Privacy Notice

Last updated: 14 October 2026

Applies to: lucentstar.ai and the LucentSignal application

Website enquiries

When you submit a website enquiry, we use your name, email address, message and any company or topic you provide to respond and manage the related conversation. Our Railway-hosted endpoint sends the enquiry through Resend to our hello@lucentstar.ai mailbox, provided through 123 Reg and powered by Titan. The application does not save enquiry message bodies to its database. You can also email hello@lucentstar.ai directly. Sending an enquiry does not subscribe you to marketing.

Website and blog analytics

The website, blog, sign-in and welcome pages use Google Analytics only after you accept optional analytics. Google receives usage information such as pages visited and device and browser information. Your choice is stored on your device separately for each service and can be changed through Cookie settings. The signed-in application uses the same analytics preference as its sign-in and welcome screens. Reject prevents the analytics loader and optional app events; withdrawal disables further analytics. See our Cookie Policy for the scope of these controls.

This Privacy Notice explains how LucentStar AI Ltd collects, uses, stores, and protects your personal data when you visit our website at lucentstar.ai or use the LucentSignal platform. It applies to both our marketing website and our authenticated SaaS application.

1. Who We Are

LucentStar AI Ltd is the data controller responsible for your personal data. We are a UK-based digital software and AI services business, the operator of lucentstar.ai and the LucentSignal content generation platform.

Registered company: LucentStar AI Ltd
Trading name: LucentStar AI
Company number: 17492207
Registered office: 71-75 Shelton Street, Covent Garden, London, United Kingdom, WC2H 9JQ
Email: hello@lucentstar.ai

2. What Data We Collect

2.1 Data you provide directly (website)

Name and contact details (email address, phone number, postal address)
Business name and job title
Messages or enquiries submitted via contact forms
Information provided when signing up to our mailing list
Any other information you choose to share with us

2.2 Data you provide when creating a LucentSignal account

Full name and email address (used for authentication and communications)
Password (stored as a one-way bcrypt hash; we never store your password in plain text)
Marketing communications preference (opt-in, recorded at registration)

2.3 Data you create inside the LucentSignal application

Post content you draft, generate, save, schedule, or export
Ghost writing profile data (your professional identity, tone preferences, audience details)
Brand voice files you upload (.txt or .md format)
Prompts and topics you submit to the content generation system
Content calendar entries and scheduled dates

2.4 Data collected automatically

IP address and device information
Browser type and version
Pages visited and time spent on the site
Referring website or search terms used to find us
Session identifiers (stored in our PostgreSQL database via secure session cookies)
Application usage data (post generation counts, plan status, subscription events)
Cookie and tracking data (see our Cookie Policy)

2.5 Billing and subscription data

Subscription plan and status (Free, Creator, or Pro)
Stripe customer identifier and subscription identifier
Payment event history (subscription created, upgraded, downgraded, payment failed, payment recovered)

We do not store your full payment card details. All payment processing is handled by Stripe. We receive only a customer reference and event notifications from Stripe.

3. How We Use Your Data

We process your personal data for the following purposes:

To respond to your enquiries and provide customer support
To create and manage your LucentSignal user account
To authenticate you and maintain secure sessions
To generate AI-powered content on your behalf using your submitted prompts
To enforce your subscription plan entitlements (post limits, feature access)
To process subscription payments and manage billing events via Stripe
To send transactional emails (account confirmation, password reset, usage alerts, billing notifications)
To send marketing communications where you have given consent
To improve our website, application, and user experience
To comply with our legal obligations
To prevent fraud and maintain security

4. AI Processing: How Your Prompts Are Used

LucentSignal uses the Claude API, operated by Anthropic PBC, to generate content on your behalf. When you submit a topic, ghost writing profile, or brand voice instruction to the generator, that input is transmitted to Anthropic's API for processing.

You should be aware that:

Your prompts and generation inputs are sent to Anthropic as part of the API call
Anthropic processes these inputs in accordance with its own privacy policy and API usage policies, available at anthropic.com/privacy
LucentStar AI Ltd does not use your content to train AI models
Anthropic's data processing terms apply to the processing of your inputs at the model level
AI-generated outputs may contain inaccuracies or errors; you are responsible for reviewing content before publishing

We recommend you do not include sensitive personal data or confidential information in the content prompts you submit to the generator.

5. Legal Basis for Processing

Under UK GDPR, we rely on the following legal bases:

Contract: Processing necessary to provide the LucentSignal service under your subscription agreement, including account management, content generation, billing, and quota enforcement.
Legitimate interests: Processing for our business purposes where these do not override your rights, including responding to enquiries you choose to send us, security monitoring, fraud prevention, application performance, and service improvement.
Consent: Where you have given clear consent for optional analytics on the website, blog, sign-in and welcome pages, and for marketing emails (opt-in at registration or via account preferences).
Legal obligation: Where we are required to process or retain data to comply with applicable law, including financial records.

6. Marketing Communications

We will only send you marketing emails if you have opted in to receive them at registration or subsequently via your account settings. You can unsubscribe at any time by clicking the unsubscribe link in any email or by updating your preferences in the LucentSignal account page. We do not pass your contact details to third parties for marketing purposes.

7. Our Data Processors (Subprocessors)

We use the following third-party processors to operate LucentStar AI Ltd and LucentSignal. All processors are required to process your data securely and in accordance with applicable data protection law.

