LUXDriveLegal
Privacy Policy
1. Scope and controller
This policy explains how Lucas Systems ("we", "us") processes personal data when you visit luxdrive.cloud, buy a plan, create or use a LUXDrive workspace, or contact us. It follows the Personal Information Protection Act of the Republic of Korea (PIPA) and, for people in the European Economic Area, the United Kingdom and California, the GDPR, UK GDPR and CCPA/CPRA.
Controller for website, billing and account data: Lucas Systems, Republic of Korea. Business registration number: 172-05-03200. Address: 15, Ichon-ro 88-gil, Yongsan-gu, Seoul, 04425, Republic of Korea. Representative and personal-information manager: MYEONG HWAN KIM. Privacy contact: admin@luxdrive.cloud.
2. Our role: controller and processor
For the data of the people who use a LUXDrive workspace (account details, usage logs, billing contact) we are the controller. For the files, comments and other content that a customer organization stores in its workspace ("Customer Content") the customer is the controller and we are its processor: we process that content only on the customer's documented instructions and under the data-processing terms in our Terms of Service (a separate DPA is available on request). If you are an employee or client of a customer, please direct requests about Customer Content to that organization.
3. Personal data we process
| Category | Examples | Source |
|---|---|---|
| Account and identity | name, work e-mail, organization, role, language, profile photo, SSO identifiers (issuer and subject) | You, your administrator or your identity provider |
| Billing and purchase | billing name and address, country, tax ID, plan, subscription status, last four card digits and brand (we never see full card numbers) | You and Paddle |
| Workspace activity | file names and paths, version, lock and share events, comments, audit-log entries, IP address, device and client version | Generated when you use the Service |
| Customer Content | files, drawings, photos (including location metadata you choose to keep), messages and other content you upload | You and your colleagues |
| Technical and security | request logs, error reports, authentication events, rate-limit counters | Our servers and desktop client |
| Support and sales | e-mails, attachments and call notes when you contact us | You |
| Website | pages visited, referrer, browser type, approximate location from IP | Your browser |
We do not intentionally collect sensitive personal data (such as health, biometric or political data). Please do not put it into the sales site's forms.
4. Why we use it and on what basis
| Purpose | Basis (GDPR) / PIPA ground |
|---|---|
| Create and run your workspace, authenticate you, store and process files, provide support | Performance of a contract; PIPA: necessary to perform the contract |
| Take payment, issue invoices, manage subscriptions and licenses, prevent payment fraud | Contract; legal obligation (tax and accounting law) |
| Secure the Service, detect abuse, keep audit logs, back up data | Legitimate interests in security and reliability |
| Improve the Service using aggregated and de-identified usage statistics | Legitimate interests |
| Send service, billing and security notices | Contract; legitimate interests |
| Send marketing e-mail about LUXDrive | Consent, which you can withdraw at any time; we send none unless you opt in |
| Comply with law and respond to legal requests | Legal obligation |
We do not sell personal data and do not use Customer Content to train AI models for other customers. Where a customer turns on the AI assistant, content is processed to answer that customer's own questions, using only what the asking user is permitted to see.
5. Who we share it with
We share personal data only as needed, with:
- Paddle.com Market Limited, our merchant of record, which processes payments, taxes and invoices as an independent controller under its own privacy policy;
- Cloudflare, Inc., which delivers this website and sits in front of parts of the Service (network and security processing);
- Hosting, storage, backup and e-mail delivery providers that run our infrastructure and send service e-mails for us, as processors bound by data-processing terms;
- Your organization and its administrators, who can see the account and activity data of their users and the audit log;
- Professional advisers, auditors and authorities where required by law or to protect rights, and a successor in a merger or sale of the business, who must honour this policy.
A current list of sub-processors is available on request at the privacy contact above; we give customers notice of material changes.
6. International transfers
We are based in the Republic of Korea, and our providers may process data in other countries, including the United States and the European Union. Where personal data of people in the EEA or UK is transferred to a country without an adequacy decision, we rely on safeguards such as the European Commission's standard contractual clauses. Korean law requires us to tell you about overseas transfers of personal information: the recipients, countries and purposes are those listed in section 5 and in the sub-processor list; you may refuse transfers that are not necessary for the Service, but then we may be unable to provide it.
7. How long we keep it
| Data | Retention |
|---|---|
| Account data | While the workspace is active, then deleted within 90 days of termination (30 days of export access first) |
| Customer Content | Until the customer deletes it or the subscription ends; then export for 30 days, deletion from production within 30 days and from backups within a further 60 days. Items in the Recycle Bin follow the retention policy the administrator sets. |
| Billing and tax records | 5 years, or as required by Korean tax and commercial law |
| Audit and security logs | Up to 12 months, unless needed longer to investigate an incident |
| Support correspondence | 3 years after the case closes |
| Marketing consent records | Until you withdraw consent, then the minimum needed to honour the withdrawal |
Where law requires a longer period we keep only what is required, separately from live data.
8. Security
We protect personal data with measures that include encryption in transit, hashed and salted secrets (passwords and tokens are never stored in clear text), role-based access, tenant isolation, audit logging, least-privilege access for staff, regular backups and monitoring. If a breach is likely to put your rights at risk we will notify the affected customer without undue delay and, where required, the supervisory authority within 72 hours and the individuals concerned.
9. Your rights
Depending on where you live you may have the right to access your personal data, correct it, delete it, restrict or object to processing, receive it in a portable format, withdraw consent, and not be subject to solely automated decisions with legal effect (we make none). Under PIPA you may also ask us to stop processing or to explain how your data is processed. California residents have the rights to know, delete, correct and opt out of sale or sharing; we do not sell or share personal data for cross-context advertising.
To exercise a right, write to admin@luxdrive.cloud. We may need to verify your identity and will answer within 30 days (shorter where law requires). If your request concerns Customer Content, we will pass it to the customer that controls it. You may also lodge a complaint with your supervisory authority, in Korea the Personal Information Protection Commission (PIPC), or the Personal Information Dispute Mediation Committee.
10. Cookies and similar technologies
This website sets no advertising or cross-site tracking cookies. The checkout, which loads from Paddle when you press a purchase button, uses cookies and local storage that Paddle needs to process the payment and prevent fraud, under Paddle's policy. We use privacy-friendly, aggregated traffic measurement from Cloudflare that does not track you across sites. The web console and desktop client use strictly necessary cookies and storage for sign-in, language and layout preferences. You can block cookies in your browser; the sales site works without them, although checkout may not.
11. Children
The Service is for business use and is not directed to children under 16. We do not knowingly collect their personal data; if you believe a child has given us data, write to us and we will delete it.
12. Changes to this policy
We will update this policy when our practices change. For material changes we will notify workspace administrators by e-mail or in the web console at least 30 days in advance. The version and effective date are shown at the top of the page.
13. Contact and complaints
Privacy questions and requests: admin@luxdrive.cloud, subject "Privacy". If you are not satisfied with our answer you can complain to your data-protection authority.