Legal

Privacy notice

Last updated 5 November 2026

Ask Lucy is an AI assistant for companies, on Mistral models, run in the European Union or in your own data centre. This notice explains what we collect on this website and in the Ask Lucy app, what we deliberately do not, and the choices you have.

1. Who we are

In Good Company SARL, a company established in Luxembourg, makes Ask Lucy ("we", "us"). For any privacy question, or to exercise your rights, write to hello@asklucy.eu.

Our role depends on the data:

• This website, demo requests and our customer relationship: we are the controller.
• What your organisation puts into Ask Lucy (conversations, files, memory, connected applications): your organisation is the controller and we are its processor, under the data processing agreement we sign with it. If you use Ask Lucy at work, your employer decides how this data is used, and is your first contact for requests about it.

2. This website

asklucy.eu sets no cookies, stores nothing on your device except your light or dark choice if you make one, and loads no fonts, scripts or images from anyone else. There is no analytics, no advertising and no tracking pixel.

Our web server processes the technical data any request carries, such as your IP address and browser, to deliver the page and keep the site secure. We keep these logs only as long as that requires.

When you book a demo, your message reaches us by email, with the name, company and contact details you choose to give. We use them to answer you and to arrange the demo, and keep them for as long as we are in touch.

3. The Ask Lucy app

Your account

You sign in through your organisation (single sign-on) or with an Ask Lucy account. We hold your name, work email, your organisation, your role in it, and your settings, so you can sign in and your administrators can manage access.

Your work

Conversations, files you attach, what Lucy makes for you, and the memory Lucy keeps for your organisation are stored in your organisation's space, separated from every other organisation down to each row of the database. We do not use them to train models, and we do not read them except when your organisation asks us to, for support, or when the law requires it.

When you mention an earlier chat, or earlier work would help, Lucy can search your own chats and read the one it needs to answer you. It sees only yours, never a colleague's, and only what was written in them. You can turn this off in the app, under Settings, Personalization.

The models

Lucy runs on Mistral models, through Mistral AI's EU endpoint or on open-weight models in an environment we or your organisation control. Zero data retention is the default: the model provider keeps neither your prompts nor its answers once an answer is written.

The record

So your organisation can show how work was done, Ask Lucy keeps an audit record: who asked what, which model answered, each tool Lucy used and what happened to the data. The record stays in your organisation's environment, under its retention policy.

Applications you connect

If your organisation connects other applications to Lucy, such as its email, calendar or file storage, Lucy reads and writes there only on your behalf and only within what you allowed. Those applications are your or your organisation's own providers, under your or its own terms with them.

Google accounts: Gmail, Google Calendar and Google Drive

You can connect your own Google Account in the app, under Settings, Connectors. You choose which of its apps Lucy may use, within what your organisation allows. This is how Ask Lucy handles the data it receives from Google's APIs. Where these rules are stricter than the rest of this notice, they apply.

• What Ask Lucy can access. Your name, email address and Google account ID, to show which account is connected. Then only the apps you chose: Gmail (search and read your mail, write drafts into your Drafts), Send mail (send a message you approved), Google Calendar (see your events, add a meeting you approved) and Google Drive (search and read your files, read only).
• How it is used. Only to do what you ask in Ask Lucy. Lucy searches or reads your mail, calendar or files when a request of yours needs it, or when an agent you set up and connected runs. It writes the drafts you ask for, and it sends a message or adds a meeting only after you approve that exact message or meeting. Ask Lucy keeps no copy of your mailbox, calendar or Drive.
• Who receives it. To write an answer, what Lucy read is sent to the model that writes it: Mistral AI's EU endpoint, which keeps neither the prompt nor the answer, or an open-weight model in an environment we or your organisation control. It goes to no one else.
• How it is stored. The access Google grants Ask Lucy (its tokens) is encrypted with AES-256 in our database in the European Union, used only by the service that calls Google, and never shown in the app. What Lucy read to answer you stays in that conversation, in your organisation's space, and is deleted with it under your organisation's retention. Lucy reads it again from there only for you, when you refer to that chat in another of yours. Facts Lucy remembers from it stay in your personal memory unless you choose to share them.
• What we never do. We do not sell your Google data, use it for advertising, or transfer it to anyone except as described here. We do not use it, or anything derived from it, to develop, improve or train artificial intelligence or machine learning models. No one at In Good Company reads it, unless you ask us to look at specific messages or files, it is needed for security (for example, to investigate abuse), or the law requires it.
• How to stop. Disconnect in Settings, Connectors, and Ask Lucy deletes its access to your Google Account at once. You can also remove Ask Lucy from your Google Account, under Third-party apps & services. To delete what Lucy read, delete those conversations, or ask your organisation or us.

Ask Lucy's use and transfer to any other app of information received from Google APIs will adhere to the Google API Services User Data Policy, including the Limited Use requirements.

Web search

Web search is off unless your organisation turns it on. When it is on and a question needs it, only the search query leaves Ask Lucy, never your files.

Usage

We count how much each person and organisation uses, so limits and budgets work and we can bill your organisation. The app carries no advertising or third-party analytics.

4. How we use data

• To run Ask Lucy for your organisation and provide the features you use.
• To keep the service secure, prevent abuse and investigate incidents.
• To answer you, provide support and arrange demos.
• To bill our customers and meet our legal obligations.

We do not sell personal data, and we do not use your work to train models.

5. Legal bases

Under the GDPR we rely on: performance of a contract (running the service for our customer),legitimate interests (securing the service, answering demo requests, understanding aggregate usage), legal obligation (where the law requires it), and consent where we ask for it, which you may withdraw at any time. For the data we process for your organisation, its own legal basis applies.

6. Who we share with

We use a small set of processors, each in the European Union and each bound by a data processing agreement:

• Mistral AI (France): the models.
• Our hosting, in data centres in the European Union.

We share personal data with no one else, except where the law requires it. Your organisation can ask us for the current list of processors at any time.

7. Where your data stays

Your data is stored and processed in the European Union, or in your own data centre if your organisation runs Ask Lucy there. We do not transfer it outside the European Economic Area.

8. Retention

Your organisation sets how long conversations, files and the record are kept, and can delete them. We keep account data while the account is active. When your organisation's contract ends, we return or delete its data as the contract says, except what the law requires us to keep.

9. Your rights

You have the right to access, correct, delete, export or restrict the processing of your personal data, and to object to some processing. For data your organisation controls, ask it first; we help it answer. Otherwise, write tohello@asklucy.eu. You also have the right to complain to a data protection authority; in Luxembourg, that is the Commission nationale pour la protection des données (CNPD).

10. Security

Encryption in transit and at rest, single sign-on, role-based access, row-level separation of every organisation's data, and an audit record of what Lucy did. No system is perfectly secure, and if a breach affects your data we tell your organisation without undue delay.

11. Children

Ask Lucy is a service for companies and is not meant for anyone under 16.

12. Changes

We may update this notice as Ask Lucy grows. We change the date at the top, and for material changes we tell our customers before they take effect.

13. Contact

Questions about this notice or your data: hello@asklucy.eu.