Privacy Policy

1. Introduction

HiLucy ("we," "our," or "us") operates a SaaS platform for hospitality and short-term rental management, including an AI-powered concierge service. This Privacy Policy explains how we collect, use, disclose, and protect your personal information when you use our services.

This policy applies to:

• Hotel and property guests using our AI concierge
• Property managers and staff using our platform
• Visitors to our website

2. Data Controller

HiLucy
10205 S Komensky Avenue
Oak Lawn, IL 60453, USA

Contact for Privacy Inquiries: [email protected]

For EU residents: [email protected]

3. Personal Data We Collect

3.1 Information You Provide

3.2 Information Collected Automatically

4. How We Use Your Data

5. Data Sharing

We share your data with the following categories of service providers:

All subprocessors are bound by Data Processing Agreements (DPAs) and Standard Contractual Clauses (SCCs) where applicable.

5.1 Mobile Information and SMS

No mobile information will be shared with third parties or affiliates for marketing or promotional purposes. Information sharing to subcontractors in support services, such as customer service, is permitted. All other use case categories exclude text messaging originator opt-in data and consent; this information will not be shared with any third parties.

We use your mobile number solely to deliver the messages described in our Terms of Service: one-time verification codes and notifications about your own stay or account. We do not sell mobile numbers, and we do not use them for marketing.

6. Data Retention

7. Your Rights

GDPR Rights (EU/EEA Residents)

• Access: request a copy of your personal data
• Rectification: correct inaccurate or incomplete data
• Erasure: request deletion of your data
• Restriction: limit how we process your data
• Portability: receive your data in a structured format
• Object: object to processing based on legitimate interest
• Automated Decision-Making: request human review

CCPA Rights (California Residents)

• Right to know what personal information is collected
• Right to delete personal information
• Right to opt-out of the sale of personal information
• Right to non-discrimination for exercising privacy rights

To exercise your rights, email [email protected]. We will respond within 30 days (GDPR) or 45 days (CCPA).

8. Security

We protect your data through:

• TLS 1.2+ encryption for all data in transit
• Encryption at rest for stored consumer data (Google connection tokens are protected as described in 11.7)
• Multi-factor authentication for all admin access
• Role-based access controls
• Regular security monitoring and logging
• PCI-DSS compliance for payment processing (via Stripe)

9. Cookies

We use essential cookies for authentication and session management. For analytics and marketing cookies, we obtain your consent before setting them. You can manage cookie preferences through your browser settings.

9.1 The hl_pid cookie (business prospects)

If you run a property and you click a link in a message we sent you, we set a first-party cookie called hl_pid in your browser. It holds a reference to the property listing the link was about and to the message itself. It is signed so it cannot be edited, and it cannot be read by scripts on the page.

Its only purpose is sales follow-up: it lets our team see that you came back to look at the pricing or demo page, so that when we contact you the conversation is about something you were actually interested in. It records the page you were on, not what you typed, and it never records your IP address or any payment details.

This applies to business prospects only. It is never set for hotel guests using the service, and it plays no part in guest bookings, check-in or messaging.

The cookie lasts 90 days from your most recent click. To stop it: use the unsubscribe link in any message we sent you, reply STOP, or email [email protected]. Any of these stops the collection itself, not just what we display. You can also delete the cookie in your browser at any time.

We rely on legitimate interest for this (Article 6(1)(f) GDPR): you are a business contact who has already engaged with us, the data is limited to business context, and you can stop it at any time.

10. AI and Automated Processing

Our AI concierge (Lucy) uses OpenAI GPT-4o-mini to process your messages. AI-assisted routing and recommendations are not legally significant automated decisions. You may request human review of any AI interaction at any time.

11. Google User Data

11.1 When this section applies

This section covers the data HiLucy receives from Google when you use one of the four features below. Each one is optional, and each one starts only when you choose it and approve it on Google's own consent screen.

