Data Processing Addendum

Summary

This summary is a plain-language guide to the main points of this document. It does not form part of the document’s binding terms and does not change their meaning. The numbered clauses govern.

This addendum forms part of the Terms of Service. It applies automatically when your organisation accepts the Terms. Nobody needs to sign it.
Your organisation decides what personal information goes into Lucrii and why. Lucrii processes it only to provide the Service and on your instructions.
Customer Data is hosted by Amazon Web Services in Sydney. Hermes’ language models run on Amazon Bedrock in Sydney and Melbourne, and its embedding models run through Amazon Bedrock and may be processed in AWS regions outside Australia. Some providers, such as PostHog, are in the United States, and the Sub-processors page lists every one.
Lucrii gives at least 30 days’ notice of a new sub-processor, and you may object. If Lucrii cannot resolve the objection, you can cancel or end the agreement and get a refund of fees paid in advance for the rest of the period.
Lucrii tells you without undue delay after it becomes aware of a security incident involving your Customer Data. Your organisation decides whether to notify the regulator and the people affected, and Lucrii helps.
Your data stays available until you ask Lucrii to delete it. Lucrii completes deletion within 30 days of a written request to support@lucrii.io. Database backups expire after 7 days and earlier file versions after 30 days.
For customers in the European Union and the United Kingdom, the EU Standard Contractual Clauses and the UK Addendum are built in. For Australian customers, Lucrii handles your personal information in line with the Australian Privacy Principles.

1. Application and interpretation

1.1 This Data Processing Addendum (DPA) is made between Lucrii Pty Ltd (ABN 46 694 710 211, ACN 694 710 211) of PO Box 784, New Farm QLD 4005, Australia (Lucrii) and the Customer that has accepted the Terms of Service (the Terms). It forms part of the Terms and takes effect when the Terms take effect, without separate signature. The Customer’s acceptance of the Terms is also its acceptance and execution of this DPA and of the Standard Contractual Clauses and UK Addendum incorporated by clause 11.

1.2 This DPA applies to Lucrii’s processing of Customer Personal Data in providing the Service, including Customer Personal Data captured in session recordings and in Hermes Content sent to PostHog. It does not apply to personal information Lucrii handles for its own purposes as a controller, such as account administration, billing, security of its own systems, analytics about how Users use the Service that does not contain Customer Personal Data, and its own marketing, which Lucrii’s Privacy Policy governs.

1.3 The order of precedence in clause 2.3 of the Terms applies. To the extent of any conflict or inconsistency, the documents rank in this order:

(a) the Standard Contractual Clauses and the UK Addendum, where they apply;

(b) this DPA, for the processing of Personal Information in Customer Data;

(d) the rest of the Terms; and

(e) the Acceptable Use Policy.

1.4 This DPA adopts the definitions in clause 2.1 of the Terms, including Customer, Customer Data, Owner, Administrator, Service, Hermes, Hermes Content, Credits, Document Page, Recipient, User and Sub-processor. Capitalised terms used but not defined in this DPA have the meanings given in the Terms. Words such as “including” and “for example” do not limit the words before them.

2. Definitions

2.1 In this DPA:

(a) Australian Privacy Principles or APPs means the Australian Privacy Principles in Schedule 1 to the Privacy Act.

(b) Customer Personal Data means the personal data and personal information within Customer Data.

(c) Data Protection Laws means all laws relating to privacy and the processing of personal data that apply to a party in connection with the Service, including the Privacy Act, the GDPR and the UK GDPR, in each case to the extent they apply.

(d) Data Subject means the identified or identifiable individual to whom Customer Personal Data relates.

(e) GDPR means Regulation (EU) 2016/679, the General Data Protection Regulation.

(f) Personal Data Breach means a Security Incident (as defined in clause 16.2 of the Terms) affecting Customer Personal Data transmitted, stored or otherwise processed by Lucrii or its Sub-processors, and includes unauthorised access to, unauthorised disclosure of, or loss of Customer Personal Data within the meaning of Part IIIC of the Privacy Act.

