Privacy Policy

Last updated: October 2026

Lufios Inc. ("Lufios", "we", or "the company") considers protecting the personal data of customers and users of Lufios services one of our responsibilities. This Privacy Policy explains how data is collected, processed, and retained.

This policy has been prepared to meet our obligations under the Turkish Personal Data Protection Law No. 6698 (KVKK) and the European Union General Data Protection Regulation (GDPR).

1. Data Controller

The legal entity acting as data controller with respect to your personal data:

Lufios Inc.
Email: security@lufios.com

For our enterprise customers (B2B), the customer organization acts as the data controller and Lufios acts as the data processor. In such cases, data processing conditions are governed by a separate Data Processing Agreement (DPA).

2. Personal Data Collected

The following categories of personal data may be collected during use of the Lufios platform:

Identity information: Name, surname, email address, and account information associated with the sign-in method used; the mobile app may use a one-time email code
Contact information: Email address, phone number (optional)
Usage data: Session information, platform interaction records, feature usage statistics
Technical data: IP address, browser type, operating system, device information, cookie data
Content data: Chat messages created on the platform, uploaded files, AI interaction history
Conversation recordings: When you use the recording feature in the mobile app, audio recordings, the transcripts created from them, and derived conversation insights
Connection data: Data accessed through third-party integrations (Gmail, Outlook, Google Drive, etc.), only when explicitly authorized by the user

3. Purposes of Data Processing

Your personal data is processed for the following purposes:

Providing and maintaining Lufios platform services
Creating, authenticating, and managing user accounts
Operating AI-powered features (chat, analysis, reporting, automation)
When the required permissions have been obtained, recording conversations, processing them securely, and providing transcripts or conversation insights
Customer support and technical troubleshooting
Ensuring platform security, detecting and preventing misuse
Fulfilling legal obligations
Improving service quality and performance analytics (using anonymous and aggregated data)

We do not sell personal data to third parties or use it for targeted advertising. Conversation insights may be made available to authorized users in the customer's organization as described in this policy.

4. Legal Basis for Data Processing

Under KVKK, your personal data is processed based on the following legal grounds:

Performance of contract: Data processing necessary for the delivery of platform services
Legitimate interest: Security, fraud prevention, and service improvement
Legal obligation: Tax, accounting, and regulatory requirements
Explicit consent: Non-essential data processing activities and third-party integration authorizations

The same legal bases apply under GDPR (Article 6(1)(a), (b), (c), (f)).

5. AI and Data Usage

For enabled AI and conversation features:

Conversation audio, transcripts, and related context may be transferred to speech-processing or AI service providers when necessary to deliver an enabled feature
Access between organization workspaces is governed by account and membership permissions
Generated transcripts and analyses may be inaccurate and should be reviewed by a person before important decisions
Meeting recordings: The recording's audio is sent to ElevenLabs to be transcribed. The resulting text and your company's sales steps are sent to Microsoft Azure OpenAI for the summary, needs, objections and suggested next steps. That analysis runs in Microsoft's European Union data zone; ElevenLabs may process the audio outside the European Union (for example, in the United States)
Lufi coach: When you talk to Lufi or practise a conversation, your voice and the text of the meeting you ask about are sent to Microsoft Azure OpenAI, which processes them for us so that Lufi can answer. The turn-taking voice line and practice run in Microsoft's European Union data zone. The full-duplex live line, and the model it uses for harder questions, are global services: they may process your voice and that text outside the European Union
Managers' questions: When a manager asks the recordings a question in the panel, the question and limited analysis summaries of the meetings they may read are sent to Microsoft Azure OpenAI; no audio is sent this way
Reporting an answer: When you report an AI answer, only the answer you chose (up to 4,000 characters), the reason you picked and your optional comment go to the Lufios support team; the rest of the conversation is not sent. The report is kept for your company's retention period (at most 90 days) and removed when the linked recording or your account is deleted
Microsoft may retain prompts and outputs sent to Azure OpenAI for up to 30 days to monitor for abuse; it does not use them to train models

6. Data Retention and Deletion

Your personal data is retained for the duration required by the processing purpose:

Active account data: Retained while the account is active
Meeting recordings, transcripts, summaries, notes and customer entries: The customer organization (for example, the dealership) is the controller of these business records. Recordings contain your voice and are personal data; they are kept under the organization's retention policy (today 30 or 90 days, depending on the organization), and the organization can delete them earlier. Deleting an individual account does not delete them, and names spoken or typed inside them are not rewritten
Audit records: Retained for a specified period under legal obligations
App step record (diagnostics): To find faults, the mobile app records its own steps: which screen was open and for how long, where on the screen it was touched (as a share of the screen), the outcome and duration of the app's calls to our servers, the states of the recording and the Lio device, and errors. This record contains no conversation, text, name, email address or customer information; it is linked to your account, read only by the Lufios support team to troubleshoot, and deleted after 14 days
Backup data: Database backups are stored encrypted at rest in Microsoft Azure and are deleted automatically after 30 days, plus up to 7 days of recovery protection

You can delete your account in the app: tap your initials at the top of the screen, then Privacy > Delete account. Your access ends immediately; within 30 days we delete the sign-in account Lufios provides, remove your name and email address from your Lufios profile, and email you when it is done. If you sign in with your company's own Microsoft account, that account belongs to your company and we do not delete it. See Account deletion for details.

