Privacy Policy

Effective Date: January 21, 2026
Last Updated: January 21, 2026

Atina, Inc. ("Atina," "we," "us," or "our") is committed to protecting your privacy. This Privacy Policy explains how we collect, use, disclose, and safeguard your information when you use Lucy, our Google Sheets add-on for finance automation.

By using Lucy, you consent to the data practices described in this policy.

1. Information We Collect

1.1 Google Sheets Data

When you use Lucy, we access and process:

• Transaction data from your Google Sheets, including amounts, dates, descriptions, and categories
• Spreadsheet structure including column headers, formulas, and formatting
• Historical transaction records that you choose to categorize using Lucy

1.2 Google Account Information

We collect limited information from your Google account:

• User ID to identify your account and maintain service continuity
• Email address for account management and service communications (note: we do NOT access your Gmail inbox or email content)

1.3 Usage Data

We automatically collect:

• Service usage statistics including features used, frequency of use, and performance metrics
• Error logs and diagnostic data to improve service quality
• Interaction patterns with the add-on interface

1.4 Data We DO NOT Collect

Lucy does NOT collect:

• Your Gmail messages or email content
• Google Calendar data
• Google Drive files (except the Sheets you explicitly use with Lucy)
• Personal contacts
• Location data
• Browsing history

2. How We Use Your Information

We use the collected information for the following purposes:

2.1 Core Service Functions

• Transaction categorization: Analyzing and categorizing financial transactions using AI-powered scripts
• Data automation: Reading and writing data to your Google Sheets as requested
• Historical analysis: Storing transaction history to improve categorization accuracy over time
• Service delivery: Providing the core features and functionality of Lucy

2.2 Service Improvement

• Performance optimization: Analyzing usage patterns to improve speed and reliability
• Feature development: Understanding user needs to develop new features
• Error detection: Identifying and fixing bugs and technical issues

2.3 Communication

• Service updates: Notifying you of important changes to Lucy
• Support: Responding to your questions and support requests
• Beta feedback: Gathering feedback during the beta testing period

3. How We Store Your Information

3.1 Data Storage Locations

Your data is stored in:

• PostgreSQL database: We maintain a secure PostgreSQL database where historical transaction data is stored for categorization and analysis purposes
• Google Sheets: Data remains in your Google Sheets under your control
• Secure cloud infrastructure: Our systems are hosted on enterprise-grade cloud infrastructure with industry-standard security measures

3.2 Data Security

We implement reasonable technical and organizational measures to protect your data:

• Encryption of data in transit using TLS/SSL protocols
• Encryption of data at rest in our PostgreSQL database
• Access controls limiting employee access to customer data
• Regular security audits and updates
• Secure authentication through Google's OAuth system

However, no method of transmission or storage is 100% secure. We cannot guarantee absolute security.

4. How We Share Your Information

4.1 AI Service Provider (Third-Party Data Processor)

To provide transaction categorization, we use Anthropic's Claude API (Sonnet 4.5 model) as a third-party data processor:

What data is shared:

• Transaction descriptions (text only, e.g., "Amazon.com purchase", "Payroll deposit")
• Transaction amounts (numbers only)
• Transaction dates

When data is shared:

• ONLY as a fallback when our automated categorization scripts cannot determine the category
• NOT for every transaction - only uncertain ones
• Estimated frequency: 10-20% of transactions require AI fallback

Why data is shared:

• To provide accurate AI-powered categorization when rule-based systems fail
• To improve user experience and reduce manual work

How Anthropic processes your data:

• Anthropic processes this data solely to provide AI categorization services
• Anthropic is bound by their own privacy policy and terms of service at https://www.anthropic.com/legal/privacy
• We use Claude API in accordance with Anthropic's Commercial Terms of Service
• Anthropic does not use your data to train AI models (per their API terms)

Data security:

• All data transmitted to Anthropic is encrypted in transit (TLS 1.3)
• Anthropic does not store your data after processing is complete
• We have a Data Processing Agreement with Anthropic as required by GDPR

4.2 We DO NOT Share Data With:

• Advertising networks
• Data brokers
• Marketing companies
• Social media platforms
• Any other third parties for their own purposes

4.3 Legal Requirements

We may disclose your information if required by law or in response to:

• Valid legal process (subpoenas, court orders)
• Requests from government authorities
• Protection of our rights, property, or safety
• Prevention of fraud or illegal activity

4.4 Business Transfers

If Atina, Inc. is involved in a merger, acquisition, or sale of assets, your information may be transferred. We will notify you before your information becomes subject to a different privacy policy.

5. Data Retention

5.1 Google Sheets Data Retention

Data from Google APIs is retained as follows:

• Transaction history: Retained for as long as you actively use Lucy to improve categorization accuracy
• Sheet structure metadata: Retained only during active sessions
• Deleted immediately: Any temporary data used for processing is deleted within 24 hours
• Upon your request: We delete all your data within 30 days of receiving a verified deletion request

5.2 Active Users

• We retain your transaction history for as long as you actively use Lucy
• Historical data improves categorization accuracy over time
• You can request deletion of your data at any time

5.3 Inactive Users

• If you uninstall Lucy, we will retain your data for 30 days to allow for reinstallation
• After 30 days, we will automatically delete your data from our PostgreSQL database
• You can request immediate deletion at any time by emailing andres@atina.app
• Data in your Google Sheets remains under your control at all times

5.4 Legal Retention

We may retain certain data longer if required by law or for legitimate business purposes (e.g., resolving disputes, enforcing agreements).