(g) Privacy Act means the Privacy Act 1988 (Cth).

(h) Standard Contractual Clauses or SCCs means the standard contractual clauses for the transfer of personal data to third countries annexed to Commission Implementing Decision (EU) 2021/914 of 4 June 2021.

(i) Sub-processors Page means the Sub-processors page, as updated under clause 7.

(j) UK Addendum means the International Data Transfer Addendum to the EU Commission Standard Contractual Clauses, version B1.0, issued by the UK Information Commissioner under section 119A of the Data Protection Act 2018 (UK) and in force from 21 March 2022.

(k) UK GDPR means the GDPR as it forms part of the law of the United Kingdom.

2.2 The terms controller, processor, personal data, processing and supervisory authority have the meanings given in the GDPR. Personal information and APP entity have the meanings given in the Privacy Act.

3. Roles of the parties

3.1 As between the parties, the Customer is the controller of Customer Personal Data (or, where the Customer processes Customer Personal Data on behalf of another controller, a processor acting for that controller), and Lucrii is a processor of Customer Personal Data acting on the Customer’s behalf. Where the Privacy Act applies, the Customer is the APP entity that holds Customer Personal Data, and Lucrii is its service provider.

3.2 The Customer is responsible for:

(a) the lawfulness of the Customer Personal Data it, its Users and its Recipients submit, and of its instructions to Lucrii;

(b) having a lawful basis, and giving every notice and obtaining every consent Data Protection Laws require, for the collection of Customer Personal Data and its processing under this DPA, including notices to Recipients; and

(c) where it acts as a processor for another controller, ensuring its instructions to Lucrii are authorised by that controller.

3.3 The Customer must not submit special categories of personal data, sensitive information (as defined in the Privacy Act) or personal data relating to criminal convictions to the Service, except where it appears incidentally in a record, note, file or email and the Customer has a lawful basis for that processing.

3.4 Annex I describes the subject matter, nature and purpose of the processing, the categories of Data Subjects and of Customer Personal Data, and the duration of processing.

4. Processing on documented instructions

4.1 Lucrii will process Customer Personal Data only on the Customer’s documented instructions, unless processing is required by a law to which Lucrii is subject. In that case Lucrii will inform the Customer of that legal requirement before processing, unless that law prohibits it on important grounds of public interest.

4.2 The Customer instructs Lucrii to process Customer Personal Data:

(a) to provide, secure and support the Service in accordance with the Terms and this DPA;

(b) as initiated by the Customer and its Users through the Service, including by creating and changing records, uploading files, forwarding emails to Lucrii, sending documents to Recipients, using Hermes, turning Hermes on or off in the Organisation’s general settings, installing Apps and connecting integrations or MCP Clients;

(c) to run Hermes for the Organisation while Hermes is turned on, including measuring and improving Hermes as clause 6.4 of the Hermes AI Terms describes, as set out in Annex I and in the Hermes AI Terms; and

(d) as set out in any other reasonable written instruction the Customer gives that is consistent with the Terms.

4.3 The Terms and this DPA are the Customer’s complete instructions at the date the Customer accepts the Terms. An instruction that changes the scope of the Service may need a change to the Terms or to the Customer’s Plan.

4.4 Lucrii will immediately inform the Customer if, in its opinion, an instruction infringes Data Protection Laws. Lucrii may suspend the affected processing until the Customer confirms or changes the instruction.

4.5 Lucrii will not sell Customer Personal Data, will not use it for its own marketing or for direct marketing on behalf of anyone else, and will not use it to train artificial intelligence models. Lucrii does not permit its Sub-processors that provide AI models to train on Customer Data. Lucrii sends Hermes Content to PostHog to measure and improve Hermes, and does not use it to train AI models. Klaviyo does not receive Hermes Content.

