Privacy Policy

Lucra is operated by Relative Companies Inc., DBA Lucra. References to Lucra, we, us, or our mean Relative Companies Inc., DBA Lucra. References to you mean brand users, creators, team members, invited users, connected-account users, and visitors to our public pages.

We collect account and workspace information such as names, email addresses, organization names, roles, profile details, workspace settings, authentication events, invitations, permissions, and support communications.

We collect creator workflow information such as creator profiles, program participation, briefs, uploaded files, source filenames, thumbnails, preview images, video metadata, transcripts, captions, review decisions, revision notes, approval status, asset IDs, submission dates, earnings records, and payout status.

We collect campaign and advertising information such as campaign names, objectives, destinations, budgets, launch records, platform ad IDs, creative IDs, media IDs, status changes, spend, impressions, clicks, conversions, installs, trials, purchases, revenue, cost metrics, attribution windows, and reporting snapshots.

If you connect Google, Meta, TikTok, Instagram, Shopify, AppsFlyer, Stripe, or another third-party service, we collect the information authorized by that connection. This may include account, business, page, app, pixel, advertiser, store, product, order, and campaign IDs; account names and settings; creator handles and profile metadata; content and engagement metadata; attribution and performance data; access and refresh tokens; token expiration data; and provider API or webhook events.

We collect billing, payout, referral, and finance information needed to calculate invoices, usage fees, platform fees, creator payouts, referral commissions, payment status, refunds, disputes, chargebacks, tax records, ledger entries, and reconciliation records.

We collect technical information such as IP address, device and browser details, approximate location derived from IP address, log events, session events, cookies or similar technologies, error data, performance data, and security signals.

Google Sign-In and Google Ads are separate, optional connections. Google Sign-In uses the OpenID, email, and profile permissions to authenticate you and may provide your Google account identifier, name, email address, and profile image. It does not give Lucra access to your Google Ads accounts.

A brand workspace owner or administrator may separately connect Google Ads from Lucra's Integrations settings. Lucra requests the Google Ads permission only when that user starts the connection. We use it to discover the Google Ads customer and manager accounts the user can access and let the user select an advertiser account for the Google Ads features exposed in Lucra. Lucra may access and store the customer and manager account IDs and names, account status, currency, and time zone needed for this setup. Lucra takes further Google Ads actions or accesses campaign, creative, delivery, performance, or conversion data only when an authorized user selects or configures a corresponding feature that is available in Lucra.

Google OAuth tokens are encrypted at rest and are not exposed to workspace users. Lucra does not receive your Google password. We share Google user data only with service providers that process it for Lucra's user-facing features, security, or legal compliance, subject to appropriate confidentiality and data-protection obligations. We do not sell Google user data, use it for advertising or retargeting, transfer it to data brokers, use it to determine creditworthiness or for lending, use it for surveillance, or use it to train generalized or cross-customer artificial intelligence models. Human access is limited to a user's affirmative request, security or abuse investigation, legal compliance, or permitted internal operations involving aggregated data.

Lucra's use and transfer to any other app of information received from Google APIs will adhere to the Google API Services User Data Policy, including the Limited Use requirements. You can disconnect Google Ads in Lucra and revoke Lucra from your Google Account connections. See our Data Deletion page for the exact steps and retention limits.

Google Ads, Meta, and TikTok advertising connections may provide business, advertiser, page, identity, pixel, campaign, creative, permission, delivery, spend, and performance data used for the campaign and reporting features you choose. Creator Instagram and TikTok connections may provide account identifiers, handles, profile images, public or authorized content metadata, media, and engagement metrics used for creator profiles, content syncing, and paid-social authorization workflows.

Shopify may provide store, product, variant, inventory, draft-order, order, fulfillment, shipping, and limited customer contact information needed to sync products and fulfill creator samples. AppsFlyer may provide app identifiers and authorized attribution, install, conversion, campaign, and revenue reporting. Stripe processes payment, identity, tax, bank-account, card, billing, and payout information for billing and creator payouts; Lucra generally receives identifiers, status, amounts, and transaction records rather than complete card or bank credentials.

We use information to provide and operate Lucra, including workspace access, creator invitations, creator profile management, content upload, transcription, creative review, revision workflows, paid ad creation, campaign controls, spend syncing, attribution reporting, earnings calculations, referral tracking, billing, payout operations, and reconciliation.

We use information to connect and maintain third-party integrations, verify permissions, upload or map creative assets, create or update campaigns, sync status and metrics, process webhook events, debug provider errors, and keep connected accounts, campaigns, billing, and payout records consistent.

We use information to secure Lucra, detect abuse, prevent fraud, enforce agreements, comply with platform obligations, respond to legal requests, investigate suspicious activity, support users, and maintain audit logs.

Where applicable law requires a legal basis, we process information to perform our contract with you and provide the features you request; with your consent, including when you connect an optional provider; for our legitimate interests in securing, supporting, measuring, and improving Lucra where those interests are not overridden by your rights; and to comply with legal, tax, accounting, payment, fraud, and platform obligations. You may withdraw consent by disconnecting an optional integration or contacting us, without affecting processing that occurred before withdrawal.

We may use creative content, thumbnails, transcripts, captions, metadata, review outcomes, campaign settings, ad status, spend, conversion data, payout data, and support signals to improve the Lucra product experience, quality controls, measurement, fraud detection, creative performance analysis, recommendations, forecasting, benchmarks, internal models, training systems, and predictive features.

