Privacy Policy

This policy explains how Lokuna Inc. (“Lokuna”, “we”) collects, uses, discloses, and protects personal information in connection with the Lokuna service at app.lokuna.com. It is written to satisfy the transparency requirements of Quebec’s Act respecting the protection of personal information in the private sector (as amended by Law 25), PIPEDA, and — for users in the European Economic Area/UK — the GDPR.

1. Who is responsible

For operator accounts (the businesses that subscribe to Lokuna), Lokuna determines the purposes of processing and is the organization responsible (controller). For end-customer information (the customers of those businesses), the operator is responsible (controller) and Lokuna acts as its service provider (processor) under a Data Processing Addendum. If you are an end-customer, direct requests about your information to the business you have the relationship with; we will assist them in responding.

Person in charge of the protection of personal information (Privacy Officer): Elliot Charette, Founder & CEO — reachable at info@lokuna.com. This designation is published in accordance with Law 25.

2. Information we collect

Operator account information (from you)

• Identification and contact: name, business email, company name, website, timezone.
• Credentials: password (hashed by our authentication provider), session cookies.
• Configuration: sender identities, brand voice settings, offer guardrails, business profile facts you provide, and — encrypted — credentials for email/SMS providers you connect.
• Google account information, if you connect Gmail or sign in with Google: your email address, name, and profile picture, plus an encrypted permission to send email from your mailbox and to read customer replies in it (Section 7).
• Microsoft or GitHub account information, if you sign in with Microsoft or GitHub: your name and email address, used only to create and sign in to your Lokuna account.
• Billing: your Lokuna subscription and metered-usage records. Payment card details are collected by Stripe directly; we never receive card numbers.
• Support and correspondence with us.

End-customer information (processed for operators)

• From the operator’s connected Stripe account: name, email address, phone number, subscription plan, billing status, subscription amounts (MRR), start/renewal/trial dates, timezone, and language.
• Message and engagement records: emails and SMS sent by the retention agent, delivery, open, click, bounce, and complaint events, and unsubscribe/STOP status.
• Content end-customers write: replies to emails and SMS, and free-text answers on the cancellation page (for example, the reason for cancelling).
• Where the operator connects a support tool (Intercom, Zendesk, HubSpot, Freshdesk, Help Scout): ticket status and sentiment signals associated with the customer.
• Where the operator connects PostHog (optional, with a read-only key): aggregated product usage per customer, such as last-seen date, number of active days, onboarding steps reached, features used, product areas visited, repeated errors in an area, and usage against a plan limit. We do not copy raw events, event properties, IP addresses, locations or session recordings, and we store nothing for people who do not match a customer, except teammates the operator confirms as part of a customer’s account (we keep their email address only to count their activity for that account; the operator can remove it at any time).
• Derived signals: churn-risk and account-health scores computed from the above. Each daily score is kept with its inputs and the reason it changed, so that billing based on it can be checked.

We do not collect government identifiers, payment card numbers, health, or biometric information, and we ask operators not to submit such data to the Services.

3. How we use information (purposes)

• Providing the Services: detecting churn and payment risk and taking the retention actions the operator has authorized (messages, offers, the cancellation page).
• Generating message copy with AI (Section 5).
• Billing, including computing metered Performance Fees.
• Security, abuse prevention, and troubleshooting.
• Communicating with operators about their account and the agent’s activity (e.g., weekly digests).
• Producing aggregated, de-identified statistics that do not identify anyone.
• Improving how Lokuna chooses retention offers, using the outcomes of past offers: for each business, its own outcomes; across businesses, only aggregated, de-identified outcome statistics (Section 5).

We do not sell personal information, do not use end-customer information to market Lokuna itself, and do not use identifiable customer content (such as names, email addresses, messages, or what a customer wrote) to train or fine-tune our own or third-party AI models.

Where the GDPR applies, our legal bases are: performance of a contract (providing the Services to operators), legitimate interests (security, service communications, de-identified analytics), and consent where required. Operators are responsible for their own lawful basis to contact their customers.

