Privacy Policy

Introduction

LDS Ventures LLC, doing business as Luda AI ("Luda AI," "we," "us," or "our"), is committed to protecting your privacy. This Privacy Policy explains how we collect, use, disclose, and safeguard information when you visit our website at goluda.ai, use our services, or interact with us in any way.

Luda AI provides AI-powered automation services to home service businesses ("Clients"), including AI voice receptionist systems, quote follow-up automation, review request automation, and outbound lead qualification tools. This Policy covers information collected from both our business Clients and, where applicable, end-customers whose data is processed through our Client services.

Information We Collect

2.1 Information You Provide Directly

• Contact and account information — name, email address, phone number, company name, and job title when you sign up, contact us, or engage our services
• Billing information — payment card details and billing address, processed securely through Stripe
• Communications — messages, emails, and other content you send to us

2.2 Information Collected Automatically

• Usage data — pages visited, features used, and interaction patterns on our website and platform
• Device and technical data — IP address, browser type, operating system, and referral URLs
• Cookies and similar technologies — as described in Section 09

2.3 End-Customer Data Processed on Behalf of Clients

When we provide automation services to our Clients, we may process personal data belonging to our Clients' customers ("End-Customer Data"), including names, phone numbers, email addresses, and appointment details. This data is processed solely on behalf of and under the instructions of our Clients. Luda AI acts as a data processor with respect to End-Customer Data.

How We Use Your Information

• To provide, operate, and improve our services
• To process transactions and send related information, including purchase confirmations and invoices
• To send administrative information such as updates to our terms and policies
• To respond to inquiries, comments, or questions
• To send marketing communications (where permitted and with your consent where required)
• To monitor and analyze usage trends and improve user experience
• To detect, prevent, and address technical issues or fraudulent activity
• To comply with applicable legal obligations

SMS Communications

Luda AI and its Clients may use SMS messaging as part of our service delivery. This section describes how SMS communications are handled.

4.1 SMS Sent by Luda AI Directly

We may send SMS messages to individuals who have explicitly opted in to receive communications from Luda AI, including appointment confirmations, service updates, and follow-up messages related to an inquiry submitted through our website or a service interaction.

4.2 SMS Sent on Behalf of Clients

Luda AI operates as an Independent Software Vendor (ISV) and technology platform. We send automated SMS messages on behalf of our home service business Clients to their customers who have opted in through the Client's own website, forms, or service interactions. Each Client is solely responsible for obtaining valid consent from their customers prior to SMS communications being sent.

4.3 Opt-Out and Help

• To opt out of SMS messages, reply STOP to any message. You will receive a confirmation and no further messages will be sent.
• To receive help or information, reply HELP to any message or contact us at david@goluda.ai.
• Opting out of SMS does not affect other communications such as email.

4.4 No Sharing of Phone Numbers

We do not sell, rent, or share your phone number with third parties for their own marketing purposes. Phone numbers are used solely to deliver the services described in this Policy and our SMS Terms.

For complete details on our SMS program, please review our SMS Terms and Conditions.

How We Share Your Information

5.1 Service Providers

We share information with trusted third-party vendors who assist us in operating our platform and delivering our services. These providers are contractually bound to protect your information and may not use it for their own purposes. Current service providers include:

• Supabase — database and authentication infrastructure
• Twilio — telephony and SMS infrastructure
• Retell AI — AI voice agent infrastructure
• ElevenLabs — AI voice synthesis
• Stripe — payment processing
• Vercel — hosting and deployment
• Anthropic (Claude API) — AI language model inference
• OpenAI — AI language model inference (where applicable)

5.2 Clients

End-user data processed through our services is shared with the applicable Client on whose behalf the service was rendered. Clients are responsible for their own use of this data in accordance with applicable laws.

5.3 Legal Requirements

We may disclose information if required to do so by law, court order, or governmental authority, or if we believe in good faith that disclosure is necessary to protect our rights, comply with legal process, or protect the safety of others.

5.4 Business Transfers

In the event of a merger, acquisition, or sale of all or substantially all of our assets, your information may be transferred as part of that transaction. We will notify active Clients via email prior to such a transfer.