Where feasible, we use aggregated, anonymized, de-identified, or otherwise privacy-protective data for model training, analytics, and product improvement. We do not sell creator content or publicly use identifiable brand or creator content in marketing materials without permission, unless the information is already public or permitted by an applicable agreement.

These product-improvement uses do not apply to Google user data or data derived from Google APIs except as needed to provide or improve the prominent, user-facing Google features the user authorized, for security, or as otherwise allowed by Google's Limited Use requirements.

Lucra uses PostHog as an analytics and observability service provider. We may send Lucra user and workspace IDs, name, email address, role, audience, organization details, page paths without query strings, feature interactions, integration and workflow outcomes, product events, device and browser information, performance information, and sanitized error details. Autocaptured page text and element attributes are masked before delivery. When session recording is enabled in Lucra's PostHog project, PostHog may receive a visual reconstruction of navigation and interactions to diagnose product and reliability issues. Session recordings mask all page text and input values and do not capture network request or response bodies, network headers, canvases, cross-origin iframes, or fonts. We do not intentionally send passwords, OAuth tokens, cookies, authorization headers, card or bank credentials, request bodies, or URL query strings to PostHog.

Analytics helps us understand feature use, maintain reliability, support users, investigate errors, prevent abuse, and improve Lucra. It does not change the provider data stored in Lucra's authoritative campaign, finance, payout, or integration records.

We share information with service providers that help us operate Lucra, including hosting, database, authentication, file storage, email, analytics, error monitoring, observability, payment, payout, billing, tax, and customer support providers.

We share information with connected platforms such as Google, Meta, TikTok, Instagram, Shopify, AppsFlyer, Stripe, payment processors, payout providers, and app stores as needed to perform actions you request, maintain integrations, comply with platform rules, process payments, or keep campaigns, content, commerce, attribution, reporting, billing, and payouts in sync.

Brand users may see creator information, submitted content, review status, usage rights, campaign status, and payout-related information tied to their workspace. Creators may see program, submission, revision, approval, campaign, and earnings information tied to their own account or programs.

We may disclose information if required by law, subpoena, court order, governmental request, platform investigation, security incident, dispute, payment claim, or to protect Lucra, users, creators, brands, platforms, or the public. We may also disclose information in connection with a merger, acquisition, financing, reorganization, or sale of assets.

Platform data from Google, Meta, TikTok, Instagram, Shopify, AppsFlyer, Stripe, and similar providers is used only for authorized Lucra workflows, such as account discovery, content and product syncing, campaign creation, creative upload, campaign controls, reporting, attribution, sample fulfillment, payout calculations, security, and compliance.

We do not sell platform data. We do not use platform data for cross-context behavioral advertising. We use platform data in accordance with the permissions granted by connected accounts, applicable platform terms, and applicable law.

We use cookies and similar technologies for authentication, security, and user preferences. Lucra's PostHog browser analytics uses in-memory persistence rather than analytics cookies or local storage. Session recording is off by default and, if enabled, uses the masking and collection limits described above. You can control cookies through your browser, but some authentication and preference features may not work if cookies are disabled.

We retain information for as long as needed to provide Lucra, maintain accurate campaign and payout records, comply with law, comply with tax and accounting obligations, resolve disputes, enforce agreements, prevent fraud, satisfy platform requirements, and protect the service.

We may retain billing records, payout records, transaction records, audit logs, campaign history, provider identifiers, fraud signals, dispute records, and de-identified or aggregated information after an account or integration is disconnected where retention is permitted or required.

OAuth and API credentials are kept only while the corresponding integration remains connected and are deleted from Lucra when the integration is disconnected. Provider account metadata, synced content, commerce records, attribution data, campaign reporting, and identifiable analytics data are deleted or de-identified after a verified deletion request when they are no longer needed for the purposes above. Shopify privacy requests are completed within the provider-required period, generally 30 days, unless a lawful retention exception applies.

We use administrative, technical, and organizational safeguards designed to protect information, including access controls and operational security practices. No system is perfectly secure, and users are responsible for protecting credentials, connected account access, workspace permissions, and devices.

Depending on where you live, you may have rights to request access, correction, deletion, portability, restriction, objection, or information about how personal information is used or shared. You may also have the right to appeal a privacy decision or opt out of certain processing where required by law.

You can update certain profile and workspace information in Lucra, disconnect certain integrations, and request privacy assistance by emailing [email protected]. We may need to verify your identity, account ownership, and workspace authority before completing a request.

Lucra does not sell personal information or share it for cross-context behavioral advertising. Where applicable, you may appeal a decision on a privacy request by replying to our response and asking for review.

Lucra is operated from the United States, and information may be processed in the United States and other countries where we or our service providers operate. Those countries may have privacy laws that differ from the laws where you live.

Lucra is not intended for children under 13, and users who create accounts, connect integrations, submit payable content, or receive payouts must have legal authority to do so. We do not knowingly collect personal information from children under 13.

We may update this Privacy Policy from time to time. The updated version will be posted on this page with a new last updated date. Continued use of Lucra after an update means the updated Privacy Policy applies to your use of the service.

Questions or privacy requests can be sent to [email protected].