4. Automated processing

Churn-risk scoring and send decisions are performed by automated rules applied to the information described above. On a cancellation page, the retention offer shown is recommended by an AI model (Section 5) within limits set by the business and enforced by automated rules. The measured results of past offers also shape which offers are considered, and a small share of visits (about one in ten) may be shown a different allowed offer that suits the reason given, chosen at random in proportion to how promising it is, so that results can be measured fairly. Every offer shown stays within the business’s limits. None of this involves human review unless the operator enables a review mode. If you are an end-customer and wish to make observations about, or request human review of, an automated retention decision that affected you (for example, an offer you were or were not shown), contact the business you deal with or info@lokuna.com; a person will review the decision.

5. AI-generated content

Message copy, cancellation-page copy, reply drafts, health-score explanations, customer feedback summaries, and segment filters are generated by large language models accessed through OpenRouter, an AI routing service. By default the model is Anthropic Claude; only if it is unavailable, OpenAI GPT, and then Google Gemini. Every request is restricted, by settings we send with it, to endpoints that OpenRouter lists as zero data retention and that do not collect or train on prompts, and to three hosting providers: Google Cloud (Vertex AI) and Amazon Web Services (Bedrock) for Claude, Microsoft Azure for OpenAI GPT, and Google Cloud (Vertex AI) for Gemini. The model developers (Anthropic, OpenAI and Google) do not receive these requests directly, except that Google also operates Vertex AI. Relevant customer context (such as name, plan, billing status, churn-risk factors, and text the customer wrote) is transmitted for this purpose. On a cancellation page, the model may also recommend which retention offer (a discount, a pause, or a call) is most likely to suit a customer. It can only choose among options, and within limits, set by the business, and those limits are enforced by deterministic rules. Scoring, whether to send a message, spending caps, and billing are never decided by the model. See the AI Disclosure.

Learning from outcomes. For each cancellation-page decision, Lokuna records which offers were allowed, which one was shown and how it was chosen, and what happened next (whether it was accepted, whether the next invoice was paid, and whether the customer was still subscribed 90 days later). A business’s own records are used to improve that business’s own offer choices. Across businesses, Lokuna uses only aggregated, de-identified statistics, such as how often a pause kept customers who said the price was too high. A statistic is used only when at least five businesses and thirty outcomes contribute to it, and no single business may account for more than a quarter of it. These statistics contain no names, email addresses, identifiers, or message text; no business can see them; and they serve only as starting estimates for Lokuna’s offer-selection rules, never as another business’s data. They are built from offer decisions and billing outcomes, never from Gmail or Outlook content. This is statistical analysis of outcomes; it does not train or fine-tune an AI model on customer content.

6. Who receives information (service providers)

We share personal information only with the service providers below, only for the purposes shown, under contracts that restrict their use of it:

In addition, when an operator connects their own email, SMS, support or product-analytics provider (e.g., SendGrid, Amazon SES, Postmark, Gmail, Outlook, Twilio, Vonage, MessageBird, Plivo, Intercom, Zendesk, HubSpot, Freshdesk, Help Scout, PostHog), messages and related data flow through that provider under the operator’s own agreement with it. We may also disclose information where required by law, to protect rights and safety, or in a merger or sale of the business (with notice).

7. Google user data (Gmail and Sign in with Google)

Lokuna’s use and transfer of information received from Google APIs will adhere to the Google API Services User Data Policy, including the Limited Use requirements.

What we access

• Connect Gmail (optional): an operator can connect their own Gmail or Google Workspace mailbox. We request two permissions and the mailbox’s email address:
  • Send email (gmail.send): so the retention agent sends emails to the operator’s customers from the operator’s own address.
  • Read email (gmail.readonly): so the agent can see when one of those customers replies. We check the sender of new messages in the inbox and open a message only if it comes from a customer Lokuna emailed for that operator in the last 60 days. We skip every other message by its sender, without opening it or storing anything about it.
  From a customer’s reply we store the reply text (with the quoted earlier conversation removed), its subject, the sender, and the message ID so the same reply is not handled twice. We never change, label, move, archive, or delete anything in the mailbox, and we never read contacts, calendar, or Drive.
• Sign in with Google (optional): if you sign in with Google, we receive your name, email address, and profile picture to create and sign in to your Lokuna account.

