Privacy Policy

1. Introduction

Welcome to Lucrivo ("we," "our," or "us"). We respect your privacy and are committed to protecting your personal data. This Privacy Policy explains how we collect, use, disclose, and safeguard your information when you visit our website lucrivo.com and use our services.

By using our website and services, you agree to the collection and use of information in accordance with this policy.

2. Information We Collect

2.1 Information You Provide

We collect information you voluntarily provide when you:

• Join the waitlist: Name, email, course interest, company type, optional business details, page/CTA source, UTM parameters, and policy acceptance version
• Request a service quote: Name, email, optional company name, website URL, message, service type, page/CTA source, UTM parameters, and policy acceptance version
• Request free lead magnet prompts: Email address to unlock prompt collections on our website, plus policy acceptance version
• Create an account: Email address and password (authentication handled by Supabase Auth)
• Use member features: Course progress, notes, highlights, profile preferences, and purchase history tied to your account
• Purchase MCP training courses: Email address for delivery and account access (payment card details are processed by our payment provider — we do not store them)
• Contact us via email: Name, email, and message content

2.2 Automatically Collected Information

When you visit our website, we automatically collect:

• Analytics Data: Page views, visitor count, referrer sources, geographic location (country/region), device type, and browser information via Vercel Analytics
• Performance Data: Core Web Vitals and site performance metrics
• Log Data: IP address, browser type, operating system, timestamps, and pages visited

Note: Vercel Analytics does not use cookies and is fully privacy-compliant. No personal data is stored or tracked.

2.3 FBA Reimbursement Audit Tool

Our FBA Reimbursement Audit tool (available by direct link, not listed in site navigation) processes Amazon Seller Central reports entirely in your browser. Your data never leaves your device, is never uploaded to our servers, and is never stored by us.

3. How We Use Your Information

We use the information we collect to:

• Deliver purchased MCP training courses, free lead magnets, and account access
• Respond to service quote requests, waitlist signups, and customer support inquiries
• Send transactional emails you request (confirmations, launch notifications, quote follow-ups)
• Sync course progress and notes across devices for logged-in members
• Analyze website traffic and improve our content and user experience
• Detect and prevent fraud or abuse
• Comply with legal obligations

4. Legal Basis for Processing (GDPR)

If you are in the European Economic Area (EEA), our legal basis for collecting and using your information depends on the data and context:

• Consent: Waitlist signups, lead magnet unlocks, service inquiries, marketing emails, and related communications (you can withdraw consent at any time)
• Legitimate Interests: Analytics and website improvement (we ensure this does not override your rights)
• Contractual Necessity: Account access, course delivery, and services you request
• Legal Obligation: Compliance with applicable laws

5. Sharing Your Information

We do not sell, rent, or trade your personal information. We may share your information only in the following circumstances:

5.1 Service Providers

• Database (Supabase): We store waitlist signups, lead magnet signups, service inquiries, user profiles, course progress, course notes, and purchase records in Supabase (supabase.com). Supabase acts as a data processor under our instruction. See Supabase's privacy policy at supabase.com/privacy
• Email (Resend): We use Resend (resend.com) to deliver lead magnet confirmations, waitlist notifications, service inquiry confirmations, and related transactional mail. Your email address is shared only with Resend to deliver mail you requested. See Resend's privacy policy at resend.com/legal/privacy-policy
• Hosting (Vercel): Our website is hosted on Vercel. See Vercel's privacy policy at vercel.com/legal/privacy-policy
• Analytics (Vercel Analytics): Privacy-friendly, no cookies, no personal data tracking

5.2 Legal Requirements

We may disclose your information if required by law, court order, or government regulation, or if we believe disclosure is necessary to:

• Comply with legal obligations
• Protect our rights, property, or safety
• Prevent fraud or abuse

6. Data Retention

We retain your information only as long as necessary:

