service Providers are bound by contract to appropriate technical and organisational measures and to confidentiality, and we assess them before we engage them.
No method of transmission over the internet, and no method of electronic storage, is completely secure. We cannot guarantee absolute security, and we do not promise it.
Your part. Use a strong password that you do not use anywhere else, keep it to yourself, and do not let anyone else use your Account. Tell us at support@getlucida.com as soon as you suspect that someone else has access to it.
If something goes wrong. Where a breach of security affecting Personal Data occurs, we will assess it and, where the law applicable to it requires, notify the competent supervisory authority — in Turkey, the Personal Data Protection Board — and notify you where the law requires us to.
14. Changes and Contact
Changes. We may update this policy. The version number and effective date at the top of this page always tell you which version you are reading, and the current version is always published at getlucida.com/privacy. Where a change materially affects how we handle your Personal Data, we will give notice before it takes effect, by email to the address associated with your Account or by a notice in the Service. Where a change requires your consent, we will ask for it rather than assume it.
Contact. Questions about this policy, requests under section 10, and objections under section 5 all go to the same place:
support@getlucida.com
Lucida AI Teknoloji AŞ, Emniyetevleri Mah. Sapphire Sit. No:1/1, 34443, Levent, Istanbul, Turkey.
