Privacy Policy

1. Who we are

Lucuma is a product developed and operated by Marvanova ("we", "us", "our"). Marvanova is a product studio based in the United Kingdom. For privacy enquiries, contact us at hello@marvanova.com.

2. What data we collect

Account data

When you create a Lucuma account we collect your name, email address, and (where applicable) your company name. This is used to manage your account, process payments, and communicate with you about your subscription.

CV and candidate data

When you upload CVs for screening, the content of those files is processed by our AI screening engine to generate results. This data is processed in memory during your session and is not stored on our servers after processing is complete. We retain no copies of uploaded CVs.

Usage data

We collect standard web analytics data including pages visited, time on site, browser type, and referring URLs. This helps us understand how Lucuma is used and improve the product. This data is aggregated and not linked to individual candidate data.

Payment data

Payments are processed by Stripe. We do not store payment card details. Stripe's privacy policy applies to payment processing: stripe.com/privacy.

3. How we use your data

• To provide and operate the Lucuma screening service
• To manage your subscription and process payments
• To send you service-related communications (account notices, billing, product updates)
• To improve the product through aggregated usage analytics
• To comply with legal obligations

We do not use candidate CV data or personal data extracted from CVs for any purpose other than generating your screening results. We do not use this data to train AI models.

4. Legal basis for processing (UK / EU GDPR)

• Contract: Processing your account data is necessary to provide the service you have subscribed to.
• Legitimate interests: We process usage analytics to improve the product, where this does not override your privacy rights.
• Compliance: We may process data where required to meet legal obligations.

For candidate data processed through your account: you are the data controller in respect of the candidates whose CVs you upload. Lucuma acts as a data processor on your behalf. Agency and Enterprise plan subscribers receive a Data Processing Agreement (DPA) which governs this relationship.

5. Data retention

• CV data: Not retained. Processed in memory and discarded after your screening session.
• Account data: Retained for the duration of your subscription and for 12 months after account closure, then deleted.
• Billing records: Retained for 7 years to comply with UK financial regulations.
• Usage analytics: Retained in aggregated form for up to 24 months.

6. Data sharing

We do not sell your data. We share data only with:

• Stripe, for payment processing
• Anthropic, for AI processing of CV content (Anthropic's data policy applies; they do not train on API data)
• Infrastructure providers, for hosting and security monitoring, under strict data processing agreements
• Legal authorities, where required by law

7. International transfers

Lucuma is operated from the United Kingdom. Data may be processed by Anthropic's infrastructure in the United States. Anthropic is certified under the EU-US Data Privacy Framework. All transfers are governed by appropriate safeguards.

8. Your rights

Under UK GDPR and EU GDPR you have the right to:

• Access the personal data we hold about you
• Correct inaccurate data
• Request deletion of your data
• Object to processing or request restriction
• Data portability
• Withdraw consent where processing is based on consent
• Lodge a complaint with the ICO (UK) or your local supervisory authority

To exercise your rights, contact hello@marvanova.com. We will respond within 30 days.

9. Cookies

Lucuma uses essential cookies required for the service to function (session management, authentication). We also use analytics cookies where you have consented. For full details see our Cookie Policy.

10. Security

We use industry-standard security measures including TLS encryption for data in transit, encrypted storage for account data, and role-based access controls. CV data is never written to persistent storage. We conduct regular security reviews.

11. Children

Lucuma is a professional B2B service and is not intended for use by persons under 18. We do not knowingly collect data from minors.

12. Changes to this policy

We may update this policy from time to time. We will notify subscribers of material changes by email at least 14 days before they take effect. Continued use of Lucuma after changes take effect constitutes acceptance.

13. Contact

For any privacy questions or to exercise your rights:
Email: hello@marvanova.com