This Privacy Policy describes how Lucidya, including its affiliates (“Lucidya,” “we,” “b,” or “our”), collects, uses and shares Personal Information when individuals who are our business customers’ or prospective Customers’ (“Customers”) employees, agents and other representatives visit our website at www.lucidya.com or any other website to which we post this Policy (the “Site(s)”), use Lucidya products,  platforms, or solutions provided by us to our Customers (including demos and trials) (collectively, the “Services”), or receive and respond to our communications. With respect to such information, Lucidya is the “controller” of your Personal Information covered by this Privacy Policy. We recommend that you regularly review this policy to stay informed about any updates or modifications that might be done. 

For purposes of this Privacy Policy, “Personal Information” refers to information that identifies, relates to, describes, is reasonably capable of being associated with, or could reasonably be linked, directly or indirectly, to you, and includes “personal data” or similar terms as defined in applicable law.

This Privacy Policy pertains to the collection, use, storage, and disclosure of Personal Information collected from or about you in the following ways: 

• through the Site where this Privacy Policy is posted or linked;
• in connection with the delivery of our Services to our Customers;
• in connection with our business development and marketing activities; and
• through our offline and business interactions.

While we are responsible for processing your Personal Information as the controller of this data, it’s important to note that this Privacy Policy does not apply to Personal Information that Lucidya processes as a processor (or service provider) on behalf of our Customers. In these situations, our Customers are the ones who control the Personal Information they upload or store in our Services, as well as any information they may process from publicly available sources using Lucidya’s Services. If you are an end user of a Customer or would like more information on the Personal Information we may process on behalf of our Customers, please refer to the section titled “Lucidya’s Role as a Service Provider” below.

For individuals residing in the Kingdom of Saudi Arabia (“Saudi Data Subjects”), please see Additional Information for Saudi Data Subjects for more information.

2. Notice at Collection of Personal Information

This section serves as our “Notice at Collection of Personal Information” as required by California law. We collect the following categories of Personal Information identified below. Some of these categories we “sell” or “share” (as such terms are defined in California law) for marketing and advertising purposes to business partners and third parties, such as data analytics providers, advertising technology vendors, third-party advertising networks, and social media platforms. We also use these categories for business purposes, such as maintaining our Site and operating the Services. 

We do not knowingly sell or share Personal Information about persons under the age of 18. Please click the “Do Not Sell or Share My Personal Information” link in the footer of our Site to opt out of the sale or sharing of your Personal Information, including for targeted advertising. You may also choose to enable online, where available, a universal tool that automatically communicates your opt-out preferences, such as the Global Privacy Control (“GPC”). Where technically feasible, we will process the GPC signal as a request to opt-out. 

California residents can find out more about their rights here.‍

3. Categories of Personal Information We Collect

4. Business And Commercial Purposes For Processing Your Personal Information

We use your Personal Information for the following business purposes and as otherwise described to you in this Privacy Policy or at the time of collection:

• To provide the Site and Services. We use your Personal Information:
  
  • to provide, operate and improve the Site and Services, including to provide you demos or create your account for the Services;
  • to communicate with you regarding the Services, including by sending you announcements, updates, and support and administrative messages, and to engage in customer support;
  • to understand your needs and interests, and personalize your experience with the Site and Service; and
  • to respond to your requests, questions and feedback related to the Service or the company if you have contacted us as an investor.
• For research and development. We analyze how our users use the Sites to study trends and users’ movements around the Sites, gather demographic information about our users and customers, improve the Service, and develop new products and services.
• To send you product and event information. We may send you information regarding our products or future events that you may be interested in, but you may opt-out of receiving such communications as described below.
• To market and advertise our Site and Services. We use your information for targeted advertising and to show you ads we may think are relevant about our Services.
• To create aggregated data. We may create aggregated data from our users’ information. We generate and maintain such data by aggregating  it and removing information that makes the data personally identifiable. We may use this anonymous data and share it with third parties to understand and improve our Services and for other lawful business purposes.
• In connection with business transactions. We use Personal Information to carry out sales and business transactions in which information held by us is among the assets transferred or is otherwise relevant to the evaluation, negotiation, or completion of the transaction, including in connection with a bankruptcy.
• For compliance, fraud prevention and safety. We may use your Personal Information as we believe appropriate to (a) protect our, your or others’ rights, privacy, safety or property (including by making and defending legal claims); and (b) protect, investigate and deter against fraudulent, harmful, unauthorized, unethical or illegal activity.
• For compliance with law. We may use your Personal Information as we believe appropriate to (a) comply with applicable laws, lawful requests and legal process, such as to respond to subpoenas or requests from government authorities; and (b) where permitted by law in connection with a legal investigation.
• With your consent. In some cases we may ask for your consent to collect, use or share your Personal Information, such as when required by law.