4.6 Lucrii may create aggregated statistics from Customer Data that are de-identified so that neither the Customer nor any individual can reasonably be identified, and may use them for the industry figures Hermes shows and to operate and improve the Service, as the Hermes AI Terms describe. De-identified data of that kind is not Customer Personal Data.

5. Confidentiality of personnel

5.1 Lucrii will ensure that every person it authorises to process Customer Personal Data, including its employees and contractors, is bound by a written obligation of confidentiality or an appropriate statutory duty of confidentiality.

5.2 Lucrii will limit access to Customer Personal Data to those personnel who need it to provide, secure or support the Service, or to comply with law.

6. Security

6.1 Lucrii will implement and maintain appropriate technical and organisational measures to protect Customer Personal Data against Personal Data Breaches, taking into account the state of the art, the costs of implementation, and the nature, scope, context and purposes of the processing, as well as the risk to Data Subjects. Those measures include, at a minimum, the measures in Annex II.

6.2 Lucrii may update the measures in Annex II from time to time, provided the update does not materially reduce the overall level of protection of Customer Personal Data.

6.3 The Customer is responsible for its own use of the Service, including the roles it gives Users, whether its Users set up two-factor authentication, keeping its Users’ credentials secure, and the Apps, integrations and MCP Clients it connects.

7. Sub-processors

7.1 The Customer gives Lucrii general written authorisation to engage Sub-processors. The Sub-processors Page lists the Sub-processors Lucrii engages at the date the Customer accepts the Terms, and the Customer authorises each of them.

7.2 Before Lucrii engages a Sub-processor, Lucrii will enter into a written agreement with it that imposes data protection obligations no less protective of Customer Personal Data than those in this DPA, to the extent applicable to the services the Sub-processor provides.

7.3 Lucrii gives at least 30 days’ notice before a new Sub-processor begins processing Customer Data, by updating the Sub-processors Page and by email to the Owners of each Organisation and to everyone who has asked to receive these notices.

7.4 The Customer may object to a new Sub-processor on reasonable grounds relating to data protection by written notice to support@lucrii.io within that notice period, and the parties will discuss the objection in good faith. If Lucrii does not resolve the objection to the Customer’s reasonable satisfaction before the new Sub-processor begins processing Customer Data, the Customer may, by written notice before that date, cancel its subscription with immediate effect or end the agreement under clause 7.2 of the Terms, and Lucrii will refund any Fees paid in advance for the period after the cancellation or ending takes effect. That cancellation or ending, with the refund, is the Customer’s sole remedy for an unresolved objection.

7.5 Lucrii remains fully liable to the Customer for the performance of each Sub-processor’s obligations as if they were Lucrii’s own.

7.6 Apps from the Lucrii App Store, Xero, Stripe Connect, MCP Clients such as Claude and ChatGPT, and any other third-party product the Customer chooses to connect to the Service are not Sub-processors. Lucrii does not engage them. When the Customer or a User connects one, Lucrii sends the data that connection requires at the Customer’s direction, and the third party’s own terms govern what it does with that data.

8. Assistance

8.1 Data Subject requests. Taking into account the nature of the processing, Lucrii will assist the Customer by appropriate technical and organisational measures, insofar as possible, to respond to requests from Data Subjects to exercise their rights under Data Protection Laws, including access, correction, erasure, restriction, portability and objection. The Customer can view, correct and export Customer Personal Data through the Service, including with the CSV exports in each list. Where the Customer cannot fulfil a request through the Service, Lucrii will, on the Customer’s written instruction to support@lucrii.io, provide reasonable assistance, including by locating, exporting or deleting the Customer Personal Data the instruction identifies.

8.2 If Lucrii receives a request directly from a Data Subject that relates to Customer Personal Data, Lucrii will promptly forward it to the Customer where Lucrii can identify the Customer from the request, and will not respond to it except to tell the Data Subject to contact the Customer, unless the Customer instructs otherwise or law requires.

