Privacy Policy

1. Who we are and scope

Luepe is a website assistant that answers visitors’ questions from the approved content of a website, links to its sources and lets visitors send a request to the website’s team. Luepe is operated by ALFIN TECHNOLOGY SOLUTIONS SRL (“Luepe”, “we”).

This notice covers the public website luepe.com, the Luepe workspace (luepe.com/admin), sign-up and sign-in, team invitations, the live assistant at luepe.com/chat, and the Luepe assistant when a customer installs it on its own website.

Our role depends on the activity:

• Controller: for luepe.com, Luepe accounts and team members, invitations, the live assistant on luepe.com, and the security of our service.
• Processor: for the questions and requests of visitors to a customer’s website, where the customer decides why and how its assistant is used (see section 6).

2. Information we collect

Accounts and sign-in

Email address, a Firebase user identifier, the time the account was created and of the last sign-in. With Google sign-in, Google tells us your email address and account identifier. With email and password, the password is stored by Google Firebase Authentication; Luepe never sees it.

Team membership

The accounts you belong to, your role (owner, admin, editor or viewer), the email addresses you invite, and when an invitation was sent.

Workspace content

What you enter for an account: its name, websites and domains, assistant settings, an optional assistant picture, approved texts and FAQs, and the text of the public pages of your website that Luepe reads when you scan it.

Audit log

Changes made in the workspace or by Luepe staff, with the time, the action and the email address of the person who made it.

Assistant questions

The question a visitor types, used to find matching approved content and produce an answer. It is not stored by Luepe (see section 5).

Assistant requests

Only if a visitor chooses to send one: name, email address, message, a separate marketing preference and the time it was sent.

Technical and usage data

A random session token, a daily digest derived from the IP address to apply rate limits, counts of answered and unanswered questions without their content, and security logs kept by our hosting provider.

Please do not enter special-category data, passwords, payment details or other information that is not needed for your question or request. If you add content about other people to your workspace, you must have a lawful basis to publish and share it.

3. How and why we use information

We do not use your data for advertising, we do not sell it, and we do not use customers’ content or visitors’ questions to train AI models.

4. Cookies and browser storage

• luepe.com: the public pages set no cookies and use no analytics or advertising trackers.
• Workspace: while you are signed in, your sign-in session and the selected site are kept in your browser’s session storage, which is cleared when you close the tab. Google Firebase Authentication may set the technical data it needs to complete a Google sign-in.
• The assistant: sets no cookies and uses no browser storage. Its session token stays in the page’s memory and disappears when the page is closed.

The install code a customer adds to its website waits for the visitor’s consent in the customer’s consent manager (the functional or preferences category, or the equivalent setting) before the assistant loads. If the visitor declines or withdraws that consent, the assistant is not loaded or is removed.

5. The Luepe assistant

Questions and answers

When you ask a question, it is compared with the approved content of that website to find the most relevant passages. When AI answers are enabled, your question and those passages are sent to Luepe’s answer service on Google Cloud in Belgium (europe-west1), which calls Google Cloud Vertex AI through its EU endpoint to write the answer. Without AI answers, the assistant shows matching excerpts instead.

Luepe does not store the text of questions or answers. We keep only counts without content (for example, how many questions were answered) and technical measurements such as duration and the number of tokens used.

Session and rate limits

A random session token is valid for 30 minutes and kept in browser memory. A daily digest derived from your IP address is used to apply rate limits and is deleted after at most 48 hours.

Requests to the website’s team

If you choose to send a request, your name, email address, message and separate marketing preference are shown to the website’s team in its Luepe workspace and kept for at most 90 days. Marketing consent is never pre-ticked and is not required. After sending, you receive a deletion code: you can delete your request at any time with “Delete my request” in the assistant.

A website owner can also choose to pass the request to its own contact system on its website. In that case the website owner’s own privacy notice applies to that copy.

6. Customers’ websites and our role

When a customer installs Luepe on its website, the customer is the controller of its visitors’ questions and requests and Luepe processes them on the customer’s behalf. The customer is responsible for its own privacy notice, for a lawful basis and for collecting the visitor’s consent where required. Visitors who want to exercise their rights over a request should contact the website owner; we assist the owner as its processor and can delete a request with its deletion code.

Each customer’s data is kept separate from every other customer’s. Members of one account cannot see another account’s content, and the assistant only answers from the content of the website it is installed on and only links to that website.

Luepe staff who operate the platform can manage accounts, domains and members, but the platform console does not give them access to customers’ content or visitors’ requests. Where Article 28 GDPR applies, the customer relationship should include a Data Processing Agreement; contact us to arrange one.

7. Service providers and disclosures

We do not sell personal data. We share data only where needed to run Luepe, deliver what you asked for, meet legal duties or protect rights. Recipients may include:

• authorised Luepe personnel who need access for their role;
• Hostinger, which hosts luepe.com, the Luepe service and its database;
• Google Firebase Authentication for sign-in, verification and password-reset emails;
• Google Cloud (Cloud Run in Belgium, europe-west1) for the answer service and for the page renderer that opens a customer’s public pages during a scan;
• Google Cloud Vertex AI, called through its EU endpoint, to generate answers;
• Lettermint for transactional email, currently team invitations;
• Google Fonts for delivery of the website’s typefaces;
• professional advisers, public authorities or courts where disclosure is legally required.

Providers act under contractual confidentiality and data-protection terms appropriate to the service they provide.

8. International transfers

We choose EU regions where a provider offers them; the answer service, page renderer and AI model calls run in the EU. Some providers, such as Google for sign-in and fonts, may process data in, or permit access from, countries outside the European Economic Area. Where an adequacy decision does not apply, we rely on an appropriate transfer mechanism, such as the European Commission’s Standard Contractual Clauses, with supplementary safeguards where required.

Contact us for more information about the safeguards for a specific provider.

9. Retention

Data may be deleted earlier when it is no longer needed, or kept longer where required by law, a legal hold or the establishment, exercise or defence of legal claims.

10. Security

We use technical and organisational measures designed to protect personal data, including encrypted transport, server-side authentication and role-based authorisation, strict separation between customer accounts, signed requests between our services, verification of domain ownership, rate limits, data minimisation and an audit log of changes. Uploaded pictures are checked and re-encoded, which also removes embedded metadata such as location. Service secrets are stored outside the public web folder. No online system can guarantee absolute security.

If a personal-data breach occurs, we will assess it and make the notifications required by applicable law, including to affected customers where we act as their processor.

11. AI-generated answers

The assistant gives information; it does not make legal, financial, employment or similarly significant decisions about anyone. When the approved content does not cover a question, the assistant says so instead of guessing and offers to pass the question to the website’s team.

12. Your GDPR rights

Depending on the processing and applicable conditions, you may have the right to:

• access your personal data;
• correct inaccurate or incomplete data;
• request erasure;
• restrict processing;
• object to processing based on legitimate interests;
• receive portable data where the right applies;
• withdraw consent at any time;
• lodge a complaint with a supervisory authority.

To exercise a right, email info@alfintechs.com. For a request you sent through an assistant on another company’s website, you can also contact that company. We may need to verify your identity and clarify your request. We normally respond within one month, subject to permitted extensions.

13. Children’s privacy

Luepe accounts are intended for organisations and business professionals, not for children. We do not knowingly collect personal data from children. Contact us if you believe a child has given us personal data.

14. Changes to this notice

We update this notice when our service, providers or legal obligations change. The current version and update date are shown at the top of this page. Where a change materially affects existing processing, we will give additional notice, for example by email to account owners.

15. Contact and complaints

16. Current service-provider list

The list is reviewed when providers are added, replaced or materially changed.