Effective date: 10 July 2026
This policy explains what personal information Lucid collects, why Lucid collects it, who receives it, and how you exercise your rights. It is written to comply with the Privacy Act 2020 (New Zealand) and its Information Privacy Principles (the "IPPs"). Defined terms keep their meaning throughout.
1.1 Lucid Education ("Lucid") is operated by Patrick Gaines (referred to in this policy as "Lucid", "we", "us", and "our"). Lucid is the agency responsible for your personal information under the Privacy Act 2020.
1.2 Our Privacy Officer is Patrick Gaines. The Privacy Officer handles access requests, correction requests, complaints, and breach response. Contact the Privacy Officer at privacy@edapt.net.nz.
2.1 We collect personal information for one lawful purpose: to provide the Lucid study companion to the students in your account. Each category below connects to that purpose (IPPs 1 to 4).
2.2 We collect the following categories of information.
| Category | What it is | Why we collect it |
|---|---|---|
| Account email | The account holder's email address | To create and secure the account, and to send transactional email |
| Password | Stored as a hash only, never in plaintext | To authenticate the account holder |
| Student display name and year level | The name and curriculum year the account holder enters for each student | To address the student and match tutoring to the curriculum level |
| Session and turn text | The messages a student and the tutor exchange | To generate the tutor's replies and continue each session |
| Drafts | Written work a student develops inside Lucid | To give feedback on the student's own work |
| Derived progress | Mastery and progress measures computed from sessions | To show progress on the dashboard and adapt the tutoring |
| Billing information | Subscription status and payment records held by Stripe | To charge for the service |
2.3 We collect information from you and from the students you add. We collect nothing about a student beyond what the account holder enters and what the student types into Lucid.
2.4 We do not sell personal information. We do not use student learning content for advertising.
3.1 Lucid's tutor runs on an artificial-intelligence service provided by Anthropic, located in the United States. To generate each reply, Lucid sends the content of the session — the messages typed by the student and the tutor's prior turns — to Anthropic's servers in the United States. A student may type personal information into a message; if so, that information reaches Anthropic.
3.2 United States law may not protect this information in a way comparable to the Privacy Act 2020. Under IPP 12, we rely on your informed authorisation for this transfer. You give that authorisation at signup, after reading this disclosure, by agreeing to the following statement:
"Messages typed into Lucid may contain personal information. Lucid sends message content to Anthropic in the United States to generate the tutor's replies. United States law may not protect this information in a way comparable to New Zealand's Privacy Act 2020. I authorise this transfer, for myself and for each student I add to my account."
3.3 Anthropic processes this content under a data-processing agreement with Lucid. Anthropic does not train its models on Lucid's content sent through its API.
3.4 If you do not authorise this transfer, you cannot use Lucid, because every tutoring reply depends on it.
4.1 Four external providers process information on our behalf. Only Anthropic receives student learning content.
| Provider | Role | Location | What it receives |
|---|---|---|---|
| Anthropic | AI tutor | United States | Session and turn text, and drafts sent for feedback |
| Stripe | Billing | Global (per Stripe's terms) | Account holder billing details and payment records |
| Resend | Transactional email | Per Resend's terms | Account holder email address and message content of system emails |
| Sentry | Error tracking | United States | Technical error reports, scrubbed of student content before they leave our systems |
4.2 Each provider is bound by a data-processing agreement. We keep this list current; the list in this policy is the complete list of external recipients.
5.1 A student never signs up for Lucid directly. An adult account holder — a parent, or a teacher or administrator acting for a school — creates the account, accepts the Terms of Service, and adds each student. Consent for a student's information flows through that adult.
5.2 The account holder must be at least 18 years of age.
5.3 Where a school adds students, the school warrants under the Terms of Service that it holds the consent needed to enrol each student and to permit the transfer described in clause 3.
6.1 We keep personal information only while it is needed to run your account (IPP 9).
6.2 The account holder may delete a student's data, or the whole account, at any time. Deletion takes effect through the tools in the account dashboard or by request to the Privacy Officer.
6.3 When an account closes, we delete the personal information in it 30 days after closure. The 30-day window exists so an accidental closure can be reversed. After that window, deletion is permanent.
6.4 Records we must keep by law — for example, billing records required for tax purposes — are kept for the statutory period and no longer.
7.1 You may ask for the personal information Lucid holds about you or about a student in your account (IPP 6). You may ask us to correct it (IPP 7).
7.2 The dashboard already shows the account holder each student's progress and content, and lets the account holder delete a student's data.
7.3 For a formal access or correction request, write to the Privacy Officer at privacy@edapt.net.nz. We respond within 20 working days, as the Privacy Act requires. If we decline a correction, you may ask us to attach a statement of the correction sought.
8.1 We take reasonable safeguards against loss, misuse, and unauthorised access (IPP 5):
9.1 If a privacy breach creates a risk of serious harm, we notify the Office of the Privacy Commissioner and the affected people without undue delay, as Part 6 of the Privacy Act 2020 requires.
9.2 If you have a privacy concern, raise it first with our Privacy Officer at privacy@edapt.net.nz. If you are not satisfied with our response, you may complain to the Office of the Privacy Commissioner: www.privacy.org.nz, PO Box 10094, Wellington 6143.
10.1 If we change this policy, we publish the new version at this address and update the effective date. For a material change — one that alters what we collect, who receives it, or the transfer described in clause 3 — we notify account holders by email before the change takes effect.
10.2 This policy was last updated on 10 July 2026.
Questions about this policy go to the Privacy Officer at privacy@edapt.net.nz.