8.3 Impact assessments and consultation. Taking into account the nature of the processing and the information available to Lucrii, Lucrii will provide reasonable assistance to the Customer with any data protection impact assessment, privacy impact assessment or prior consultation with a supervisory authority or other regulator that the Customer is required to carry out in relation to the Service. Lucrii may meet this obligation by providing this DPA, the Security and Incident Response page, the Sub-processors Page and answers to the Customer’s reasonable written questions.

8.4 Regulators. Lucrii will provide reasonable cooperation to the Customer in responding to an inquiry from a supervisory authority or the Office of the Australian Information Commissioner relating to Lucrii’s processing of Customer Personal Data.

9. Personal Data Breaches

9.1 Lucrii will notify the Customer without undue delay after becoming aware of a Personal Data Breach, by email to the Owners and to any other contact the Customer has given Lucrii for this purpose.

9.2 Lucrii’s notice will describe, to the extent the information is available at the time:

(a) the nature of the Personal Data Breach, including where possible the categories and approximate number of Data Subjects and records concerned;

(b) the likely consequences of the Personal Data Breach;

(d) a contact point for more information.

Where Lucrii cannot provide all of this information at once, it will provide it in phases as it becomes available, without further undue delay.

9.3 Lucrii will take reasonable steps to contain, investigate and remediate each Personal Data Breach, and will give the Customer the information and assistance it reasonably needs to meet its own obligations to notify regulators and affected individuals.

9.4 Where a Personal Data Breach may be an eligible data breach under the Notifiable Data Breaches scheme in Part IIIC of the Privacy Act, Lucrii will assess it with the Customer and take all reasonable steps to complete that assessment within 30 days. The parties will cooperate so that any statement to the Office of the Australian Information Commissioner and any notice to individuals are made once and on time. Unless the parties agree otherwise in writing, the Customer decides whether to notify the Commissioner and the affected individuals, and Lucrii will not notify them about Customer Data without the Customer’s agreement unless the law requires Lucrii to do so.

9.5 Lucrii’s notice of, or response to, a Personal Data Breach is not an acknowledgement by Lucrii of any fault or liability.

10. Deletion and return

10.1 While the Terms continue, Customer Data remains available until the Customer asks Lucrii to delete it. If the Customer’s subscription is cancelled or expires, the Organisation returns to the Free plan and its Customer Data remains available. Clause 10.6 applies when the Terms end.

10.2 The Customer may export Customer Data at any time with the CSV exports in each list, including orders, contacts, items, boards and tasks.

10.3 An Owner may ask Lucrii in writing at support@lucrii.io to delete an Organisation and its Customer Data. Lucrii will complete the deletion within 30 days after receiving the written request, and will confirm in writing when it is complete. Database backups expire after 7 days and earlier versions of files after 30 days, as Annex II describes, and copies of deleted Customer Data leave Lucrii’s systems as they expire. Until then Lucrii keeps those copies secure and does not restore them except to recover the Service from a failure, in which case it deletes any restored copy of deleted Customer Data again.

10.4 The audit history of an Organisation is kept for the life of that Organisation, and is deleted with it under clause 10.3.

10.5 Hermes messages are deleted 90 days after they are sent, and files attached to them sooner, as clause 4.5 of the Hermes AI Terms provides. The title and summary of each Hermes conversation are kept while the Organisation exists, unless the Customer asks Lucrii to delete them under clause 10.3.

10.6 If the agreement ends other than at the Customer’s request under clause 7.2 of the Terms, Lucrii will keep the Customer’s Organisations available for export for at least 30 days after it ends, unless the law prevents this, and will then delete them under clause 10.3, as clause 7.8 of the Terms provides.

10.7 Lucrii may retain Customer Personal Data after deletion only to the extent and for the period a law to which Lucrii is subject requires, and will keep it confidential and process it only for that purpose.

