Luska AI ("we", "our", or "us") is committed to protecting your privacy and the security of your personal information. This Privacy Policy explains how we collect, use, disclose, retain, and safeguard your information when you use our competitor price tracking platform (the "Service").
Our information security practices are aligned with the ISO/IEC 27001 standard for Information Security Management Systems (ISMS). We maintain documented policies, procedures, and controls to ensure the confidentiality, integrity, and availability of all information assets.
2. Information We Collect
2.1 Personal Information
We collect personal information that you voluntarily provide when creating an account, subscribing to a plan, or contacting us:
Name and email address
Company name and job title
Billing and payment information (processed by Stripe; we do not store full card details)
Account credentials (passwords are hashed and never stored in plaintext)
Communication preferences and correspondence
2.2 Business Data
Data you input into the Service in the course of using it:
Product information (names, SKUs, prices, cost prices)
Competitor URLs and pricing data
Pricing rules, strategies, and configurations
Reports and decision history
2.3 Usage and Technical Data
We automatically collect certain technical information when you use our Service, including IP address, browser type and version, operating system, device identifiers, pages visited, referral URLs, time spent on pages, and feature usage patterns. This data is collected via Google Analytics 4 (GA4) and is subject to your cookie consent preferences.
3. Legal Basis for Processing (GDPR)
We process your personal data under the following legal bases:
Contract performance: Processing necessary to provide the Service you have subscribed to (Art. 6(1)(b) GDPR)
Consent: Analytics tracking and marketing communications, which you may withdraw at any time (Art. 6(1)(a) GDPR)
Legal obligation: Compliance with applicable laws, regulations, and legal proceedings (Art. 6(1)(c) GDPR)
4. How We Use Your Information
We use your information for the following purposes:
Providing, operating, and maintaining the Service
Processing transactions and sending billing information
Sending administrative communications, security alerts, and service updates
Responding to inquiries and providing customer support
Improving our platform, developing new features, and conducting analytics
Detecting, preventing, and addressing security incidents, fraud, and abuse
Complying with legal obligations and enforcing our Terms of Service
Generating AI-powered pricing recommendations based on your data
5. Data Classification and Handling
In accordance with our ISO 27001-aligned ISMS, we classify information assets into the following categories and apply appropriate security controls:
Confidential: Authentication credentials, API keys, payment data, access tokens. Encrypted at rest and in transit; access restricted to authorized systems only.
Restricted: Business data (product prices, competitor data, pricing strategies). Encrypted at rest; access controlled by row-level security policies per user account.
Internal: Usage analytics, system logs, support tickets. Access limited to authorized personnel with a legitimate business need.
Public: Marketing materials, publicly available pricing, documentation.
All data classification decisions are documented and reviewed periodically as part of our information security risk assessment process.
6. Data Sharing and Sub-Processors
We do not sell your personal information. We share data only with trusted third-party sub-processors who are contractually bound to maintain appropriate security measures:
Supabase (database and authentication): Hosts our database infrastructure. Data stored in EU-region data centres.
Google Analytics 4 (analytics): Collects anonymised usage data, subject to your cookie consent. IP anonymisation enabled.
Resend (transactional email): Sends account notifications, alerts, and reports.
We maintain a register of all sub-processors and conduct due diligence on their security practices before engagement. Data Processing Agreements (DPAs) are in place with all sub-processors. We will notify you of any material changes to our sub-processor list.
