Privacy policy

Last updated 4 November 2026

This policy explains what personal data Lucas Deck collects, why, who helps us process it, and your rights. Lucas Deck is the data controller. You can contact us about privacy by replying to any email we have sent you.

What we collect

• Your account: your email address (and your name if you sign in with Google), your plan, and how much of your allowance you have used.
• What you upload or record: recordings, videos and documents, and the transcripts and text we make from them. These can contain personal data about you and about other people (for example, people speaking in a meeting).
• What we make for you: slides, documents, MP3s, recaps and other outputs, and your chats with Ask Lucas and the idea chat.
• Payments: handled by Stripe. We never see or store your full card details; we keep your Stripe customer ID and subscription status.
• Shared links: if you share a deck, we record anonymous view statistics (which slides were viewed and for how long) and any questions viewers ask through "Ask this deck". Viewers are identified only by a random ID, not by name or email.
• Zoom: if you connect Zoom, we store access tokens so we can list and fetch the cloud recordings you choose. You can disconnect at any time.
• Usage and errors: page views, product events and errors, linked to your account ID (never your email), and the cost of each AI request so we can run fair limits.

Why we use it (and our legal basis)

• To provide the service you signed up for: processing your material and producing your outputs (performance of our contract with you).
• To take payments and keep financial records (contract, and legal obligation).
• To prevent abuse, keep costs fair and fix problems (our legitimate interests).
• To send account emails, such as your welcome email, trial reminders and usage warnings (contract and legitimate interests). Marketing emails, such as waitlist invites, have an unsubscribe link.

If you upload material that includes other people, you are responsible for having a lawful reason to do so, for example telling meeting participants that the call is recorded and summarised.

Who helps us process it

We use these service providers. Each only gets what it needs to do its job, under a data processing agreement.

• Supabase: database, sign-in and file storage (London, UK).
• Vercel: website hosting.
• AssemblyAI: transcription of recordings (EU servers).
• Anthropic (Claude): writing slides, documents and answers from your material (USA).
• OpenAI: the AI voice for MP3s and videos; it receives only the script to be read aloud (USA).
• Stripe: payments.
• Resend: sending emails.
• PostHog: product analytics and error tracking (EU), in cookieless mode.
• Cloudflare Turnstile: bot checks on the sign-in page.
• Unsplash and Pexels: stock photos on slides; they receive only search words, never your material.
• Zoom: only if you connect it.
• Google Drive: only if you use it. Files you pick go straight from Google to your project, and decks you save go straight to your own Drive. We can only see files you pick or that we create for you, and we don't keep your Google sign-in.

Our AI providers process your material only to answer our requests. Under their business terms they do not use it to train their models. Where data leaves the UK, it is protected by the UK's approved safeguards, such as the UK-US data bridge or standard contractual clauses.

We do not sell your data, and we do not use your material to train AI models.

How long we keep it

• Original recordings and uploaded files are deleted automatically 30 days after upload. Your outputs and transcripts stay until you delete the project or your account.
• When you delete your account, we delete your projects, files and profile. Payment records are kept by Stripe and us for as long as the law requires (usually six years).
• CV reviews and rewrites are not saved.

Cookies

We use only essential cookies: one to keep you signed in, and one that remembers an invite code for 30 days if you arrive through a friend's link. Our analytics run without cookies, so there is nothing to accept or decline.

Your rights

You can ask to see, correct, export or delete your personal data, or object to how we use it. You can delete your projects and your whole account yourself in the app. For anything else, contact us by replying to any email we have sent you. We will reply within one month.

If you are unhappy with how we handle your data, you can complain to the Information Commissioner's Office (ico.org.uk).

Changes

If we make important changes to this policy, we will tell you by email or in the app before they take effect.