10.8 For the purposes of Clauses 8.5 and 16(d) of the Standard Contractual Clauses, deletion under this clause 10 is the deletion or return the Clauses require, and Lucrii will provide the certification of deletion described in those Clauses on the Customer’s request.

11. International transfers

11.1 Locations. Lucrii hosts Customer Data with Amazon Web Services in Sydney, Australia (ap-southeast-2). Hermes’ language models run on Amazon Bedrock in Sydney and Melbourne. Requests to Hermes’ embedding models run through Amazon Bedrock’s cross-region inference and may be processed in AWS regions outside Australia. Some Sub-processors process Customer Personal Data in the United States, as the Sub-processors Page sets out. Lucrii will not transfer Customer Personal Data to a country outside Australia except to Sub-processors listed on the Sub-processors Page, or as the Customer directs.

11.2 EU transfers. To the extent the Customer’s transfer of Customer Personal Data to Lucrii is a transfer of personal data to a third country subject to Chapter V of the GDPR, the Standard Contractual Clauses are incorporated into this DPA by reference and apply between the Customer as data exporter and Lucrii as data importer, as follows:

(a) Module Two (controller to processor) applies where the Customer is a controller, and Module Three (processor to processor) applies where the Customer is a processor acting for another controller;

(b) Clause 7 (docking clause) is included;

(c) in Clause 9, Option 2 (general written authorisation) applies, and the time period for prior notice of changes to Sub-processors is 30 days, given as described in clause 7.3;

(d) in Clause 11, the optional language allowing a Data Subject to lodge a complaint with an independent dispute resolution body is not included;

(e) in Clause 13, the competent supervisory authority is the one determined under Clause 13(a) according to the Customer’s establishment in the European Union or, where the Customer is not established in the European Union, according to the Member State in which its representative under Article 27(1) of the GDPR is established, or otherwise the Member State in which the Data Subjects whose personal data is transferred are located, as Annex I.C states;

(f) in Clause 17, Option 1 applies, and the Clauses are governed by the law of Ireland;

(g) in Clause 18(b), disputes are resolved by the courts of Ireland;

(h) Annex I.A, I.B and I.C to the Clauses are completed by Annex I to this DPA, Annex II to the Clauses is completed by Annex II to this DPA, and Annex III to the Clauses is completed by Annex III to this DPA; and

(i) where Module Three applies, the Customer will pass on to the relevant controller any notice or information Lucrii gives under the Clauses that is intended for the controller.

11.3 UK transfers. To the extent the Customer’s transfer of Customer Personal Data to Lucrii is a restricted transfer under the UK GDPR, the UK Addendum is incorporated into this DPA by reference and applies to the Standard Contractual Clauses as completed in clause 11.2, as follows:

(a) Table 1: the parties’ details are those in Annex I.A, and the key contact for Lucrii is support@lucrii.io;

(b) Table 2: the Addendum EU SCCs are the Standard Contractual Clauses incorporated by clause 11.2, including the Appendix Information, with the modules and options set out in clause 11.2;

(d) Table 4: neither party may end the UK Addendum under Section 19 of the UK Addendum; and

(e) the governing law and choice of courts for the Standard Contractual Clauses, as they apply to restricted transfers under the UK GDPR, are those of England and Wales, as the UK Addendum provides.

11.4 Onward transfers. Where a Sub-processor processes Customer Personal Data in a country that does not provide an adequate level of protection under the GDPR or the UK GDPR, Lucrii will ensure that the onward transfer is made under a transfer mechanism those laws recognise, such as Module Three of the Standard Contractual Clauses (with the UK Addendum where applicable) or the Sub-processor’s certification under a framework that has an adequacy decision.

11.5 Government access. If Lucrii receives a legally binding request from a public authority for access to Customer Personal Data, Lucrii will, unless the law prohibits it, promptly notify the Customer, and will challenge the request where, after careful assessment, it concludes there are reasonable grounds to consider it unlawful. Lucrii will disclose only the minimum Customer Personal Data the request requires.