5. Retention

We retain Personal Information where we have an ongoing legitimate business need to do so (for example, to provide you with a service you have requested; to comply with applicable legal, tax or accounting requirements; to establish or defend legal claims; or for fraud prevention). When we have no ongoing legitimate business need to process your Personal Information, we will either delete, anonymize or de-identify it or, if this is not possible (for example, because your Personal Information has been stored in backup archives), then we will securely store your Personal Information and isolate it from any further processing until deletion is possible. 

Saudi Data Subjects, please review this section.

6. How We Collect Personal Information

We collect your Personal Information in a number of ways, from various sources: 

1. Information you give us

Personal information you may provide through the Site or Services or otherwise communicate to us includes:

• Contact details. When you contact us through the Site, register for an account, or otherwise communicate with us, we may collect information such as the username and password you establish, your first and last name, business email and mailing addresses, business phone number, professional title, and company name.
• Correspondence. We may collect information about you when you request information from us or otherwise correspond with us.
• Product interests. If you contact us regarding our Services, we may collect the information you provide to us relating to your interests.
• Event information. If you register for or participate in our events, we may collect the information you provide to us in connection with the event.
• Account information. If you have an account, we collect information related to your use of our Services in order to manage our relationship with you, including the Customer on whose behalf you are registered, when you access the Services, how you use the Services, billing information and any other information related to your account.
• Other information. We may collect other information from you that is not specifically listed here. We will use such information in accordance with this Privacy Policy.

2. Information we get from others

We may receive Personal Information about you from third parties and business partners, including companies that co-sponsor our promotions (e.g., trade shows at which we are present, joint marketing partners); marketing/advertising and analytics partners, including online advertising networks and analytics providers; social media platforms (note that the information we receive from such platforms is dependent upon their policies and your settings on the platforms); and other companies that provide Personal Information to supplement what we already know about you, including data aggregators.

3. Information automatically collected

Our servers and third-party service providers may automatically record certain information about how you use the Site and Services, including: 

• Device information, such as your Internet Protocol (IP) address, domain name, device and browser type, operating system, Internet service provider, etc.
• Usage information, such as referring/exit pages, the pages or features of the Site that you browse and the time you spend on those pages or features, the frequency with which you use the Service, links that you click on or use and other statistics. Usage information may also capture keystrokes, mouse movements, form field entries, recordings of chat sessions, your use of and inputs to other AI-supported tools, and other use of and overall engagement with our Site and Services.  
• Marketing information, including, for example, if you receive an email from us, in which case we may collect information about your interactions with the message (e.g., whether you opened, forwarded, or clicked through to our Site).
• Cookies and similar technologies, placed by us or our third-party partners, used to track your browsing activity and ensure that you are recognized on the Site. We may also use these technologies to improve your experience. For example, we may use this information to enhance and personalize your user experience, to monitor and improve our Site and Services, and to improve the effectiveness of our Services, offers, advertising, communications, and features such as live and automated chat and customer service.

We (and our partners and service providers) use the following types of cookies:

• Strictly necessary cookies. These cookies are essential to enable you to move around the Sites and use its features. These cookies allow us to provide some of the basic functionalities of the Sites.
• Analytics cookies. These cookies generally collect information about how visitors use the Sites so that we can improve our Services. These cookies do not collect identifiable information.
• Personalization cookies. These cookies allow the Sites to remember the choices you make as you browse the Sites. They provide more enhanced and personal features. The information collected is anonymized, and they cannot track browsing activity on other sites once you leave the Sites.
• Targeting/advertising cookies. These cookies may be set by our advertising partners, including social media platforms. They may be used by our partners to build a profile of your interests and show you relevant advertisements on other online services, which is known as “interest-based advertising.” These cookies uniquely identify your browser and device and observe your behaviors and browsing activities over time across multiple websites or platforms.

For more information, please visit our Cookies Policy.

4. Combination of information

We may link or combine the Personal Information we collect directly from you and the information we collect automatically or receive from third parties. We will treat combined information with the same protections provided under this Privacy Policy.

5. De-identified information

As noted above, we may anonymize, de-identify and aggregate any of the Personal Information we collect, including information about individuals that are your subscribers, website visitors or customers so that it does not directly identify you or them, and is no longer considered Personal Information under this Privacy Policy. In such cases, we will maintain and use the information in deidentified form and will not attempt to reidentify the information unless permitted by applicable laws. We may use such information for purposes that include testing our IT systems, research, data analysis, improving the Services and developing new products and features, and we may share this information with other parties.

