Privacy Policy
Last updated: 2026-10-06
Lufer AI is a solo-founder business based in Palm Coast, Florida, USA. This policy describes, in plain language, what personal data this website collects and what happens to it.
What we collect
- Contact and quote requests. When you submit your name, email address, or a message — through the contact form, the chat assistant, or the
/mcpagent interface — we store that information in our database and receive it by email so we can respond. - Chat conversations. Messages you send to the on-site assistant are processed by Anthropic's Claude API (proxied through Cloudflare AI Gateway) to generate a response. Anthropic does not use API data to train its models by default. The legacy homepage chat does not save its conversation in your project. When you consent to the conversation at /crear, its messages and replies are saved with your project and can be reviewed by Lufer during its applicable retention period described below.
- Guided projects and private demos. When you consent to saving a project at /crear, we store your business details, objective, notes, demo versions and test inquiries for review by Lufer. Completing the guided forms does not invoke an AI model. Website review requests can trigger an internal notification to Lufer, as described below; no automatic reply is sent to you. If you separately consent to the AI conversation, we send your saved business brief and a limited recent message history to Anthropic through Cloudflare AI Gateway. Your proposal email, private access token and order details are not included in that context. Generated suggestions only change your brief after you review and confirm them. Chat requests disable Gateway response caching and conversation logging; provider processing policies still apply. An essential, secure cookie lets you resume in the same browser for seven days. Projects normally expire after seven days and are removed in scheduled cleanup batches. If you explicitly consent when submitting a website review request, its project information and private follow-up are retained for up to 30 days from submission so Lufer can attend it; your browser access still expires after seven days. Older requests keep their original retention period. An internal notification tells Lufer that a request is waiting; it does not include your contact details or website contents and does not automatically email you. If you prepare a commercial proposal, its business details and project brief are copied into the order record for delivery and support; that record remains after the temporary project expires.
- Technical data. Our host, Cloudflare, processes IP addresses and request metadata to serve the site and to enforce security controls (rate limiting, WAF). We do not run analytics trackers. The guided project uses the essential access cookie described above. Short-lived hashed identifiers and counters limit automated abuse.
Who processes it
Providers used for the applicable service include Cloudflare (hosting, storage and AI Gateway), Anthropic (website chat), Resend (email), and Stripe (payments). Stripe collects payment details on its hosted checkout; Lufer stores order references and payment states, not full card numbers. Voice at /crear, when you separately consent, sends audio, your saved brief and recent chat to OpenAI for live conversation and delegated responses. Lufer saves text fragments with approximate timing in the project history for its applicable retention period: seven days normally, or up to 30 days if you separately consent when requesting a website review. The separate temporary voice buffer expires with browser access after at most seven days. The same history is available to you and Lufer; recent voice text can also inform the text chat after its consent. Lufer does not save audio recordings. Transcriptions may be incomplete or inaccurate and never constitute approval of a brief, contract or payment. OpenAI may retain processed data under its API policies; disabling Live session storage does not imply zero retention for delegated Responses. The separate private operator pilot remains available only with operator access. Internal prospect evaluation uses TypeSafe only when activated, with submitted business evidence. We do not sell personal data.
Retention and your rights
Contact, proposal and order records support conversations, delivery, billing and customer support. The proposal page keeps its private access token in browser session storage so you can return from checkout. To ask what we hold about you, or to have it corrected or deleted, emailhello@lufer.ai — we review each request directly and explain any records that must be retained for billing, an unresolved dispute, or applicable requirements.