Your data.
Handled with care.

This Privacy Policy explains how Lucid AI (the "we", "us", or "our") collects, uses, stores, and protects your personal data when you visit lucidai.pro, submit our diagnostic form, contact us, or engage our services. We comply with the UAE Personal Data Protection Law (PDPL, Federal Decree-Law No. 45 of 2021) and apply it as our global minimum standard.

Who we are

Lucid AI is an AI services business operating from Dubai, United Arab Emirates. The founder and data controller is Dr Chadwick Foldy. You can reach us at [email protected].

What data we collect

When you submit the diagnostic form

• Your name, company, role, and email address
• The answers you provide to the seven maturity questions
• The slider values you set (team size, weekly manual hours, loaded cost)
• A generated reference code and timestamp

When you contact us directly

• Whatever information you voluntarily include in the email, WhatsApp message, or phone call

Automatically collected

• Standard server logs (IP address, browser user-agent, timestamp of request) — retained for 30 days for security and diagnostics
• No third-party cookies. No cross-site tracking. No ad networks.

How we use your data

We use your personal data exclusively to:

• Generate your personalised Strategic Readiness Brief and send it to you
• Reply to your enquiry and schedule a discovery call if you request one
• Provide the services you've engaged us for
• Send you invoices, contracts, and engagement-related correspondence
• Comply with our legal and regulatory obligations

We do not use your data for advertising, profiling, sale to third parties, or training any AI model — ours or anyone else's.

Legal basis for processing

We process your data on one or more of these lawful bases under the PDPL:

• Consent — you actively submit the diagnostic or contact form
• Performance of a contract — when you engage our services
• Legitimate interest — responding to your enquiry and operating our business
• Legal obligation — UAE tax, commercial, and regulatory requirements

Where your data is stored

All diagnostic submissions and correspondence are stored on infrastructure operated by our hosting provider within their UAE and EU data centres. For clients in regulated sectors (healthcare, finance, government), on-premise or UAE-sovereign cloud deployment is available on request.

How long we keep it

• Diagnostic submissions: retained for 24 months unless you request earlier deletion
• Client engagement records: retained for 7 years after engagement end, per UAE commercial law
• Marketing consent records: retained while consent is active, plus 12 months after withdrawal
• Server access logs: 30 days

Who we share it with

We share your personal data only with:

• Our hosting and email provider (Hostinger) — to deliver this website and your diagnostic email
• Our accountants and legal advisors — only when necessary, bound by professional confidentiality
• UAE authorities — only if legally compelled (court order, regulatory enquiry)

We never share your data with advertising networks, data brokers, AI-training providers, or any third party for their marketing purposes.

Your rights under PDPL

You have the right to:

• Access the personal data we hold about you
• Correct any inaccurate or incomplete data
• Delete your data (subject to our legal retention obligations)
• Restrict or object to processing for specific purposes
• Withdraw consent you previously gave, at any time
• Port your data to another service in a machine-readable format
• Complain to the UAE Data Office if you believe we've mishandled your data

To exercise any of these rights, email [email protected] with the subject line "Data subject request". We respond within 30 calendar days.

How we protect it

• TLS 1.3 encryption in transit for everything on this website
• SMTP over TLS for all outbound email
• Access controls on administrative systems — credentials are not shared
• No unnecessary data retention — we delete what we no longer need
• Regular backups with encryption at rest

No system is perfectly secure. If a data breach affects you, we will notify you and the UAE Data Office within 72 hours of becoming aware.

Verifiable digital credentials (Open Badges v3)

If you complete one of our training programmes (T1 AI Essentials for Business and the wider T-series), we issue you a verifiable digital credential in the Open Badges v3 / W3C Verifiable Credentials format. This is hosted in-house at lucidai.pro/verify/{your-badge-id} — we do not use Credly, Accredible, or any third-party badging platform.

The credential record contains:

• Public on the verify page: your name, the programme code (e.g. "T1 — AI Essentials for Business"), the cohort code, the completion date, your capability band (Beginner / Aware / Capable / Fluent), and a SHA-256 integrity hash. This information is publicly readable at the verify URL by anyone you share the link with — that is the point of a verifiable credential.
• Stored privately on our server: your email address (used only to send you the credential link and the 30-day and 90-day follow-up surveys). Your email is never displayed on the verify page.
• Not stored at all: your individual diagnostic-instrument answers. Only your cohort-level aggregate confidence/knowledge scores and band are recorded.