6. How We Disclose Your Personal Information

We disclose your Personal Information in the following circumstances:

• Affiliates. We may disclose your Personal Information to our subsidiaries and affiliates for use consistent with this Privacy Policy.
• Service providers. We may disclose your Personal Information to companies and individuals as needed for them to provide us with services that help us with our business activities and to provide the Service (such as customer support, hosting and storage, website analytics and legal and other professional advice). These third parties will be given limited access to your Personal Information that is reasonably necessary for them to provide their services.
• Targeted advertising partners. When you access our Site, we, along with our third-party partners, data analytics providers, advertising technology vendors, and social media platforms may collect and use Personal Information to serve you interest-based advertising. These disclosures may constitute a “sale” or “share” of your Personal Information, as described above in the Notice at Collection.
• Business partners. We may disclose your Personal Information to our business partners who jointly offer a service or co-sponsor promotions or events. We do not control how these business partners handle your Personal Information, which is governed by their own privacy policies. If you have questions about our business partners’ privacy practices, we encourage you to contact them.
• For legal reasons. We may disclose your Personal Information as we believe appropriate to government or law enforcement officials or private parties for the purposes described above under the following sections: “For compliance, fraud prevention and safety and compliance with applicable law.” We may also disclose your Personal Information to protect our rights, privacy, safety, property and/or those of others; to conform to the edicts of the law or comply with a legal process served on Lucidya; or to assist, under exigent circumstances, in the investigation of violations of applicable laws and regulations.
• Business transfers. We may sell, transfer or otherwise disclose some or all of our business or assets, including your Personal Information, in connection with a business deal (or potential business deal) such as a corporate divestiture, merger, consolidation, acquisition, reorganization or sale of assets, or in the event of bankruptcy or dissolution.

7. How We Store and Protect Your Personal Information

We have in place organizational, technical and physical safeguards designed to protect against the loss, misuse or alteration of the Personal Information under our control, including through the use of physical, organizational, and technological measures and appropriate training of employees. At Lucidya, we fulfill our duty by implementing necessary precautions to safeguard against data loss or tampering by third parties. Conversely, it is the Customer’s responsibility to ensure the security of their data through measures such as employing virus screening software, configuring browser settings, setting strong and unique passwords known only to them, and utilizing other available security protocols to prevent interception by unidentified third parties. 

Your Personal Information may be transferred, stored, or processed on multiple servers located in Saudi Arabia, in the United States and elsewhere. Privacy laws in the locations where we handle your Personal Information may not be as protective as the privacy laws in your home country. Any such transfer will only take place in accordance with the conditions set out in applicable laws, including where the receiving country provides an adequate level of protection, where appropriate safeguards (such as contractual clauses) are in place, or where the transfer is otherwise permitted under the PDPL. You may request further information about the safeguards we have put in place by contacting us at privacy@lucidya.com. By submitting your Personal Information or using our Services, you agree to this processing and transfer.

8. Additional Information for Saudi Data Subjects

This section supplements this Privacy Policy and provides additional information for Saudi Data Subjects. Where any provision of this section conflicts with the general provisions of this Privacy Policy, the provisions of this section shall prevail with respect to the Personal Information of Saudi Data Subjects.

Lucidya confirms that it processes Personal Information of Saudi Data Subjects in accordance with the Saudi Personal Data Protection Law (Royal Decree M/19, dated 9/2/1443H, as amended) and its Implementing Regulations (together, the “PDPL”).

1. Legal Bases for Processing Under the PDPL

We process the Personal Information of Saudi Data Subjects on one or more of the following legal bases recognized under the PDPL: 

• Consent. Where required by the PDPL, we obtain your explicit, informed, and freely given consent before collecting or processing your Personal Information. You may withdraw your consent at any time by contacting us at privacy@lucidya.com. Withdrawal of consent does not affect the lawfulness of processing carried out prior to withdrawal, but we will cease further processing based on that consent upon receipt of your request. 
• Performance of a Contract. We process Personal Information where it is necessary for the performance of a contract to which you are a party, or in order to take steps at your request prior to entering into a contract. 
• Compliance with a Legal Obligation. We process Personal Information where it is necessary for compliance with a legal obligation to which Lucidya is subject under Saudi law or other applicable laws. 
• Protection of Vital Interests. We may process Personal Information where it is necessary to protect the vital interests of the data subject or another natural person.
• Achieving a Public Interest. We may process Personal Information where it is necessary for the achievement of a public interest recognized under applicable Saudi law.
• Legitimate Interest of the Data Subject. We may process Personal Information where the processing serves the legitimate interest of the data subject, provided such processing does not prejudice the data subject’s rights. 