• Signing in with Google. Anyone can use a Google account to create a HiLucy account and sign in.
• Scheduling CRM meetings (HiLucy staff). HiLucy's sales staff connect a Google Calendar to book video meetings with hotels and other businesses from the HiLucy CRM.
• Syncing a property's rental calendar (property operators). An operator can connect a Google Calendar so that rental bookings made through HiLucy appear on it and stay up to date.
• Importing files from Google Drive (HiLucy staff and property operators). Import screens let you pick files from your Google Drive instead of uploading them.

If you use none of these, HiLucy receives no data from your Google account and nothing in this section applies to you. Each calendar connection is made by one person, for one account, and can be undone at any time (see 11.8).

11.2 What we access

HiLucy asks Google only for the permissions below, and each one only when you use the feature that needs it.

Signing in with Google

openid, https://www.googleapis.com/auth/userinfo.email and https://www.googleapis.com/auth/userinfo.profile

Let HiLucy confirm who you are and see your name, email address and profile photo. We use them to create your HiLucy account, sign you in, and show your name and photo in the app.

Calendar (CRM meetings and rental calendar sync)

https://www.googleapis.com/auth/calendar.calendarlist.readonly

Lets HiLucy see the list of calendars on your account: each calendar's name and identifier. We use it to let you pick a calendar, and we read the address of your primary calendar to show you which Google account is connected. For CRM meetings we also use that address to add you as a guest on the meetings you book. This permission does not give HiLucy access to any events.

https://www.googleapis.com/auth/calendar.freebusy

Lets HiLucy see when you are busy. Google answers with the start and end times of busy periods inside the time window we ask about, and nothing else: no event titles, descriptions, locations, attachments or attendees. For CRM meetings we ask about the team's shared prospect calendar and your own primary calendar, so a new meeting does not clash with either.

https://www.googleapis.com/auth/calendar.events

Lets HiLucy create, update and delete calendar events. HiLucy uses it only for events it creates itself: meetings you schedule through the HiLucy CRM, which go on the team's shared prospect calendar with you added as a guest, and events for rental bookings made through HiLucy. We record the identifier Google returns for each event we create, and we act only on those identifiers. HiLucy does not list or read the other events on your calendars, and it never changes or deletes an event it did not create.

Rental calendar connections made before September 7, 2026 may still hold Google's broader calendar.readonly permission instead of the first two above. HiLucy uses it for the same two things only: the calendar list and busy times. Disconnecting and connecting again replaces it with the narrower permissions.

Importing from Google Drive

https://www.googleapis.com/auth/drive.file

Lets HiLucy open only the files you pick in Google's file picker, and nothing else in your Drive. The access token stays in your browser and is not stored on our servers. The files you pick are handled like an upload: HiLucy reads spreadsheets to fill in the import, and PDFs and photos are also sent to our AI provider, OpenAI, to read what they say (see 11.5).

11.3 How we use it

• Signing you in. We use your name, email address and photo from Google to create your HiLucy account and sign you in.
• Confirming the connection. We display the connected account's address so you can see which Google account HiLucy is using.
• Choosing a calendar. We show your calendar list so you can pick which calendar HiLucy writes to.
• Offering meeting times. We read busy times for the team's prospect calendar and for your own primary calendar, so the scheduling screen does not offer a time that is already taken on either.
• Creating meetings. When you schedule a meeting, we create an event with a Google Meet link on the team's prospect calendar and add you as a guest, so it also shows on your own calendar. If you ask us to, we invite the prospect by email, and text them the date, time and Meet link by WhatsApp or SMS.
• Moving or cancelling meetings. When you reschedule or cancel a meeting in the CRM, we update or delete that event.
• Keeping bookings in step. For rental bookings, we create events for the agreed times and update or remove them when the booking changes or is cancelled.
• Importing files. We read the files you pick from Google Drive to fill in the import screen you picked them from. You review the result before anything is saved.

We do not use Google user data for advertising, for building profiles, to train machine-learning or AI models, or for any purpose other than providing these features to you.

11.4 What we store, and for how long

For Google sign-in, we keep your name, email address and profile photo as part of your HiLucy account, until the account is deleted (see section 6).

