Privacy Policy

AMBBR (“we”, “us”) operates AskLucien, also called Lucien, an AI phone concierge that places outbound calls to businesses on your behalf. This policy explains what we collect, why, and your rights. If you are in the EU/EEA or UK, we act as the data controller for your account data.

Information we collect

Account data you provide: name, email, password (stored hashed), and optional settings (preferred language, currency). With Google sign-in we receive your name, email, and profile image from Google.

Saved booking details you choose to store: a contact phone number, email, or address. The agent shares them with a business only when the task needs them — a reservation in your name, a callback, a delivery.

Request & call data: the tasks you ask us to perform, the numbers/businesses to call, and the conversations our AI agent has on your behalf — including call audio recordings, transcripts, AI summaries, and collected results. Calls our agent places may be recorded. Recordings necessarily capture the voice and words of the people who answer; we process that data solely to deliver your results, and you must only instruct calls you may lawfully make.

Billing data: your prepaid credit balance and ledger. Card details are processed and stored by Stripe — we never see or store full card numbers.

Technical data: consented usage and acquisition analytics across the public site and app; error reports when something breaks; and the cookies described below.

Technical diagnostics

Technical diagnostics help us investigate failures and maintain reliability. Web error reports use Sentry. The iPhone app uses Google Firebase Crashlytics for crash reports and limited technical errors, including app version, device and operating-system information, stack traces and installation identifiers. We do not attach account details, phone numbers, messages, recordings or call content to diagnostic reports. iPhone crash diagnostics are enabled by default and can be turned off separately from usage analytics, before sign-in or in Account settings. Turning them off deletes unsent reports on that device and stops future uploads. Better Stack checks public pages, aggregate backend health and job completion; Checkly uses a dedicated empty test account for availability checks.

How we use it

To provide the service (place and reconcile calls, return results), to bill prepaid credit, to secure accounts and prevent abuse, to send transactional email (verification, password reset, receipts), and to measure and improve the product and site. Where the GDPR applies, we rely on performance of a contract (running the service), legitimate interests (security and fraud prevention), legal obligations (accounting), and consent (analytics across the public site and app).

Teams & organizations

If your account belongs to an organization, its owners and admins can see the organization’s requests, results, and billing. If you use our API, requests made with your API keys are processed like any other, and webhook events are delivered to the endpoints your organization configures.

Connecting AskLucien to ChatGPT or Claude

When you choose to connect AskLucien to ChatGPT or Claude, we link your AskLucien account to that assistant with the permissions you approve. Depending on those permissions, account linking shares your account identifier and verified email with the assistant provider. You can review the requested permissions before connecting.

For a call requested through a connected assistant, we receive the task, destination phone number, requested language and duration, and any optional business information or name you choose to share. We receive the information sent to our tools for that task, rather than access to your full chat history. Our calling providers process the approved call details and call content as described in this policy.

We return the call preview and maximum charge, then the call reference, status, outcome, short summary and settled charge to the connected assistant so you can review the call and read its result in your conversation. The connector does not return recordings, full transcripts, unrelated call history, payment-card details or account passwords. The assistant provider processes the information it receives under its own terms and privacy policy.

You can disconnect the assistant in AskLucien’s connection settings. Disconnection stops its subsequent access to AskLucien and prevents calls awaiting dispatch from starting through that connection. It does not undo calls already submitted or erase information already returned to the assistant. AskLucien records remain subject to the retention, deletion and access provisions below.

Service providers (sub-processors)

We share the minimum data necessary with providers who help us run the service: telephony and voice (Telnyx; ElevenLabs and Twilio on the voice path), AI models that generate the agent’s speech and analysis (Anthropic, OpenAI, Google, and models hosted by our voice providers), business search (Google Places, which receives your search queries in discovery mode), payments (Stripe), email (Mailgun), authentication (Google), error monitoring (Sentry), product analytics (Google Analytics and Contentsquare, only with consent), database hosting (Supabase), and hosting/storage/analytics (Vercel, including recording storage). Call content is necessarily shared with the telephony and AI providers to place the call.

Call recordings & consent

You are responsible for ensuring you have the right to instruct calls to the numbers you provide, and for complying with recording and calling laws in the relevant jurisdictions. Where required by law, the agent plays a recording notice at the start of the call. Recordings and transcripts are stored so you can review the outcome.

Cookies

We use a small set of first-party cookies: NEXT_LOCALE remembers your language; hp_ab remembers which version of our homepage you saw so it stays consistent; and if you start a request from the homepage, cai_funnel/cai_prompt carry your entry point and the text you typed into the app for up to one hour — by cookie rather than in the URL, so it stays out of logs and browser history. If you accept analytics, cai_acquisition keeps the first traffic source, campaign, and landing page for up to 90 days so we can connect a signup to its origin. Analytics run only after you accept them, and your choice applies across the public site and app. You can decline without losing functionality. Google Analytics then sets its own measurement cookies (such as _ga) and receives only a pseudonymous account identifier—not your name or email.

Retention & deletion

We keep account and call data — including recordings and transcripts — for as long as your account is active and as needed to provide the service and meet legal and accounting obligations. You can delete individual requests, and you can ask us to delete your account, after which we delete or anonymize your data except what we are legally required to keep.

After account deletion, we retain only necessary billing identity (billing name and email), original internal and Stripe references, invoices, payment and credit movements, refunds and disputes in a separate, restricted financial archive. Call content, request titles, phone numbers and free-text notes are not retained in that archive. It cannot be used to sign in or spend credit. Accounting records are retained for 10 years after the end of the relevant financial year (31 December); for example, 2026 records are retained through 31 December 2036. Unresolved disputes and documented legal holds may require longer retention. Closed financial records and their unneeded billing identity are deleted after the applicable retention period.

Acceptance and withdrawal evidence is kept separately from call content for handling the contract, consumer requests and legal claims, with access restricted to the personnel handling those purposes. A minimal deletion audit is kept for 90 days, or with retained financial evidence for its retention period. Recordings from deleted workspaces are queued for deletion with retries if a provider is unavailable. Shared workspaces remain available to their other members. Provider copies and backups have distinct deletion cycles; contact privacy@asklucien.com for the applicable arrangements.

Your rights

Subject to applicable law (including the GDPR), you may request access, correction, deletion, restriction, portability, or object to processing, and withdraw consent at any time. To exercise these, contact us below. You also have the right to complain to your local data protection authority (in France, the CNIL).

International transfers & security

Some providers process data outside your country, including in the United States; where required we rely on appropriate safeguards such as the EU Standard Contractual Clauses. We use industry-standard measures to protect your data — encryption in transit, hashed passwords, access controls — though no method is perfectly secure.

Children

The service is not directed to anyone under 16.

Changes & contact

We may update this policy and will revise the date above; material changes will be communicated in the app or by email. Questions or requests: privacy@asklucien.com.