Privacy Policy

Effective September 26, 2026

Who we are

Luca is a personal money agent ("Luca", "we", "us"). This policy explains what we collect when you use Luca by text message, email or on this website, and what we do with it.

What we collect

Your mobile number and the name on your messaging profile, when you text us.
The email address you give us, and the emails you forward to Luca: bills, renewals, statements and receipts. We only see emails you or your mail-forwarding rule send to us. If you connect Gmail, Luca has read-only access: it searches the last 90 days, and then new mail every 10 minutes, for bills, renewals, statements and receipts, opens only emails that match that search, and keeps only the bills. It can't send, delete or change anything. You can disconnect anytime by texting DISCONNECT, from your setup page, or in your Google account settings, and Luca then deletes its access. We never ask for your email password.
The messages you send us and the messages we send you.
Emails we send to and receive from providers on your behalf, and the results (for example, a lower premium).
Photos you send us of paper bills or of items you want to sell. We read bills with text recognition that runs on our own servers.
Payment details, which are collected and stored by Stripe. We don't see or store your full card number.
Basic website data: pages visited and a device identifier used to prevent referral fraud. On our public pages we use Microsoft Clarity to see how visitors use the site (clicks, scrolling and page views) so we can improve it; email addresses and anything typed into forms are hidden from it. Clarity is not used on pages where you sign an authorization. See Microsoft's privacy statement at privacy.microsoft.com.

How we use it

To find savings, contact providers as your representative when you ask us to, and tell you what happened.
To send you updates about your bills, savings and account. If you opt in separately, we also send referral and feature messages.
To bill you, apply credits and run the referral and Savings Circle programs.
To prevent fraud and abuse, and to meet legal obligations.
We don't sell your personal information, and we don't share it with advertisers.

Health information

If you ask us to work on a medical bill, we ask you to sign a HIPAA authorization naming Luca. It lets the billing office share billing information with us (statements, itemized charges, insurance and financial assistance details) for the sole purpose of reviewing and negotiating your bill. We use it for nothing else, never sell it and never use it for marketing. You can revoke it anytime by texting REVOKE, and you can download your signed copy from the link we send you.

Google user data (Gmail)

Luca's use and transfer to any other app of information received from Google APIs will adhere to the Google API Services User Data Policy (https://developers.google.com/terms/api-services-user-data-policy), including the Limited Use requirements.
What we access: with your permission, read-only access to your Gmail (the gmail.readonly permission). Luca searches your mailbox for bills, renewals, statements and receipts and opens only the emails that match that search.
How we use it: only to provide Luca's service to you, which is finding bills you may be overpaying on, refunds and credits you're owed, and renewals to review, and to tell you what we found. We keep the bills and receipts Luca finds and don't store other emails.
What we never do: we don't sell Google user data, use it for advertising, or use it to build or train general-purpose AI models. People at Luca don't read your emails unless you ask us to, it's needed for security or to investigate abuse, or the law requires it.
Who else sees it: only the service providers listed in this policy that run Luca for us, under contract, and only to provide Luca to you. When Luca uses Anthropic's AI model to read an unusual bill, the text is sent with your name and account details removed, and Anthropic does not use it to train its models.
Stopping and deletion: you can disconnect Gmail anytime from your setup page, by texting DISCONNECT, or at myaccount.google.com/permissions. Luca then deletes its access immediately. To delete the bills Luca kept, text DELETE or email us.

Text messages

By texting LUCA, or by ticking the text-message box when you sign up, you agree to receive messages from Luca about your bills and savings. Message frequency varies. Message and data rates may apply. Reply STOP to stop all messages or HELP for help.

No mobile information will be shared with third parties or affiliates for marketing or promotional purposes. Text-message opt-in data and consent are excluded from every category of sharing in this policy and will not be shared with any third party, except the text-messaging provider that delivers our messages.

How long we keep it

We keep the amounts, dates, providers and results Luca needs while your account is open. The full text of forwarded emails and provider emails is deleted after 90 days, and photos of items you sold are deleted 30 days after the listing ends. Signed HIPAA authorizations are kept as the law requires.

Text DELETE and we erase your bills, messages and account. Records of payments, credits and fees are kept without your name for as long as tax and accounting law requires.

Your rights

You can ask to see, correct or delete your information at any time by texting DELETE or emailing us. We answer within 30 days.

California privacy rights (CCPA and CPRA)

If you live in California, you have the right to know what personal information we collect, use and disclose; to get a copy of it; to correct it; to delete it; to limit the use of sensitive personal information; and to not be treated differently for using these rights.
We don't sell your personal information, and we don't share it for cross-context behavioral advertising, so there is nothing to opt out of. We use health information only to handle the bill you asked us to work on.
To use your rights, text DELETE to Luca or email hello@luca.network with the subject "California privacy request". You can use an authorized agent. We verify requests using the phone number or email on your account.

Security

Data is encrypted in transit and at rest, and access is limited to the people who operate Luca. No system is perfectly secure; if a breach affects you, we'll tell you as the law requires.
Our operations console requires a password and a second sign-in code, and every time a staff member opens your account is logged. Backups are encrypted.
We check that every forwarded email really comes from you or your provider (SPF, DKIM and DMARC). Emails that fail those checks aren't acted on until a person reviews them. A new forwarding address is linked only after you confirm it from that inbox.
You can set a PIN by texting PIN and 4 to 6 digits. Luca then asks for it before deleting your account or adding an email address, and emails you when either happens.

Children

Luca is for people 18 and over. We don't knowingly collect information from anyone under 18.

Changes and contact

We'll post any changes here and update the date below. Questions: hello@luca.network.