What gets uploaded
When you upload a contract, Lucid extracts the text from the PDF and stores both the extracted text and the parsed section structure on our backend. We don't retain the original PDF beyond what's needed to extract its text and parse its structure.
Who can see your contract
Each upload is identified by a private URL containing a 128-bit random token. Anyone with the link can view the analysis — the link is the access control. We do not list documents publicly and do not expose any way to enumerate other people's contracts. Treat the link the way you'd treat a one-time-share link: don't post it publicly.
Where AI fits in
Lucid uses OpenAI models (GPT-4.1-mini) to summarise clauses, route situations, and draft letters. The extracted text from your contract is sent to OpenAI for inference. Per OpenAI's API data policy, this data is not used to train OpenAI models. We send only what each request needs; for example, the response analyzer sees only the landlord's reply and the original draft, never the full lease.
Email addresses
If you set a deadline reminder or send us a contact-form message, we use your email only for that purpose. For send-events recorded against an action (e.g. you sent yourself a copy of a draft), we store a SHA-256 hash of the address rather than the address itself, so you remain the only person who can reverse it.
Tracking
We use Vercel Analytics, which counts pages and visits without setting tracking cookies and without identifying individual users. We do not run advertising trackers, social-media pixels, or third-party session replays.
What we don't do
- We don't sell or share your contract or email with anyone.
- We don't require an account or track you across devices.
- We don't use your contract to train models. OpenAI doesn't either, per their API policy.
Retention & deletion
Documents and events are kept while Lucid is running so the analysis you paid attention to keeps working when you come back. We do not yet expose a self-serve delete button. To have a specific document or contact submission removed, email contact@getlucid.legal with the document URL or the email address you used. We'll confirm the deletion in writing.
Your rights
EU/EEA users have rights under the GDPR including access, correction, deletion, and portability. You can exercise any of them by emailing the address above. We aim to respond within 30 days.
Questions or concerns? See the contact page.