Privacy Policy

1. Who this policy covers

This policy explains how lucabindi.com collects, uses, and protects personal data for anyone who visits the site, creates an account, or subscribes to a paid tier. lucabindi.com is operated by [operating entity legal name and registered address]. lucabindi.com is based in Luxembourg, and this policy is written with the EU General Data Protection Regulation (GDPR) as its baseline standard.

2. What data is collected

Depending on how you use the platform, the following categories of personal data may be collected:

• Account data: name, email address, and password (stored as a hash, never in plain text) when you create an account.
• Subscription and billing data: your subscription tier and billing history. Card details themselves are never stored by lucabindi.com — they are collected and processed directly by Stripe.
• Usage data: pages visited and questions submitted to the AI Research Assistant, retained for service quality and rate-limiting purposes.
• Booking data: if you book a consulting call, your name, email, and selected time are collected by the embedded scheduling widget (Cal.com).
• Correspondence: any information you send by emailing the platform.

3. Legal basis for processing

Personal data is processed on the following bases: performance of a contract (providing the account and subscription you signed up for), legitimate interest (maintaining and securing the service, preventing abuse), and consent (where required, such as for optional communications).

4. Who else processes your data

lucabindi.com uses the following third-party processors, each of which handles a specific, limited part of the service:

• Supabase — database hosting and authentication (EU region).
• Stripe — payment processing for subscriptions and report purchases.
• Sanity — content management for published research and reports.
• Vercel — application hosting, and cookieless usage analytics via Vercel Analytics (see the Cookie Policy).
• Resend — outbound transactional email (e.g. account confirmations, receipts).
• Forward Email — forwards mail sent to the platform's email addresses; it forwards messages only and does not otherwise process their content.
• Cal.com — the embedded booking widget on the Consulting page.
• Anthropic — if you use the AI Research Assistant after this feature is fully enabled, your question and the retrieved platform data used to answer it are sent to Anthropic's API to generate a response. This does not apply while the Assistant is running in preview mode, which does not call any external AI provider.

Some of these processors are based outside the European Economic Area (EEA), including in the United States. Where that is the case, transfers rely on that processor's own GDPR-compliant safeguards (such as Standard Contractual Clauses). [Confirm each processor's current transfer mechanism before publishing.]

5. How long data is kept

Account data is kept for as long as your account is active, and for a limited period afterward as required for legal, accounting, or dispute-resolution purposes. [Specify exact retention periods per data category.]

6. Your rights

Under GDPR, you have the right to:

• Access the personal data held about you.
• Request correction of inaccurate data.
• Request erasure of your data, subject to legal retention requirements.
• Request a portable copy of your data.
• Object to or request restriction of certain processing.
• Lodge a complaint with your local data protection authority.

To exercise any of these rights, contact research@lucabindi.com.

7. Children's privacy

lucabindi.com is intended for professional and institutional use and is not directed at children. It does not knowingly collect personal data from anyone under 16.

8. Changes to this policy

This policy may be updated from time to time. The "Last updated" date above reflects the most recent revision.

9. Contact

Questions about this policy or your data can be sent to research@lucabindi.com.