6. Your Rights and Choices

6.1 Access and Correction

You have the right to:

• Access the data we have collected about you
• Request correction of inaccurate data
• Update your information through the Lucy interface

6.2 Data Deletion

You may request deletion of your data by:

• Emailing andres@atina.app with your deletion request
• Uninstalling Lucy (automatic deletion after 30 days)

We will respond to deletion requests within 30 days.

6.3 Data Export

You may request a copy of your data in a machine-readable format. Contact andres@atina.app to request data export.

6.4 Opt-Out of Communications

You may opt out of non-essential communications by:

• Following unsubscribe instructions in emails
• Contacting andres@atina.app

Note: We may still send you essential service-related communications.

7. Google API Services User Data Policy and Limited Use Disclosure

What this means for you:

Lucy accesses your Google Sheets data solely to provide transaction categorization and finance automation features that you explicitly request. We limit our use of your Google user data to these specific purposes:

7.1 Limited Use Compliance

We ONLY use your Google Sheets data to:

• Read transaction data that you choose to categorize
• Write categorization results back to your sheets
• Store historical transaction patterns to improve accuracy
• Provide the core finance automation features you requested

We DO NOT:

• Use your Google data for serving advertisements
• Sell your Google data to third parties
• Use your Google data for purposes unrelated to providing Lucy's services
• Allow humans to read your data except for:
  • Security purposes (detecting abuse, fraud, or security incidents)
  • Compliance with applicable laws
  • When you explicitly provide consent for support purposes

7.2 Data Transfer to Third Parties

The ONLY third party that receives your Google Sheets data is:

• Anthropic Inc. (Claude API) - receives transaction descriptions ONLY when our automated scripts cannot categorize them, solely for the purpose of providing AI-powered categorization

No other third parties receive, access, or process your Google Sheets data.

8. Children's Privacy

Lucy is not intended for use by individuals under the age of 18. We do not knowingly collect personal information from children. If we discover we have collected information from a child, we will delete it immediately.

9. International Data Transfers

Your data may be transferred to and processed in the United States where Atina, Inc. is located. By using Lucy, you consent to the transfer of your data to the United States.

We implement appropriate safeguards to ensure your data receives adequate protection in accordance with applicable data protection laws.

10. California Privacy Rights (CCPA)

If you are a California resident, you have additional rights under the California Consumer Privacy Act:

• Right to Know: Request details about the personal information we collect and how we use it
• Right to Delete: Request deletion of your personal information
• Right to Opt-Out: Opt out of the "sale" of personal information (note: we do not sell personal information)
• Right to Non-Discrimination: We will not discriminate against you for exercising your privacy rights

To exercise these rights, contact andres@atina.app.

11. European Privacy Rights (GDPR)

If you are in the European Economic Area, you have rights under the General Data Protection Regulation:

• Right of Access: Access your personal data
• Right to Rectification: Correct inaccurate data
• Right to Erasure: Request deletion of your data
• Right to Restriction: Limit how we process your data
• Right to Data Portability: Receive your data in a portable format
• Right to Object: Object to certain processing activities
• Right to Withdraw Consent: Withdraw consent at any time

To exercise these rights, contact andres@atina.app.

Legal Basis for Processing: We process your data based on:

• Contract performance (providing Lucy services)
• Legitimate interests (improving our services)
• Consent (where explicitly obtained)

12. Cookies and Tracking

Lucy does not use cookies or tracking technologies within the Google Sheets interface. Our backend services may use minimal session management for service functionality.

13. Third-Party Links

Lucy may contain links to third-party websites or services. We are not responsible for the privacy practices of these third parties. We encourage you to review their privacy policies.

14. Changes to This Privacy Policy

We may update this Privacy Policy from time to time. Changes will be posted on this page with an updated "Last Updated" date. Material changes will be communicated via:

• Email notification
• In-app notification
• Prominent notice on our website

Continued use of Lucy after changes constitutes acceptance of the updated Privacy Policy.

15. Data Breach Notification

In the event of a data breach that affects your personal information, we will:

• Notify affected users within 72 hours of discovery
• Provide details about the breach and affected data
• Outline steps we are taking to address the breach
• Advise you on protective measures you can take

16. Contact Information

If you have questions, concerns, or requests regarding this Privacy Policy or your data, please contact us:

Atina, Inc.
218 Front Street
Brooklyn, New York 11201
United States

Email: andres@atina.app
Website: https://www.atina.app

For privacy-specific inquiries, please include "Privacy Request" in your email subject line.

17. Complaints

If you believe we have not complied with this Privacy Policy or applicable privacy laws, you may:

• Contact us at andres@atina.app to resolve the issue
• File a complaint with your local data protection authority (for EEA residents)
• File a complaint with the California Attorney General (for California residents)

By using Lucy, you acknowledge that you have read and understood this Privacy Policy and agree to the collection, use, and disclosure of your information as described herein.

Appendix: Data Processing Summary

Quick Reference Guide

Data Retention Timeline:

• Active users: Indefinitely (while using Lucy)
• After uninstall: 30 days, then deleted
• Minimum retention for legal compliance: As required by law