Privacy Policy

This page explains what data we collect and how we use it. It covers the lucco.ai website, the Lucco merchant dashboard and mobile inbox, and the AI messaging services we run for businesses on WhatsApp, Facebook Messenger, Instagram, TikTok, Telegram and website chat.

Who we are

Lucco Technology (SSM 202503276634 / JM1033531-D), No. 20-01, Jalan Kencana Mas 1/5, Taman Daya, 81100 Johor Bahru, Malaysia. We comply with Malaysia's Personal Data Protection Act 2010 (PDPA). For anything privacy-related, email support@lucco.ai or WhatsApp +60 11-2922 2627.

Business owners and their customers — different rules

If you are a business using Lucco: we are responsible for your data as a data controller. This includes your account details (business name, your name, phone, email, staff emails), the business profile you fill in for your AI employee (company info, opening hours, products, FAQ), billing details, and usage records such as AI reply counts.

If you are a customer messaging a business that uses Lucco: the business you contacted is responsible for your data; we process it on their behalf. That covers your name and number as provided by the messaging platform, the conversation itself, order or booking details you submit in chat, and labels the business adds. To correct or delete your data, contact that business first — we will help them carry it out.

What we use data for

Only to run the service: generating AI replies to customer messages, showing conversations in the merchant's shared inbox (desktop and mobile), maintaining the merchant's customer database and lead status, alerting the merchant when the AI needs a human, and counting AI replies against plan quotas. On eligible plans, merchants can send broadcast messages to customers who have opted in. We also look at aggregated, de-identified statistics (like average response times) to improve the product. We do not sell personal data, and we do not use your conversations for advertising.

AI processing

To generate replies, customer messages and the merchant's business profile are sent to OpenAI through its commercial API; under OpenAI's API terms this data is not used to train its models. Some merchants choose to connect their own AI provider account — replies then run under that account and that provider's terms. Either way, API keys are stored encrypted, never shown again after saving, and never written to logs. Any conversation can be taken over by a human at any time.

WhatsApp and Meta

Our WhatsApp service runs on Meta's official WhatsApp Business Platform (Cloud API). Messages travel through Meta's infrastructure, so the WhatsApp Business terms and Meta's privacy policy apply alongside this one. The WhatsApp Business account belongs to the merchant, not to Lucco. We receive message data from Meta only to provide the service: generating replies, showing conversations in the inbox, and tracking delivery status. We do not use WhatsApp data for advertising and do not share it with anyone beyond the providers listed below. Broadcasts and template messages are sent only to customers who have opted in to hear from that business, in line with Meta's messaging policies. The same principles apply to Messenger, Instagram, TikTok and Telegram.

Who we share data with

Provider	Purpose
Meta (WhatsApp, Facebook, Instagram)	Delivering messages on their platforms
OpenAI	Generating AI replies — not used to train models
Telegram, TikTok	Delivering messages on their platforms
Hosting providers	Running our servers and databases
Payment processors	Billing — we never store full card numbers

Each provider receives only the data needed for its role.

Your customers stay yours

Names, numbers, conversations and purchase records collected through the Lucco service belong to the merchant. You can export your customer database from the dashboard at any time; if you leave Lucco, your data goes with you.

How long we keep data

Merchant account data is kept while the account is active and deleted or anonymised within 90 days of closure — except records the law requires us to keep (such as billing). Conversation history gives your team and the AI context, and is deleted along with account closure. Merchants can delete individual contacts and conversations from the dashboard at any time; deletion requests arriving from platforms (such as Meta) are processed within 30 days.

Security

All transmissions are encrypted; access tokens and API keys are encrypted at rest. Each staff member gets an individual login rather than shared passwords; platform webhooks are signature-verified before processing; access to production data is limited to those who need it for support. No system is perfectly secure — if a breach affects your personal data, we will notify affected merchants and the relevant authorities as required by law.

Your rights under the PDPA

You can ask to see the personal data we hold about you, correct it, withdraw consent (which may mean we can no longer provide the service), or request deletion where the law allows. Merchants can contact support@lucco.ai directly; customers of a merchant should contact that business first (they control the data) and we will help them respond. We reply within 21 days as the PDPA requires.

Cookies

The website uses essential cookies (like your language choice) and basic analytics to understand which pages help. The dashboard uses session cookies to keep you logged in. There are no third-party advertising trackers.

Children

Lucco is a business tool and is not directed at children under 18. We do not knowingly collect their data — if you believe a child has provided personal data to us, tell us and we will delete it.

Changes

If this policy changes in any important way, we will notify merchants by WhatsApp or email before it takes effect. The date at the top always shows the current version.

Contact

Lucco Technology
No. 20-01, Jalan Kencana Mas 1/5, Taman Daya, 81100 Johor Bahru, Malaysia
Email: support@lucco.ai · WhatsApp: +60 11-2922 2627