LuPrivacy policy
Last updated 19 October 2026
LuSaaS is a CRM and marketing platform for small businesses and agencies. This policy explains what personal information we collect, why, who we share it with, and the choices you have. It covers lusaas.com, app.lusaas.com, demo.lusaas.com and pkonline.com, where our customers' public forms and email links live.
In short: we collect what we need to run the service, we don't sell personal information, we don't use it for advertising, and you can ask us to show you, correct or delete what we hold about you at contact@lusaas.com.
1. Two kinds of information
About our users. When you sign up or use LuSaaS, we are responsible for the information about you and your account.
Inside our customers' workspaces. Businesses use LuSaaS to keep their own contacts, leads, deals, quotes and invoices, and to run forms and send email. That information belongs to the business, which decides what to collect and how to use it. We store and process it only to provide the service to that business. If you are one of their contacts, please contact that business first; we will help them answer you.
2. What we collect
- Account details: your name, email address and password (stored only as a secure hash), and, if you turn on two-factor sign-in, its secret (stored encrypted).
- Workspace details: business name, contact email, postal address, logo, brand colour and settings you enter.
- Security and usage records: sign-in times, IP address and browser type, and a log of changes made in each workspace (who changed what, and when). We use these to keep accounts secure and to investigate problems.
- Email records: for each email the service sends, the recipient, subject, time and whether it was delivered or why it was not.
- Consent records: when someone agrees to receive email through a form, we keep the exact words they were shown, when they agreed, and from which IP address, and any later unsubscribe. The law requires senders to be able to prove consent.
- Messages to us: what you send through the contact form on lusaas.com or by email.
3. Facebook and Instagram
LuSaaS can connect to Facebook Pages and Instagram accounts so a business can schedule and publish its own posts and see how they perform. This only happens if a user chooses to connect an account and approves the permissions Facebook shows them. When connected, we receive the Page or account name and ID, an access token, and the posts, comments and performance figures needed for the features that user turns on.
- We use this information only to provide those features to that business.
- We do not sell it, use it for advertising, or share it with anyone else.
- Disconnecting the account in LuSaaS, or removing LuSaaS under Facebook Settings → Business integrations, stops all further access. We then delete the stored token and the data we received from Facebook within 30 days.
4. How we use information
- to provide, secure and support the service;
- to send account emails, such as sign-in confirmations, invitations, password resets and notices about your workspace;
- to answer you when you contact us;
- to meet legal obligations, such as proving consent for marketing email.
We do not sell personal information, and we do not use it to show you ads.
5. Cookies
We do not use advertising or tracking cookies. When you sign in, the app keeps a sign-in token in your browser's local storage so you stay signed in. Our website and app serve their own fonts, so no font service sees your visit.
6. Who we share it with
We use a small number of service providers to run LuSaaS, and they handle information only on our instructions:
- hosting providers, for the servers the service runs on;
- cloud storage providers, for backup copies;
- email providers, to send and receive email;
- a web font service, for the fonts on our website.
A current list of these providers is available on request.
These providers may store or process information in countries other than the one you live in, including the United States, Canada and countries in Europe, where it may be subject to local laws. We may also disclose information if the law requires it.
7. How long we keep it
We keep account and workspace information while the account is open. When a workspace is closed, we delete its information within 30 days, and backup copies are overwritten on a rolling basis after that. Consent and unsubscribe records are kept as long as the law requires us to be able to prove consent.
8. How we protect it
Connections are encrypted (HTTPS). Passwords are hashed, two-factor sign-in is available and required for administrators, each business's data is kept separate from every other business's, and changes are logged. No system is perfectly secure; if a breach puts you at risk, we will tell you and the authorities as the law requires.
9. Your choices and rights
You can ask to see the personal information we hold about you, correct it, have it deleted, or withdraw your consent. Every marketing email sent through LuSaaS has an unsubscribe link. Email contact@lusaas.com and we will answer within 30 days.
10. Deleting your data
To delete your account and its data, or data we received from Facebook or Instagram, email contact@lusaas.com with the subject "Delete my data" from the email address on your account. We will confirm when it is done, within 30 days.
11. Children
LuSaaS is a business tool and is not directed to children under 16. We do not knowingly collect their information.
12. Changes to this policy
If we change this policy, we will update the date at the top, and tell account holders by email before a significant change takes effect.
13. Contact and complaints
Questions or requests: contact@lusaas.com. Our postal mailing address is available on request. If you are not satisfied with our answer, you can complain to the data-protection or privacy authority where you live.