Your control over your credential: you may at any time request (a) deletion of your credential record, after which the verify URL will return "credential not found"; (b) correction of any factual error (name, date, cohort); (c) a copy of the full JSON-LD manifest stored under your badge ID. Email [email protected] with subject "credential request" — we action within 5 working days under UAE-PDPL Article 13.

LinkedIn integration: the verify page includes a one-click "Add to LinkedIn certifications" deeplink. Clicking it sends your badge ID, programme name, organisation, and issue date to LinkedIn so they can populate your profile. You control that disclosure — Lucid AI does not push your credential to LinkedIn without your action.

Cookies and tracking

This website uses no third-party cookies, no advertising trackers, no social-media pixels, and no cross-site fingerprinting. Your browser may store a small amount of local state (e.g. which tab you last visited) but this data never leaves your device.

Lucid Academy app (lucidai.pro)

If you create an account on our learning app, sign in via the iOS / Android app, or use the installable web app (PWA), we additionally process:

• Account data: email address, hashed password (bcrypt), display name, account creation date, last sign-in time, language preference, and time zone. Used to authenticate you and personalise the experience.
• Learning progress: which lessons you started / completed, lesson stage, quiz answers, sandbox chat transcripts, XP, streaks, badges earned, daily challenge completions, lesson templates you saved. Used to track your learning journey and unlock content. Sandbox transcripts may include any text or PDFs you upload while practising — keep that in mind before pasting confidential content.
• Subscription & billing data: if you upgrade to Pro or buy a Professional Certificate track, payment is processed by Paddle (Paddle.com Market Ltd), our payment provider and Merchant of Record. Paddle handles your card data directly — we never see or store card numbers. We retain a Paddle customer / transaction ID, subscription status (active / past_due / canceled), plan tier, billing period, and the email on your Paddle account, used solely to grant the right access and to handle billing and refunds. As Merchant of Record, Paddle is the seller of record for your purchase and handles applicable sales tax / VAT. See Paddle's Privacy Policy.
• Web push notifications: if you opt in to lesson reminders, we store a push subscription endpoint, a per-browser p256dh key, and a VAPID auth secret. Used only to send the reminders you signed up for. Revoke any time via Settings → Notifications, or by uninstalling the app.
• Microphone (voice mode): some lessons let you speak instead of type. We use your browser's built-in SpeechRecognition API. Audio is processed by your operating system / browser locally (or by your OS vendor's speech service, e.g. Apple, Google) — we do not record, transmit, or store the audio ourselves. Only the transcribed text is sent to our servers, and only when you press Send.
• Anonymised in-app telemetry: page views, error reports, lesson-completion events. No third-party analytics, no advertising SDKs, no IDFA / Advertising ID access, no cross-app tracking.

Account deletion: you can permanently delete your Lucid Academy account at any time from Settings → Account → Danger Zone → Delete my account (in-app, no email or support ticket required). On deletion we erase or anonymise your email, name, passwords, sessions, push subscriptions, lesson transcripts, and notification preferences. Paddle transaction records are retained for the legally required 7 years for tax / accounting purposes (UAE Federal Decree-Law No. 47 of 2022); these contain no personal data beyond your former customer ID and amounts paid.

Data shared with platform stores: if you install Lucid Academy from the Apple App Store or Google Play, those platforms separately collect download / install metrics governed by Apple's Privacy Policy and Google's Privacy Policy. Lucid AI does not receive identifiable user-level data from these stores.

Children's privacy

Our services are intended for users aged 16 and over. Account creation requires explicit age confirmation. We do not knowingly collect data from anyone under 16. If we discover we have inadvertently done so, we will delete it immediately. To request review of a suspected under-16 account, email [email protected].

Changes to this notice

We may update this Privacy Policy to reflect changes in our practices or the law. The "Last updated" date at the top reflects the most recent material change. If we change anything significant, we will notify people who have given us their email within 14 days.

Contact us

Questions about this Privacy Policy? Email [email protected].