What Luculent collects

Defaults

Individual plans, free and paid outside the EU/EEA/UK: operational telemetry is on (Full, with an option to choose Essential only in Settings), and product insights are on by default with a first-run notice and one-click off switch.

Individual plans in the EU, EEA and UK (or unknown region): operational telemetry defaults to Essential only (Full offered in the first-run prompt), and product insights start off and require explicit opt-in before anything is sent.

Business, Enterprise and team workspaces: operational telemetry is on (Full, but org admins can restrict it to Essential only for the whole organization; members see read-only status). Product insights are always off: no toggle, no admin option.

Signed out: nothing is sent.

We decide your region from your billing country, then your sign-up country, then your connection IP country (discarding the IP). If we cannot tell, we treat you as EU, EEA or UK and ask first.

What is collected when sharing is on

Tier A operational telemetry (Essential: token counts, model id, provider, route, request type, estimated cost, sync health, crash diagnostics; Full adds latency TTFT, retries, and performance timings).

Tier B product insights (usage metadata only):

• Which connectors you connect or remove, how they sign in, and the provider scope names granted (for example repo:read).
• The shape of the objects a connector can see: object kinds, counts, field types and dependency counts. Never the names or contents of those objects.
• Role mappings you choose (for example a provider admin role mapped to Luculent admin), as role types only.
• Use cases you pick during setup.
• SOP drafts you approve, edit or reject, with the kind of edit (wording, step added, check changed and so on) and the step count.
• Enforcement verdicts (proceed, block, redirect, hold), their reason codes, and whether someone overrode them.
• App type, version and operating system family.

No content

No content is collected on any plan in either tier: no prompts, conversation messages, model responses, document text, SOP text, file names or paths, URLs, query text, connector payloads, or free text. There is no content switch.

What is never collected

• Your prompts, assistant conversations, model responses, source code, document text, SOP text, file contents or file names.
• Query text, repository paths, or specific URLs.
• Names of people, organizations, workspaces, projects or repositories, email addresses, or IP addresses in shared data.
• API keys, provider keys, tokens or passwords.
• Your model provider traffic. It goes directly from your device to the provider you chose, including OpenRouter.
• Session replay, keystroke logging, or screen recording.

Why we collect it

Operational telemetry is needed to calculate token billing, show accurate per-model usage charts on the Usage page, enforce rate limits, and maintain sync reliability. Product insights help us learn which connector scopes and SOP patterns work, so setup suggestions and enforcement get better. Product insights are anonymized and combined with data from at least 50 other organizations before any aggregate conclusion is drawn.

How it is processed and where it goes

Events go to one Luculent endpoint. Tier A operational events flow into Cloudflare Workers Analytics Engine for time-series aggregates, with rollups stored in Neon Postgres under tenant row level security. Tier B events go into a staging store in your region (EU accounts in the EU, everyone else in the US).

An anonymization pipeline removes identifiers, replaces stable keys with hashes that use a rotating secret salt, rounds counts into ranges, drops any pattern seen in fewer than 50 organizations (k >= 50), and scans the result for personal data before anything is kept.

How long it is kept

Raw shared events: at most 30 days, then deleted by the pipeline.

Tier A rollups and aggregates: kept for 24 months to support billing history and annual reporting. Raw Analytics Engine points have a fixed 3-month retention.

Anonymized aggregates: rebuilt on every pipeline run from the raw events that are still allowed, so they never outlive the raw data they came from by more than one run.

Your consent history: kept for the life of your account, so you and your admins can see every change in the append-only audit log.

Turning it off

Turning sharing off stops capture on the server at once and on your devices within one minute. Your raw shared events are deleted right away, your contributions leave the aggregates on the next pipeline run, and everything is gone within 30 days. You get a deletion confirmation in Settings.

Turning product insights off stops all product insights capture. Operational telemetry is separate: choose Essential only to send just the fields billing and the Usage page need. Signed out, nothing is sent. Your own model or provider calls and the connectors you chose still use the network.

See and export your data

Settings > Privacy shows the queued and sent events for your account, lets you preview what is sent in plain language and raw JSON, filter by event type, and download your export data as JSON.

Data Processing Addendum

Business, Enterprise and team workspaces send operational telemetry only (Tier A). Org-private telemetry data is visible only to that organization's admins, and Luculent use is limited to operational, billing, and reliability needs. For individual plans, Luculent acts as an independent controller only for anonymized aggregates (k >= 50), and as processor for the raw shared events until they are deleted.

Data sharing annex to the DPA:

• Subject matter: operational telemetry and usage metadata only, as listed on this page. No content and no special category data.
• Purpose: providing cloud synchronization, token accounting, billing, and improving Luculent SOP suggestions from anonymized aggregates. Not advertising, not sold, not shared with other customers.
• Location: raw events stay in the customer region (EU accounts in the EU, others in the US). Aggregates are built inside that region.
• Retention: raw events at most 30 days; withdrawal removes raw events at once and from aggregates on the next run, within 30 days at the latest, with a confirmation record.
• Security: tenant isolation by row level security, a separate least-privilege pipeline role, hashed keys with a rotating salt, k-anonymity of 50 organizations and a personal data scan before storage.
• Sub-processors for this data: Cloudflare (hosting, Workers Analytics Engine) and Neon (database), in the region above.

Every field we accept

Generated from the event schema the server enforces. Anything not listed here is rejected.