Anthropic PBC: AI content generation. Receives prompt inputs submitted to the LucentSignal generator. USA (Standard Contractual Clauses).
Stripe Inc.: Subscription billing and payment processing. Receives billing-related data and payment events. USA (Standard Contractual Clauses / UK Addendum).
Resend Inc.: Transactional and marketing email delivery. Receives recipient and message details for sending. Receives website enquiry details to deliver them to our business mailbox; this does not create a marketing subscription. USA (Standard Contractual Clauses).
123 Reg / Titan: Business email hosting for hello@lucentstar.ai. Receives and stores enquiries and related correspondence. See the 123 Reg privacy policy and Titan data processing terms for their processing and international-transfer provisions.
Railway Corporation: Application hosting and managed PostgreSQL database. Stores all application data including user accounts, posts, and sessions. USA (Standard Contractual Clauses).
Google Analytics: Optional usage analytics on the website, blog, sign-in and welcome pages after acceptance, and the signed-in application after acceptance. The website and app tags use the Lucent Star Website Analytics property. Its event-data retention setting is two months; its user-data setting is 14 months and resets on new activity. These settings do not limit aggregated standard reports. Google’s UK Analytics service terms identify Google Ireland Limited, with data processing governed by the Google Ads Data Processing Terms. See how Google uses information from sites and apps.

We maintain a current list of subprocessors at lucentstar.ai/subprocessors. We will provide reasonable notice of any material changes to our subprocessor list.

8. International Transfers

Some of our processors are based outside the UK (see Section 7). Where we transfer personal data internationally, we ensure appropriate safeguards are in place. For transfers to the USA, we rely on Standard Contractual Clauses approved by the UK ICO (or equivalent international data transfer agreements), supplemented where necessary by transfer impact assessments.

9. Data Retention

We retain your personal data only for as long as necessary for the purposes described in this policy, or as required by law.

Active account data (profile, posts, ghost profile, brand voice): Retained while your account exists. When you delete your account, the application deletes your account record, posts and Ghostwriter profile from its active database. Records held separately for billing, legal obligations or by service providers follow their own retention arrangements.
Session data: The session cookie expires after seven days. Logout destroys the active session; expired stored sessions are cleaned up by the session store.
Billing and financial records: 7 years from the date of the relevant transaction (legal obligation).
Marketing consent records: Retained until you withdraw consent.
Password reset tokens: Valid for one hour and can be used once. Used tokens are marked as unavailable; expired tokens cannot reset your password. Account deletion removes that account’s stored reset tokens.
Enquiry and contact form data: We retain enquiry emails and related correspondence for as long as necessary to handle your enquiry and related conversation, subject to any applicable legal obligations.
Website analytics data: Event data: two months. User data: 14 months, renewed when new activity is recorded. These are the current property settings checked on 3 October 2026; aggregated standard reports are not subject to these retention settings.

10. Your Rights

Under UK GDPR, you have the following rights:

Right of access: to request a copy of the personal data we hold about you
Right to rectification: to ask us to correct inaccurate or incomplete data
Right to erasure: to ask us to delete your data in certain circumstances
Right to restriction: to ask us to limit how we use your data
Right to data portability: to receive your data in a structured, machine-readable format; you can export your saved posts from the LucentSignal dashboard at any time
Right to object: to object to processing based on legitimate interests or for direct marketing
Rights related to automated decision-making: to not be subject to solely automated decisions that significantly affect you

To exercise any of these rights, please contact us at hello@lucentstar.ai. We will respond within one calendar month. You also have the right to lodge a complaint with the Information Commissioner's Office (ICO) at www.ico.org.uk or by calling 0303 123 1113.

11. Account Deletion and Data Erasure

You may request deletion of your LucentSignal account and associated personal data at any time by contacting hello@lucentstar.ai with the subject line "Account deletion request". We will process your request within 30 days.

On account deletion, we will:

Delete your account credentials, ghost writing profile, brand voice data, and all saved posts
Cancel any active subscription via Stripe
Retain billing and financial records for the legally required 7-year period
Retain anonymised usage statistics that cannot be linked back to you

A self-service account deletion option within the LucentSignal account settings page is planned for a future release.

12. Security

We take the following measures to protect your personal data:

Passwords are hashed using bcrypt with a high cost factor; we never store passwords in plain text
Sessions are stored server-side in a PostgreSQL database with secure, HTTP-only, same-site cookies
Session IDs are rotated on login and registration to prevent session fixation attacks
Password reset invalidates all active sessions for your account
All data transmission uses HTTPS/TLS encryption
Access to production systems is restricted to authorised personnel only

No data transmission over the internet is completely secure, and we cannot guarantee the absolute security of data you send to us. Please notify us immediately at hello@lucentstar.ai if you suspect any unauthorised access to your account.

13. Cookies

Our website and application use cookies. For full details, please see our Cookie Policy at lucentstar.ai/cookie-policy. The sign-in and welcome screens provide their own analytics choices. Choices on the website, blog and app are stored separately for each service. The sign-in, welcome and signed-in app share the preference on the application origin.

14. EU Users and Representative

LucentSignal is accessible to users in the European Union. At the current stage of the business, we do not have a formally appointed EU representative under Article 27 of the EU GDPR. If you are an EU-based user with a data protection query, please contact us at hello@lucentstar.ai. We will update this section on appointment of an EU representative.

15. Changes to This Policy

We may update this Privacy Notice from time to time. Any material changes will be communicated to registered users by email. Changes will also be posted on this page with a revised effective date. This policy was last updated on 14 October 2026.

16. Contact Us

For any queries relating to this Privacy Notice or your personal data, please contact:

Email: hello@lucentstar.ai
Registered office: 71-75 Shelton Street, Covent Garden, London, United Kingdom, WC2H 9JQ