We do not rely on a general “legitimate interest of the controller” basis, as this concept does not have the same recognition under the PDPL as under other data protection frameworks. Where a processing activity was previously justified on such a basis, we have identified an alternative PDPL-compliant legal basis as set out above or will obtain your explicit consent. ‍

2. Sensitive Personal Data

The PDPL defines “sensitive data” broadly. Categories of sensitive Personal Information that we may process in connection with the Services include but are not limited to: Personal Information only, such as names, phone numbers, email addresses, and other information voluntarily shared by individuals. If sensitive Personal Information is inadvertently included in user-generated content or provided by customers, we process it solely to provide the Services and in accordance with applicable law.. 

We will only process sensitive Personal Information of Saudi Data Subjects with your explicit consent, unless the PDPL provides an alternative legal basis. We implement enhanced technical and organizational measures to safeguard sensitive Personal Information, including encryption, access controls, and regular security assessments. 

3. Data Subject Rights Under the PDPL

If you are a Saudi Data Subject, you have the following rights under the PDPL, which you may exercise by contacting us at privacy@lucidya.com: 

• Right to Be Informed. You have the right to be informed of the legal basis for the collection of your Personal Information, the purpose of collection, and the identity of any party to whom your Personal Information will be disclosed.
• Right of Access. You have the right to request access to the Personal Information we hold about you, including copies of such information. 
• Right to Rectification. You have the right to request correction of any inaccurate or incomplete Personal Information we maintain about you. 
• Right to Destruction. You have the right to request the destruction of your Personal Information where retention is no longer necessary for the purpose for which it was collected, or where you withdraw your consent and no other legal basis justifies continued processing. We will comply with verified destruction requests within thirty (30) days, unless an extension is required by law or operational necessity, in which case we will inform you accordingly. 
• Right to Object to Processing. You have the right to object to the processing of your Personal Information in certain circumstances, including where processing is carried out for direct marketing purposes. 
• Right to Restriction of Processing. You have the right to request that we restrict the processing of your Personal Information in certain circumstances. 
• Right to Data Portability. You have the right to receive your Personal Information in a structured, commonly used, and machine-readable format, and to transmit that information to another controller where technically feasible. 
• Right to Withdraw Consent. Where processing is based on your consent, you may withdraw that consent at any time without affecting the lawfulness of processing based on consent before its withdrawal. 
• Right Not to Be Subject to Automated Decision-Making. You have the right not to be subject to a decision based solely on automated processing, including profiling, that produces legal effects concerning you or similarly significantly affects you. 
• Right to Lodge a Complaint. You have the right to lodge a complaint with the Saudi Data and Artificial Intelligence Authority (“SDAIA”) or the competent authority designated under the PDPL if you believe that your rights under the PDPL have been violated. 

We will respond to verified requests within the timeframes required by the PDPL and will not charge a fee for processing such requests unless the request is manifestly unfounded or excessive.

4. Data Retention Periods

We retain Personal Information of Saudi Data Subjects only for as long as is necessary to fulfill the purposes for which it was collected, or as required by applicable law. Below are the general retention periods applicable to key categories of Personal Information:

Upon expiration of the applicable retention period, we will securely destroy, anonymize, or de-identify Personal Information in accordance with our data destruction procedures, which ensure that information is irretrievable and cannot be reconstructed. 

5. Data Breach Notification

In the event of a personal data breach affecting the Personal Information of Saudi Data Subjects, Lucidya will notify SDAIA or the competent authority designated under the PDPL, and where appropriate, affected data subjects, in accordance with the timelines and requirements set out in the PDPL.

6. Data Protection Officer and Saudi Representative

Lucidya has appointed a Data Protection Officer (“DPO”) who is responsible for overseeing compliance with the PDPL and other applicable data protection laws. You may contact our DPO at:

• Data Protection Officer Email: privacy@lucidya.com

In addition, and in accordance with the PDPL, Lucidya has designated a representative in the Kingdom of Saudi Arabia. The Saudi representative may be contacted at:

• Lucidya Saudi Representative: Lucidya LLC, Prince Turki Bin Abdulaziz Al Awwal Rd, Al Mohammadiyyah, Riyadh 12362, Saudi Arabia | Email: privacy@lucidya.com | Telephone: 1-833-719-7738

7. Processor Obligations Under the PDPL

Where Lucidya processes Personal Information on behalf of its Customers as a processor, we do so in accordance with the instructions of the relevant Customer (as controller) and subject to a written data processing agreement. Our data processing agreements address the requirements of the PDPL, including the scope and purpose of processing, confidentiality and security obligations, restrictions on sub-processing, and obligations to assist the controller with data subject rights requests and compliance. Customers who wish to review or negotiate data processing terms are encouraged to contact us at privacy@lucidya.com.

‍

‍

‍

‍

‍