7. Data Sharing and Transfer

Your personal data may be shared with third parties in the following situations:

Infrastructure provider: Microsoft Azure (Austria) for servers, the database, audio storage and backups
Sign-in: Microsoft Entra External ID for email-code sign-in and authentication
Speech and AI providers: ElevenLabs (speech-to-text) and Microsoft Azure OpenAI (summaries, analysis and the Lufi coach); see section 5
Recording device: If you use the Lio recorder, its serial number and a user identifier that contains neither your name nor your email address are sent to the device maker's pairing service so the device can be paired with your account
Legal requirement: Upon court order, legal regulation, or request from authorized public authorities
Business partners: Only partners essential for service delivery and bound by confidentiality agreements

Your data is never sold to third parties or shared for marketing purposes under any circumstances.

International data transfers: Data may be processed in different countries depending on the service and provider used. Applicable regions, transfer mechanisms, and contractual safeguards are assessed under the relevant service arrangements and law. The Lufi coach's full-duplex live line is a global Microsoft Azure OpenAI service that may process your voice and the meeting text outside the European Union, and ElevenLabs may process recording audio outside the European Union (see section 5).

8. Data Security

We implement the following technical and administrative measures to ensure the security of your personal data:

TLS 1.2+ encryption in transit
Platform-level encryption at rest (AES-256)
Role-based access control (RBAC) and least-privilege principle
Multi-factor authentication (for administrative access)
Regular security scans and dependency audits
Access audit logs and immutable logging infrastructure
Full data isolation between customers (multi-tenant architecture)

9. Cookie Policy

The Lufios platform uses the following types of cookies:

Essential cookies: Authentication, session management, and security (CSRF protection). These cookies are required for the platform to function and cannot be disabled.
Functional cookies: Language preference and user interface settings. These cookies are used to improve user experience.

Lufios does not use third-party cookies for advertising or tracking purposes.

10. User Rights

Under KVKK and GDPR, you have the following rights:

Right to information: Learn whether your personal data is being processed
Right of access: Request access to your processed personal data
Right to rectification: Request correction of inaccurate or incomplete data
Right to erasure: Request deletion of your personal data (right to be forgotten)
Right to restrict processing: Request restriction of data processing under certain conditions
Right to data portability: Receive your data in a structured, commonly used, and machine-readable format
Right to object: Object to data processing based on legitimate interest
Automated decision-making: Right not to be subject to decisions based solely on automated processing

To exercise these rights, you may contact security@lufios.com. For account-deletion instructions, see Account deletion. Requests are responded to within 30 days at the latest.

You retain the right to file a complaint with the Personal Data Protection Board under KVKK, or with the relevant EU data protection authority under GDPR.

Your privacy rights in the United States

If you live in California or another US state with a consumer privacy law, you can ask us what personal information we hold about you, and you can ask us to correct or delete it. You can also appoint an authorized agent to ask for you. We will not treat you differently for using these rights. To ask, use Delete account in the app, or email security@lufios.com; we verify the request against the email address on your account and answer within 30 days. Where your employer is the controller of the records, we pass your request to your employer and help it respond.

We do not sell personal information, and we do not share it for cross-context behavioral advertising or use it for targeted advertising. We do not use sensitive personal information to infer characteristics about you.

11. Children's Privacy

The Lufios platform is designed for enterprise use and is not directed at individuals under the age of 18. We do not knowingly collect personal data from individuals under 18. If we become aware of such a situation, the relevant data is deleted immediately.

12. Job Application & Candidate Notice

This section applies to candidates who apply for a job or internship through lufios.com/careers and is provided to fulfil our disclosure obligation under the Turkish Personal Data Protection Law No. 6698 (KVKK) and the GDPR.

Personal data we process:

Identity & contact: first name, last name, email, phone number
Education: university, major, class/year
The contents of your CV/resume and the links you share (LinkedIn, GitHub, portfolio)
Your free-text answers in the application form

Purpose: Evaluating your application for open positions, running our recruitment and selection processes, and communicating with you.

Legal basis: Your explicit consent (KVKK Art. 5/1; GDPR Art. 6(1)(a)), the necessity for steps prior to entering an employment contract (GDPR Art. 6(1)(b)), and our legitimate interest (KVKK Art. 5/2; GDPR Art. 6(1)(f)).

Transfer abroad: Your application data and CV are stored in Microsoft Azure. Your CV is also copied to our team's Google Workspace (Google Drive) archive, and interviews are scheduled with Google Workspace calendar. These providers may process your data outside Türkiye, including in the United States for Google. Your personal data is therefore transferred abroad. By checking the consent box in the application form, you give explicit consent to this transfer under KVKK Art. 9.

Retention: If your application is not successful, your data is kept for up to 12 months so we can consider you for suitable future positions, after which it is deleted. You may request earlier deletion at any time.

Third-party data: If your CV includes information about third parties (e.g. references), it is your responsibility to inform them and obtain any necessary consent.

Your rights: You may exercise your rights under KVKK Art. 11 / GDPR (to learn whether your data is processed, access, rectification, erasure, etc.) by contacting security@lufios.com.

13. Policy Changes

We may update this Privacy Policy from time to time. When significant changes are made, notification is provided through the platform or via email. The updated version of the policy is published on this page and the "Last updated" date is revised.

14. Contact

For questions or requests regarding privacy:

Lufios Inc.
Email: security@lufios.com