Data Roles: Controller vs. Processor

The distinction between data controller and data processor matters for your rights under GDPR and other privacy laws:

Clients are responsible for having a lawful basis under applicable law (including GDPR Article 6 and CCPA) to collect and share end-customer data with Luda AI. Clients must have appropriate privacy notices in place for their own customers.

Data Retention

We retain personal information for as long as necessary to fulfill the purposes described in this Policy, unless a longer retention period is required by law:

• Client account information: retained for the duration of the service relationship and for up to three (3) years thereafter
• Call recordings: retained in accordance with Client account settings and applicable law
• Payment records: retained as required by applicable tax and financial regulations
• End-customer data processed in automation workflows: retained only as needed to deliver the service; deleted upon Client request or within 90 days of engagement termination
• Website analytics data: retained in aggregated or anonymized form

Data Security

We implement reasonable administrative, technical, and physical safeguards to protect the information we collect against unauthorized access, alteration, disclosure, or destruction. These measures include:

• Encrypted data transmission (TLS/SSL)
• Access controls and credential management practices
• Secure cloud infrastructure
• API key handling via encrypted vaults and one-time secret links — never transmitted over email or unencrypted channels

No method of transmission over the Internet is 100% secure. In the event of a data breach affecting your personal information, we will notify you and applicable authorities as required by applicable law, including the New Jersey Identity Theft Prevention Act (N.J.S.A. 56:8-163 et seq.).

Cookies and Tracking Technologies

Our website may use cookies and similar tracking technologies, including:

• Essential cookies — necessary for the website to function properly
• Analytics cookies — used to collect aggregated information about how visitors use our site
• Marketing cookies — used to deliver relevant content or track campaign performance

You may control cookie settings through your browser preferences. We do not currently respond to "Do Not Track" signals, but we will update this policy if that changes.

Children's Privacy

Our services are directed to businesses only and are not intended for individuals under the age of 18. We do not knowingly collect personal information from children. If we become aware that we have inadvertently collected information from a minor, we will take steps to delete it promptly.

International Data Transfers

Luda AI is co-founded and operated by individuals based in the United States (New Jersey) and Italy. As such, personal data may be accessed and processed from both jurisdictions. We take reasonable steps to ensure that international transfers of personal data comply with applicable data protection laws.

For individuals in the European Economic Area (EEA), data transfers to the United States are conducted in accordance with applicable transfer mechanisms. Clients and end users in the EEA should be aware that data protection laws in the United States may differ from those in the EEA.

Your Rights and Choices

Depending on your location and applicable law, you may have the right to:

• Access the personal information we hold about you
• Correct inaccurate or incomplete information
• Request deletion of your personal information
• Object to or restrict certain processing activities
• Request portability of your data
• Withdraw consent at any time (where processing is based on consent)

To exercise any of these rights, please contact us at the information in Section 15. We will respond within 45 days as required by applicable law.

State-Specific Privacy Rights

13.1 New Jersey Residents

New Jersey residents may have additional rights under the New Jersey Data Privacy Act (NJDPA), including the right to opt out of the sale of personal data and targeted advertising. To exercise these rights, contact us at the information in Section 15.

13.2 California Residents

California residents may have additional rights under the CCPA/CPRA, including the right to know, delete, correct, opt out of sale, and non-discrimination. To submit a CCPA request, contact us using the information in Section 15.

13.3 Other U.S. States

Residents of Virginia, Colorado, Connecticut, Texas, and other states with comprehensive privacy laws may have similar rights under their respective state laws. We honor valid requests from residents of all applicable jurisdictions.

Changes to This Policy

We may update this Privacy Policy from time to time. When we do, we will revise the "Last Updated" date at the top of this page. For material changes, we will provide additional notice via email to active Clients or via a prominent notice on our website. We encourage you to review this Policy periodically.

Contact Us

If you have questions, requests, or complaints related to this Privacy Policy or our data practices, please contact us:

We will respond to privacy-related requests within 45 days as required by applicable law.