7. Information Security Measures
We implement comprehensive technical and organisational security measures aligned with ISO 27001 Annex A controls:
7.1 Technical Controls
Encryption in transit (TLS 1.2+) and at rest (AES-256) for all data
Row-Level Security (RLS) policies ensuring strict data isolation between users
Secure password hashing (bcrypt) — plaintext passwords are never stored
API key hashing — only key prefixes are stored; full keys are shown once at creation
Rate limiting on all API endpoints and edge functions
Input validation and sanitisation to prevent injection attacks
Security-definer functions for privilege escalation prevention
Automated vulnerability scanning of dependencies
7.2 Organisational Controls
Principle of least privilege for all system and data access
Regular access reviews and credential rotation
Security awareness and training for all personnel
Documented change management procedures
Periodic risk assessments and security audits
Supplier security evaluation and monitoring
7.3 Infrastructure Security
Hosting on enterprise-grade cloud infrastructure provided by SOC 2 Type II–certified providers
Automated backups with point-in-time recovery capabilities
Network segmentation and firewall protection
DDoS protection and web application firewall (WAF)
Logging and monitoring of all administrative and data access events
8. Data Retention
We retain your data only for as long as necessary to fulfil the purposes described in this policy, or as required by law:
Account data: Retained for the duration of your account plus 90 days after deletion request
Price history data: Retained according to your subscription tier (3 days for Free, 7 days for Starter, 30 days for Professional, 90 days for Enterprise)
Billing records: Retained for 7 years to comply with financial and tax regulations
System logs and audit trails: Retained for 12 months
Support correspondence: Retained for 24 months after resolution
Analytics data: Aggregated and anonymised after 26 months (Google Analytics default)
Upon expiry of the retention period, data is securely deleted or irreversibly anonymised. We conduct periodic reviews to ensure data is not retained beyond its required retention period.
9. Incident Response and Breach Notification
We maintain a documented information security incident management procedure in accordance with ISO 27001 (A.5.24–A.5.28). In the event of a personal data breach:
We will assess the nature, scope, and potential impact of the breach within 24 hours of discovery
We will notify the relevant supervisory authority within 72 hours where the breach is likely to result in a risk to individuals' rights and freedoms, as required by GDPR Art. 33
We will notify affected individuals without undue delay where the breach is likely to result in a high risk, as required by GDPR Art. 34
We will document all incidents, including root cause analysis, corrective actions, and preventive measures
We will implement lessons learned to improve our security posture
To report a security vulnerability or incident, please contact us immediately at security@luska.ai.
10. International Data Transfers
Our primary data processing infrastructure is located within the European Union. Where data is transferred outside the EU/EEA, we ensure appropriate safeguards are in place:
EU Standard Contractual Clauses (SCCs) with all non-EU sub-processors
Transfer Impact Assessments (TIAs) conducted for each transfer
Supplementary technical measures (encryption, pseudonymisation) where appropriate
Verification that recipient countries provide adequate levels of data protection or that appropriate derogations apply
11. Your Rights
Under the GDPR and applicable data protection laws, you have the following rights:
Right of access (Art. 15): Request a copy of the personal data we hold about you
Right to rectification (Art. 16): Request correction of inaccurate or incomplete data
Right to erasure (Art. 17): Request deletion of your personal data ("right to be forgotten")
Right to restriction (Art. 18): Request restriction of processing in certain circumstances
Right to data portability (Art. 20): Receive your data in a structured, machine-readable format
Right to object (Art. 21): Object to processing based on legitimate interests or direct marketing
Right to withdraw consent (Art. 7(3)): Withdraw consent at any time where processing is based on consent
Right to lodge a complaint: File a complaint with your local data protection supervisory authority
To exercise any of these rights, please contact us at privacy@luska.ai. We will respond to your request within 30 days. We may request identity verification before processing your request.
12. Cookies and Tracking Technologies
We use cookies and similar tracking technologies to enhance your experience. Our cookie usage is managed through a consent banner that appears on your first visit:
Essential cookies: Required for the Service to function (authentication, session management). Cannot be disabled.
Analytics cookies: Google Analytics 4 (GA4) for understanding usage patterns. Disabled by default until you consent.
You can manage your cookie preferences at any time through the cookie consent banner or your browser settings. We do not use third-party advertising cookies.
13. Data Protection Officer
For matters related to data protection, privacy, or to exercise your rights under this policy, please contact our Data Protection function at privacy@luska.ai. We are committed to resolving any concerns promptly and transparently.
14. Business Continuity
We maintain a business continuity plan to ensure the availability of your data and the Service. This includes automated database backups, redundant infrastructure, disaster recovery procedures, and defined Recovery Time Objectives (RTO) and Recovery Point Objectives (RPO). Our continuity plans are tested and reviewed at least annually.
15. Changes to This Policy
We may update this Privacy Policy from time to time. For material changes, we will provide at least 30 days' notice via email or a prominent notice within the Service. We encourage you to review this policy periodically. The "Last updated" date at the top indicates the most recent revision.