How we use it

• Sending is used only for the retention, payment-recovery, and reply emails the operator has authorized the agent to send.
• Customer replies are used only to continue that conversation: to show the reply to the operator in Lokuna, to stop automated follow-ups once a customer has replied, to sort the reply into a reason (for example, price or a missing feature), and to draft a response. To sort and draft, the reply text is sent to the AI model providers in Section 5, which do not use it to train their models.
• Sign-in information is used only to authenticate you and identify your account.

What we never do with Google user data

• We do not sell it, and we do not use it for advertising, retargeting, or to market Lokuna.
• We do not use it to train, develop, or improve our own or anyone else’s AI or machine-learning models, generalized or otherwise.
• We do not transfer it to third parties, except as needed to provide the features above (our hosting, database, and AI model providers in Sections 5 and 6), to comply with law, or as part of a merger or sale of the business with notice.
• No human at Lokuna reads it, unless you give us permission for a specific support request, it is needed for security (such as investigating abuse), or the law requires it.

Storage, revocation, and deletion

The Google access and refresh tokens are encrypted at rest (AES-256-GCM) and used only by our servers. You can disconnect Gmail at any time in Setup. Disconnecting deletes the stored tokens immediately. You can also revoke Lokuna’s access from your Google Account permissions page. Deleting your Lokuna account deletes all Google user data we hold. To request deletion otherwise, email info@lokuna.com.

8. International transfers (information leaves Quebec and Canada)

Our service providers store and process personal information in the United States; our primary database is hosted in the United States (Oregon, AWS us-west-2). AI requests (Section 5) are processed by Google Cloud, Amazon Web Services or Microsoft Azure in the United States or in another region where they run the model, using only endpoints that OpenRouter lists as zero data retention. Before communicating personal information outside Quebec we assess, as required by Law 25, whether it will receive adequate protection, and we bind each provider contractually — including, where the GDPR applies, the European Commission’s Standard Contractual Clauses. By using the Services, operators instruct us to process end-customer information with these providers.

9. Retention and deletion

• Operator account and end-customer information is retained while the operator’s account is active.
• Sent-message records are kept as an audit and billing-dispute trail for the life of the account.
• Deleting an operator account permanently deletes the workspace and all data in it — customers, events, messages, and archives — and can be done by the operator directly from Settings.
• Earlier deletion of a specific end-customer’s information can be requested through the operator (or via info@lokuna.com); see Section 10.
• Unsubscribe and STOP suppressions are retained so that the choice keeps being honored.
• Deleting a customer or a workspace deletes its offer-decision records. The aggregated learning statistics (Section 5) hold no personal information and are rebuilt daily from the remaining records, so deleted records stop contributing within a day.

10. Your rights

Subject to applicable law (Law 25, PIPEDA, GDPR), you may request: access to your personal information; correction; deletion; a copy in a structured, commonly used format (portability); withdrawal of consent; and information about how your information has been used or disclosed. End-customers should address requests to the business they deal with — the controller — and we will assist that business; you may also contact us directly and we will forward the request. We respond within 30 days. You will not be discriminated against for exercising rights.

If you are unsatisfied with our response, you may complain to the Commission d’accès à l’information du Québec, the Office of the Privacy Commissioner of Canada, or your local EEA/UK supervisory authority.

11. Security

Safeguards include encryption in transit (TLS) and at rest, application-level AES-256-GCM encryption of connected-provider credentials, row-level tenant isolation with enforced workspace scoping, signature verification of provider webhooks, access controls, and security review of changes. No system is perfectly secure; we will notify affected parties and regulators of confidentiality incidents as required by Law 25, PIPEDA, and the GDPR.

12. Cookies

We use only the cookies necessary to operate the service (authentication/session) and an error-monitoring tool; see the Cookie Policy. We do not use advertising or cross-site tracking cookies.

13. Children

The Services are for businesses and are not directed to minors.

14. Changes and contact

We will post changes here with a new date and notify operators of material changes. Contact: Privacy Officer, Lokuna Inc., 2439 rue des Palmipèdes, Montréal, Québec H4R 0J2, Canada, info@lokuna.com.