12. Australian Privacy Principles

12.1 Lucrii will handle Customer Personal Data in accordance with the Australian Privacy Principles as if Lucrii were an APP entity, to the extent they apply to the processing Lucrii carries out for the Customer, whether or not the Privacy Act applies to Lucrii.

12.2 Without limiting clause 12.1, Lucrii will:

(a) use and disclose Customer Personal Data only to provide the Service in accordance with clause 4, consistently with APP 6, and not for direct marketing within the meaning of APP 7;

(b) take the steps in clause 6 and Annex II to protect Customer Personal Data from misuse, interference and loss, and from unauthorised access, modification or disclosure, consistently with APP 11.1;

(d) assist the Customer to respond to requests for access to and correction of personal information under APPs 12 and 13, in accordance with clause 8.

12.3 Cross-border disclosure. Customer Data is hosted in Australia. Where Lucrii discloses Customer Personal Data to a Sub-processor outside Australia, Lucrii takes reasonable steps, consistently with APP 8.1, to ensure that the Sub-processor does not breach the Australian Privacy Principles in relation to that information, including by binding it under clause 7.2 to written obligations that restrict its use of the information to providing services to Lucrii and require it to protect the information. Lucrii remains accountable to the Customer for each Sub-processor’s handling of Customer Personal Data under clause 7.5.

12.4 The Sub-processors Page names each country in which a Sub-processor processes Customer Personal Data. The Customer may rely on it when describing, in its own privacy policy and collection notices, the countries to which personal information is likely to be disclosed.

12.5 Clause 9 sets out how the parties deal with a Personal Data Breach that may be an eligible data breach under the Notifiable Data Breaches scheme in Part IIIC of the Privacy Act.

13. Audits and information

13.1 Lucrii will make available to the Customer the information reasonably necessary to demonstrate Lucrii’s compliance with this DPA and Article 28 of the GDPR. Lucrii will meet this obligation, and the Customer’s audit rights under this DPA and Clause 8.9 of the Standard Contractual Clauses, in the first instance by providing:

(a) this DPA, the Security and Incident Response page and the Sub-processors Page; and

(b) written answers to the Customer’s reasonable security and privacy questionnaires, no more than once in any 12-month period unless a Personal Data Breach has occurred or a regulator requests the information.

13.2 Where the Customer reasonably demonstrates that the information in clause 13.1 is not enough to show Lucrii’s compliance, or where Data Protection Laws or a supervisory authority require it, Lucrii will allow an audit, including an on-site inspection, by the Customer or an independent auditor the Customer appoints who is bound by confidentiality obligations. Any such audit must:

(a) be requested with at least 30 days’ written notice, unless a shorter period is required by law or a regulator;

(b) take place remotely, or at a location Lucrii nominates during business hours, avoid unreasonable disruption to Lucrii’s operations, and not extend to inspection of a Sub-processor’s facilities;

(c) be limited to the systems and records relevant to Lucrii’s processing of Customer Personal Data, and not extend to other customers’ data; and

(d) be at the Customer’s cost, unless the audit reveals a material breach of this DPA by Lucrii.

13.3 Lucrii may object to an auditor that is a competitor of Lucrii. Information the Customer obtains under this clause 13 is Lucrii’s confidential information.

14. Liability and general

14.1 Each party’s liability arising out of or in connection with this DPA, whether in contract, tort or otherwise, is subject to the limitations and exclusions of liability in the Terms, to the extent the Standard Contractual Clauses and the UK Addendum permit. Nothing in this clause 14.1 limits either party’s liability to Data Subjects under the third-party beneficiary rights in the Standard Contractual Clauses or the UK Addendum.

14.2 This DPA continues for as long as Lucrii processes Customer Personal Data, including after the Terms end, and ends when that processing ends under clause 10.

