Privacy Policy
Effective date: 12 August 2026
LulaWorks ("LulaWorks", "we", "us") is committed to protecting your privacy. This policy explains what information we collect, how we use and protect it, and the rights you have. We apply internationally recognised data-protection standards and comply with the laws that apply to you, including the EU General Data Protection Regulation (GDPR), the California Consumer Privacy Act as amended by the CPRA (CCPA/CPRA), the Protection of Personal Information Act (POPIA) where applicable, and other local data-protection laws as our service expands. Where regimes differ, we apply the standard that gives you the strongest protection.
1. Information we collect
Account information
When you create a company or a user account we collect your name, email address, phone number, company details and password (stored only in encrypted, hashed form).
Usage information
We collect information about how you use the platform — pages visited, actions taken, device and browser type, and IP address — to operate, secure and improve the service.
Uploaded documents
When you upload documents (such as RFQs, purchase orders, supplier invoices and delivery notes), we store and process them so we can provide the features you use, including AI extraction.
Cookies
We use cookies as described in our Cookie Policy.
2. How we process your data
We process personal information to: provide and maintain the service; authenticate users; process your documents and generate outputs; handle billing and subscriptions; provide support; and comply with legal obligations. Our lawful bases include performance of our contract with you, your consent (where required), our legitimate interests in operating the service, and legal compliance.
3. Third-party services
We use trusted third-party providers for hosting, storage, payment processing and — where you enable AI features — AI processing. These providers process data only on our instructions and under appropriate safeguards. We do not sell your personal information to anyone.
4. AI processing
Where you use AI features, the relevant document text may be sent to an AI provider to extract or generate content. This happens only when you trigger an AI action. We do not use your data to train third-party public models, and the deterministic (non-AI) parts of the platform never send your data to an AI provider.
5. Data security
We protect your data with encryption in transit, role-based access controls, audit logging and strict tenant isolation so one company can never access another's data. No method of transmission or storage is completely secure, but we take reasonable, industry-standard measures to protect your information.
6. Data retention
We retain your information for as long as your account is active and as needed to provide the service. After account closure we retain data only as required to comply with legal, tax and accounting obligations, after which it is deleted or anonymised.
7. Your rights
Subject to applicable law, you have the right to access, correct, update or delete your personal information, to object to or restrict certain processing, to withdraw consent, to data portability, and (where applicable) to opt out of the "sale" or "sharing" of personal information and to non-discrimination for exercising your rights. To exercise any of these, contact us using the details below.
8. International data transfers
We operate globally, so your information may be processed in countries other than the one you live in. Wherever data is transferred across borders, we put appropriate safeguards in place — such as standard contractual clauses or equivalent mechanisms — consistent with GDPR, CCPA/CPRA, POPIA and other applicable laws.
9. Changes to this policy
We may update this policy from time to time. Material changes will be notified through the service or by email, and the effective date above will be updated.
10. Contact us
For privacy questions or to exercise your rights, email privacy@lulaworks.co.za.