• Waitlist signups: Until course launch, then 90 days after launch (or until you request deletion)
• Service inquiries: Up to 2 years after submission, or until the inquiry is resolved and any follow-up period ends
• Lead magnet signups: Until you unsubscribe or request deletion
• Account data (profile, progress, notes, purchases): While your account is active, then deleted or anonymized within 90 days of a verified deletion request
• Course customers: Purchase and access records as long as needed to fulfill purchases and support requests (minimum 2 years for tax/legal compliance)
• Analytics data: Aggregated data retained for up to 90 days (Vercel Analytics)
• Unlock cookies: Expire after 1 year; you can delete them anytime via browser settings
• Policy acceptance records: Stored with the related submission or account to demonstrate consent

7. Your Rights (GDPR & CCPA)

Depending on your location, you have the following rights:

• Access: Request a copy of the personal data we hold about you
• Correction: Request correction of inaccurate or incomplete data
• Deletion: Request deletion of your personal data ("right to be forgotten")
• Portability: Request a copy of your data in a machine-readable format
• Withdraw Consent: Unsubscribe from emails at any time (link in every email)
• Object: Object to processing based on legitimate interests
• Restrict: Request restriction of processing in certain circumstances
• Opt-Out (California): California residents can opt-out of sale of personal information (we don't sell data)

To exercise any of these rights, email us at lucrivo@proton.me. We will respond within 30 days.

8. Cookies and Tracking

We do not use cookies for advertising or cross-site tracking. We use cookies only for essential functionality and privacy-friendly analytics.

8.1 Cookies We Use

• Authentication cookies (Supabase): When you sign in, Supabase sets session cookies required to keep you logged in and secure your account. Purpose: essential functionality.
• Lead Magnet Unlock Cookies (HttpOnly): When you unlock free prompts by providing your email, we set a secure, signed HttpOnly cookie (e.g., lucrivo_lm_helium10-mcp) to remember your unlock status on this device. These cookies expire after 1 year and cannot be accessed by JavaScript. Purpose: essential functionality.
• Vercel Analytics: Our analytics provider does not use cookies and is fully privacy-compliant. No personal identifiers are stored.

8.2 Essential Cookies

Your browser may set essential cookies for basic website functionality (e.g., session management, security). These are necessary for the site to work and do not require consent under GDPR/ePrivacy.

8.3 How to Control Cookies

You can delete cookies through your browser settings. Note that disabling essential cookies may prevent some features from working (e.g., you'll need to re-unlock prompts each visit).

9. Security

We implement industry-standard security measures to protect your information, including:

• HTTPS encryption (SSL/TLS) for all data transmission
• Secure hosting infrastructure with Vercel
• Regular security updates and monitoring
• Limited access to personal data (only authorized personnel)

However, no method of transmission over the internet is 100% secure. We cannot guarantee absolute security.

10. Third-Party Links

Our website contains links to third-party websites (e.g., Amazon Seller Central, n8n.io, Make.com, Airtable.com). We are not responsible for the privacy practices of these external sites. Please review their privacy policies before providing any personal information.

11. Children's Privacy

Our services are not directed at children under 16. We do not knowingly collect personal information from children under 16. If you believe a child has provided us with personal data, please contact us at lucrivo@proton.me and we will promptly delete it.

12. International Data Transfers

Your information may be transferred to and processed in countries other than your own, including the United States. We ensure appropriate safeguards are in place to protect your data in accordance with this Privacy Policy and applicable laws (e.g., Standard Contractual Clauses for EU data transfers).

13. Changes to This Privacy Policy

We may update this Privacy Policy from time to time. Changes will be posted on this page with an updated "Last Updated" date. If we make material changes, we will notify you via email (if you are subscribed or have an account) or a prominent notice on our website. For material changes, we may require renewed acceptance through our forms or account banner.

We encourage you to review this Privacy Policy periodically.

14. Contact Us

If you have questions or concerns about this Privacy Policy or our data practices, contact us at:

EU Representative: If you are in the EU and wish to contact a representative, please email the address above with "EU Privacy Inquiry" in the subject line.