14.3 Lucrii may change this DPA under clause 21 of the Terms, by giving at least 30 days’ notice by email to the Owners. If a change is materially adverse to the Customer, an Owner may cancel the subscription or end the agreement before the change takes effect, as clause 21.3 of the Terms provides. A change will not reduce the protection this DPA gives Customer Personal Data except where Data Protection Laws or a decision of a supervisory authority or court require it. Lucrii may update the Standard Contractual Clauses or the UK Addendum to any successor version the European Commission or the UK Information Commissioner issues.

14.4 If any provision of this DPA is invalid or unenforceable, the rest of this DPA remains in effect.

14.5 This DPA is governed by the law of Victoria, Australia, as clause 22.5 of the Terms provides, and the courts of Victoria have non-exclusive jurisdiction. The Standard Contractual Clauses are governed by the law of Ireland and subject to the courts of Ireland under clauses 11.2(f) and 11.2(g), and the UK Addendum by the law of England and Wales under clause 11.3(e).

14.6 Notices under this DPA to Lucrii must be sent to support@lucrii.io. Lucrii sends notices to the Customer by email to the Owners.

Annex I: Description of the processing

A. List of parties

Data exporter

Name: the Customer that has accepted the Terms, as identified in its Lucrii account.
Address and contact person: the address and the Owner’s name and email recorded in the Customer’s Lucrii account, or as the Customer otherwise notifies Lucrii.
Activities relevant to the data transferred: use of the Service to run the Customer’s business.
Role: controller (Module Two) or processor (Module Three).
Signature and date: the Customer’s acceptance of the Terms, which incorporate this DPA, is its signature, dated on the date of acceptance.

Data importer

Name: Lucrii Pty Ltd (ABN 46 694 710 211, ACN 694 710 211).
Address: PO Box 784, New Farm QLD 4005, Australia.
Contact person: privacy and security contact, support@lucrii.io.
Activities relevant to the data transferred: provision of the Service under the Terms.
Role: processor.
Signature and date: Lucrii’s publication of the Terms and this DPA, and its provision of the Service, is its signature, dated on the date of the Customer’s acceptance.

B. Description of the transfer and processing

Categories of Data Subjects

The Customer’s Users.
The Customer’s customers, suppliers and other business contacts, and their personnel.
Recipients of documents and messages the Customer sends through the Service.
Other individuals whose personal data Customer or its Users submit to the Service.

Categories of personal data

Identity and contact details.
Business and transaction records, such as quotes, orders, invoices, payments, items, tasks and notes, and the individuals named in them.
Files, documents and correspondence that Users upload, send or receive through the Service.
Records of Recipients’ acceptances, declines and confirmations of documents.
Hermes conversations, memories and other data Hermes derives from Customer Data.
Technical data about Users’ use of the Service to the extent it is recorded with Customer Personal Data, such as in session recordings and Hermes Content.

Sensitive data

None is intended. Clause 3.3 applies. Where sensitive data appears incidentally, the measures in Annex II apply to it.

Frequency of the transfer

Continuous, for as long as the Customer uses the Service.

Nature of the processing

Hosting, storage, retrieval, organisation, analysis (including by Hermes and its AI models), transmission at the Customer’s direction, sending email on the Customer’s behalf, backup and deletion.

Purposes of the processing

Providing, securing and supporting the Service in accordance with the Terms.
Running Hermes for the Organisation while Hermes is turned on, including producing de-identified aggregated statistics under clause 4.6.
Measuring and improving Hermes, including by sending Hermes Content to PostHog in the United States.
Product analytics, session replay with inputs masked, and diagnosing faults in the Service.
Recording evidence of Recipients’ actions on documents for the Customer.
Complying with law.

Duration of the processing

For the term of the Terms and afterwards for as long as the Customer’s Organisation exists in the Service, until deletion under clause 10. Lucrii deletes some data sooner, such as Hermes messages 90 days after they are sent.

Transfers to Sub-processors

The subject matter and nature of processing by each Sub-processor are the purpose stated for it on the Sub-processors Page, for the duration set out above.

