Privacy Policy

1. Introduction

Lucy Financial, Inc. (“Lucy,” “we,” “us,” or “our”) is committed to protecting your privacy. This Privacy Policy explains how we collect, use, disclose, and safeguard your information when you use the Lucy card, our website at heylucy.io, and related services (collectively, the “Services”).

By accessing or using our Services, you agree to this Privacy Policy. If you do not agree, please do not use our Services.

2. Information We Collect

2.1 Information You Provide

• Name, email address, phone number, and mailing address
• Date of birth and Social Security Number (for identity verification)
• Employment information provided by your employer, including employer name, employment status, and payroll schedule
• Bank account information for payroll deduction setup
• Any information you provide when contacting our support team

2.2 Information Collected Automatically

• Device information (device type, operating system, unique device identifiers)
• Log data (IP address, browser type, pages visited, time and date of visits)
• Transaction data (purchase amounts, merchant names, transaction dates, repayment history)
• Location data (general geographic location derived from IP address)
• Cookies and similar tracking technologies

2.3 Information From Third Parties

• Employment and payroll data from your employer
• Identity verification data from third-party verification services
• Information from our banking and payment processing partners

3. How We Use Your Information

We use collected information to:

• Provide, maintain, and improve our Services
• Process transactions and manage your Lucy card account
• Verify your identity and eligibility for our Services
• Facilitate payroll-based repayments through your employer
• Calculate and credit cash-back rewards to your savings account
• Detect, investigate, and prevent fraudulent transactions and unauthorized access
• Communicate with you about your account, transactions, and service updates
• Comply with legal obligations, including anti-money laundering (AML) and Know Your Customer (KYC) requirements
• Analyze usage patterns to improve our products and user experience

4. How We Share Your Information

We do not sell your personal information. We may share your information with:

4.1 Service Providers

Third-party companies that perform services on our behalf, including payment processing, identity verification, fraud detection, data analytics, customer support, and cloud hosting. These providers are contractually obligated to use your information only for the purposes we specify.

4.2 Your Employer

We share limited information with your employer solely to facilitate payroll deductions for card repayment. This includes repayment amounts and schedules. We never share your individual purchase details, transaction history, or account balance with your employer.

4.3 Financial Partners

Our issuing bank and payment network partners as necessary to operate the Lucy card and process transactions.

4.4 Legal Requirements

When required by law, regulation, legal process, or governmental request, or when we believe disclosure is necessary to protect our rights, your safety, or the safety of others.

4.5 Business Transfers

In connection with a merger, acquisition, reorganization, or sale of assets, your information may be transferred. We will notify you of any such change.

5. Data Security

We implement industry-standard security measures to protect your information:

• TLS 1.2+ encryption for all data in transit
• AES-256 encryption for data at rest
• SOC 2 Type II certified infrastructure
• Role-based access controls with principle of least privilege
• Regular security audits and penetration testing
• Multi-factor authentication for internal systems
• Independent security reviews of all third-party vendors and API integrations

While we strive to protect your personal information, no method of transmission over the Internet or electronic storage is 100% secure. We cannot guarantee absolute security.

6. Data Retention

We retain your personal information for as long as your account is active or as needed to provide you Services. We also retain information as necessary to comply with legal obligations (including financial record-keeping requirements), resolve disputes, and enforce our agreements. Transaction records are retained for a minimum of seven (7) years as required by applicable financial regulations.

When your information is no longer needed, we securely delete or anonymize it.

7. Your Rights and Choices

Depending on your jurisdiction, you may have the right to:

• Access the personal information we hold about you
• Request correction of inaccurate or incomplete information
• Request deletion of your personal information, subject to legal retention requirements
• Opt out of marketing communications
• Request a portable copy of your data
• Withdraw consent where processing is based on consent

To exercise these rights, contact us at privacy@heylucy.io. We will respond to verified requests within 30 days.

8. Cookies and Tracking

We use cookies and similar technologies to operate our website, remember your preferences, and analyze site traffic. You can control cookies through your browser settings. Disabling cookies may affect the functionality of our Services.

We do not respond to Do Not Track (DNT) signals at this time. We do not use third-party advertising trackers on our Services.

9. Children's Privacy

Our Services are not directed to individuals under the age of 18. We do not knowingly collect personal information from children. If we learn that we have collected information from a child under 18, we will promptly delete it.

10. State-Specific Disclosures

California Residents (CCPA/CPRA)

California residents have additional rights under the California Consumer Privacy Act and California Privacy Rights Act, including the right to know what personal information we collect and how it is used, the right to delete personal information, the right to opt out of the sale or sharing of personal information (we do not sell your data), and the right to non-discrimination for exercising your privacy rights.

Other State Privacy Laws

Residents of Virginia, Colorado, Connecticut, Utah, and other states with comprehensive privacy laws may have similar rights. Contact us at privacy@heylucy.io to exercise your rights.

11. Changes to This Policy

We may update this Privacy Policy from time to time. We will notify you of material changes by posting the updated policy on our website and updating the “Last Updated” date. Your continued use of our Services after changes are posted constitutes acceptance of the revised policy.

12. Contact Us

If you have questions about this Privacy Policy or our data practices, contact us at:

Lucy Financial, Inc.
Email: privacy@heylucy.io
Website: heylucy.io