For a calendar connection, we keep:

• A refresh token issued by Google, which keeps the connection working without asking you to sign in again. Kept until you disconnect.
• A short-lived access token used for individual requests. Cached for less than one hour, then discarded.
• The identifier of the calendar you selected, so we write to the calendar you chose. For a CRM connection it is deleted when you disconnect. For a rental calendar connection it is kept until you change it or ask us to delete it.
• Identifiers of events HiLucy created, so we can update or cancel the right event later. For CRM meetings we also keep the event's link, its Google Meet link and the address of the person who booked it. All of these are kept with the related meeting or booking record (see section 6).
• Timestamps of the last successful and last failed connection, so we can tell you when a connection has stopped working. Deleted when you disconnect.

We do not copy your calendar into our systems. We do not store your events, their contents, or your free/busy history. Free/busy data is requested when a scheduling screen needs it and is used to render that screen.

For Google Drive, we store nothing from Google. The access token stays in your browser and expires within an hour. We keep only what you choose to import, as your own records.

11.5 How we share it

We do not sell Google user data, and we do not transfer it to third parties for advertising or any independent purpose. It is disclosed only:

• to Google, in the course of making the API requests described above;
• to OpenAI, our AI provider, for PDFs and photos you pick from Google Drive, so it can read them and fill in the import screen. OpenAI processes them on our behalf as a service provider;
• to the prospect you are meeting, when you choose to text them the meeting details: the date, time and Google Meet link are sent by WhatsApp (through Meta) or by SMS (through Twilio);
• to the infrastructure providers that host HiLucy and act on our instructions as service providers;
• where we are required to by law, or to establish or defend a legal claim.

Events HiLucy creates can be seen by the people invited to them and by anyone the calendar is shared with. For CRM meetings that includes the HiLucy staff who share the team's prospect calendar. That sharing is controlled in Google Calendar, not by HiLucy.

Apart from what a feature shows you and your team as part of using it (for example, the list of booked meetings in the CRM), no one at HiLucy reads your Google user data, except: when you ask us to look at a specific item (for example, a meeting that did not reach your calendar); when we need to investigate a bug, abuse or a security incident; when the law requires it; or when the data has been aggregated and anonymized for internal operations.

11.6 Limited Use

HiLucy's use and transfer to any other app of information received from Google APIs will adhere to the Google API Services User Data Policy, including the Limited Use requirements.

11.7 How we protect it

Data passes between HiLucy and Google over encrypted connections. Tokens are held in our production database, access to which is restricted to the systems and staff that require it. Each connection is scoped to the person or property that created it, so one customer's connection cannot be used to reach another's calendar.

11.8 How to withdraw access and delete the data

You can end a calendar connection in either of two ways, and either is enough:

• In HiLucy: open the calendar settings for the connection and choose Disconnect. We delete the stored refresh token and discard any cached access token straight away. For a CRM connection we also ask Google to revoke HiLucy's access and delete your calendar choice. If HiLucy still appears in your Google Account's list of connected apps, remove it there as described next.
• In your Google account: visit myaccount.google.com/permissions, select HiLucy and choose Remove access. This revokes our tokens at Google, and HiLucy can no longer reach your calendar.

Disconnecting does not delete calendar events HiLucy already created; those remain on the calendar, and you can delete them in Google Calendar. To ask us to delete the identifiers we kept for those events, or any other data described in this section, contact us using the details below and we will do so.

Google sign-in and Google Drive access can also be removed at myaccount.google.com/permissions. Removing sign-in there does not delete your HiLucy account; to delete it, contact us using the details below.

11.9 Contact

Questions about this section, or requests to delete data covered by it, can be sent to [email protected]. We respond within 30 days.

12. Children's Privacy

Our services are not directed to individuals under 16 years of age. We do not knowingly collect data from children.

13. Changes to This Policy

We will notify you of material changes via email or in-app notice at least 30 days before they take effect.

14. Contact Us

Privacy inquiries: [email protected]
General support: [email protected]