C. Competent supervisory authority

The supervisory authority determined under Clause 13(a) of the Standard Contractual Clauses, as described in clause 11.2(e). For transfers subject to the UK GDPR, the UK Information Commissioner.

Annex II: Technical and organisational measures

Lucrii maintains the following measures. Each describes how the Service runs at the date of this DPA.

1. Hosting and network

1.1 The Service runs on Amazon Web Services in the Sydney region (ap-southeast-2). Hermes’ language models run on Amazon Bedrock in Australian regions (Sydney and Melbourne). Requests to the embedding models run through Amazon Bedrock’s cross-region inference and may be processed in AWS regions outside Australia.

1.2 The application servers, the database and the cache run in a private network with no public IP addresses, and only Lucrii’s content delivery network can reach the load balancer. The database server accepts connections only from Lucrii’s own services inside the private network, including the service that runs Apps, and from a single administrative access host.

1.3 Files that Users mark as public, such as pictures for documents, and attachments of emails sent in to the Service are served through Lucrii’s content delivery network and can be opened by anyone who has the file’s unique, randomly generated link. Other stored files are reachable only through Lucrii’s servers or through short-lived signed links.

2. Encryption

2.1 In transit. Data is encrypted in transit with TLS 1.2 or later between Users and the Service, and between Lucrii’s content delivery network and its servers. Lucrii’s servers send email to Amazon SES over a connection that requires TLS (STARTTLS). Amazon SES delivers email to the recipient’s mail server using TLS where that server supports it.

2.2 At rest. The database, its automated backups and stored files are encrypted at rest with AES-256.

2.3 Application-level encryption. Lucrii encrypts the credentials and other secrets that Apps and integrations store, and Users’ authenticator-app secrets, with AES-256-GCM before writing them to the database. User passwords are stored only as salted Argon2id hashes.

2.4 Infrastructure secrets, including the database credentials, are held in AWS Secrets Manager.

3. Access control in the Service

3.1 Each User has a role in an Organisation (Member, Team Leader, Administrator or Owner), and the role controls what the User can see and change. An Owner or Administrator can turn Hermes off for the Organisation.

3.2 Users can protect their accounts with two-factor authentication through an authenticator app or passkeys, with single-use backup codes, and can sign in with Google.

3.3 Lucrii asks a User to confirm their identity again before sensitive account and security changes, and limits the rate of sign-in, password reset and re-authentication attempts.

3.4 MCP Clients and Apps reach Customer Data only through access a User approves, limited to the scopes granted.

4. Access by Lucrii personnel

4.1 Lucrii limits access to production systems and Customer Data to personnel who need it to provide, secure or support the Service, under clause 5.

4.2 Administrative access to production systems requires AWS identity and access management credentials, and activity in Lucrii’s AWS account is recorded.

5. Backups and recovery

5.1 Automated backups of the database are kept for 7 days, and allow recovery to a point in time within that window.

5.2 Previous versions of changed or deleted stored files are kept for 30 days.

5.3 Backups and previous file versions expire on these schedules, which is how copies of deleted Customer Data leave Lucrii’s systems under clause 10.3.

6. Logging, monitoring and threat detection

6.1 The Service keeps an audit history of changes to records and of changes to an Organisation’s settings, members, Plan and Apps. Owners and Administrators can read the Organisation’s audit history in Settings.

6.2 Lucrii keeps application logs and access logs for 30 days.

6.3 Lucrii monitors the Service with Amazon CloudWatch alarms for server errors, unhealthy servers, high load and slow responses, and monitors its AWS account for threats with Amazon GuardDuty.

6.4 Amazon GuardDuty scans files that Users upload, and attachments of emails sent in to the Service, for malware, and tags any file it finds to be malicious. The scan does not block or remove a file.

6.5 Lucrii checks its AWS configuration against rules for encryption, public access and account security.

6.6 Container images are scanned for known vulnerabilities when they are pushed to Lucrii’s image registry.