Privacy Policy

LuuLn ("LuuLn," "we," "us," or "our") operates https://luuln.com and provides done-for-you social media content services to healthcare businesses. This Privacy Policy explains what information we collect, how we use it, who we share it with, and what choices you have.

LuuLn is operated by Tyler Kai Aguilera, a sole proprietor located in Orange County, California.

Questions: tyler@luuln.com

1. THE SHORT VERSION

• We collect information from the businesses that hire us, and basic technical data from people who visit our website.
• We do not collect, request, or accept patient health information. Our service produces general health education and business-marketing content, not patient-specific content.
• We use third-party AI and publishing tools to deliver the service. Those tools are listed in Section 5.
• We do not sell your personal information.
• You can request deletion of your data at any time. See our Data Deletion Policy.

2. INFORMATION WE COLLECT

2.1 Information You Provide

Client account information. When a client engages us, we collect the business name, the names and job titles of contacts, business email addresses, business phone numbers, business mailing address, and professional credentials or specialty information.

Onboarding and brand voice materials. To produce content in your voice, we collect materials you provide, such as business descriptions, service offerings, positioning notes, tone preferences, writing samples, existing marketing materials, photographs of you and your office, and — where video services are included — voice and likeness recordings.

Messaging data. Our approval workflow operates through a third-party messaging platform (currently Telegram). We collect the messages you send us through it, including approvals, revisions, feedback, and any files you attach, along with the account identifier associated with your messaging account.

Payment information. Payments are processed by Stripe. We do not collect or store full payment card numbers. We receive limited transaction information such as the last four digits, card brand, billing name, and payment status.

Agreement and signature records. When you sign our agreements online, we record your typed name and title, the business details you enter, the version of each document, the date and time, your IP address, and your browser's user agent. We keep these as evidence of the agreement.

Communications. Emails, website inquiries, support requests, and other correspondence you send us.

2.2 Information We Collect Automatically

Website data. When you visit our website we collect IP address, browser type and version, device type, operating system, referring page, pages viewed, and timestamps. This is collected through standard server logs and through the privacy-friendly website analytics described in Section 8.

Cookies. See Section 8.

Service usage data. For active clients, we log operational data about the service: content items generated, approval and revision activity, publishing timestamps, error and system logs, and processing volume used for billing.

2.3 Information From Third Parties

Social media platform data. When you authorize us to publish on your behalf, we receive access tokens and limited account information from the connected platforms (for example, account name, account ID, page or profile identifiers, and — where you enable it — post performance metrics). We receive this through our publishing tool and through platform authorization flows. We do not receive your social media passwords.

3. INFORMATION WE DO NOT COLLECT

Protected Health Information. We do not collect, request, require, or knowingly accept Protected Health Information ("PHI") as defined under HIPAA, or any individually identifiable patient information.

Our client agreements expressly prohibit clients from submitting patient-identifying information through our service. We are not a HIPAA business associate and do not act in that capacity.

If patient-identifying information is submitted to us inadvertently, we delete it from active systems upon becoming aware, exclude it from any long-term or persistent memory used for content generation, and notify the client.

We also do not knowingly collect information from children under 18. Our services are directed to healthcare businesses, not to consumers or minors.

4. HOW WE USE INFORMATION

We use the information described above to:

• Provide the services, including generating, delivering, and publishing content;
• Build and refine the brand voice configuration used to produce content for you;
• Operate the approval workflow and communicate with you about content;
• Bill you and process payments;
• Provide support and respond to your requests;
• Monitor, secure, debug, and improve our systems;
• Understand website traffic and improve our website;
• Comply with legal obligations and enforce our agreements.

Legal bases (where applicable). Where required by law, we rely on: performance of a contract (delivering the services), legitimate interests (securing and improving our systems, marketing to businesses), consent (where you have given it, such as for optional cookies), and legal obligation.

5. AI PROCESSING AND SERVICE PROVIDERS

Delivering our service requires sending your information to third-party providers. We share only what is necessary for each provider's function.

5.1 AI and Content Generation

On AI training. We use these providers through their business or API offerings. We do not authorize the use of your information to train third-party models, and we select providers whose business terms do not use API inputs for model training by default. We cannot, however, control a provider's independent changes to its own terms, and we will update this Policy if a material change occurs.

5.2 Publishing and Infrastructure

5.3 Other Disclosures

We may also disclose information:

• To professional advisors (accountants, attorneys) under confidentiality obligations;
• In a business transfer — if LuuLn is acquired, reorganized, or converted into another entity (including a limited liability company), information may transfer as part of that transaction, subject to this Policy;
• For legal reasons — to comply with law, respond to lawful requests, enforce our agreements, or protect the rights, safety, and property of LuuLn, our clients, or others.

5.4 We Do Not Sell Your Information

We do not sell personal information, and we do not share personal information for cross-context behavioral advertising, as those terms are defined under California law.

6. DATA RETENTION

We keep information only as long as needed for the purposes described in this Policy.

Retention periods for billing and legal records may exceed a deletion request where we are required by law to retain them. See our Data Deletion Policy for details.

7. DATA SECURITY

We use reasonable administrative and technical safeguards to protect information, including encrypted connections (TLS), access controls, credential management through environment variables rather than source code, and hosting with providers that maintain their own security programs.

No system is perfectly secure. We cannot guarantee absolute security, and you share information with us at your own risk. If we become aware of a breach affecting your personal information, we will notify you as required by applicable law.

8. COOKIES AND TRACKING

Our website uses cookies and similar technologies for:

• Essential functions — authentication, session management, security. These cannot be disabled.
• Website analytics — we use Vercel Web Analytics to count visits and see which pages are viewed and where visitors came from. It does not set cookies, does not track you across other websites, and does not build a profile of you. It records the page visited (without any query string), the referring site, and general device, browser, and country information, and we see the results only as totals.

We do not use advertising cookies or advertising trackers. If that changes, we will update this Policy first.

You can control cookies through your browser settings. Disabling essential cookies may prevent parts of the site from working.

We honor Global Privacy Control (GPC) signals where required by law.

9. YOUR PRIVACY RIGHTS

9.1 California Residents (CCPA / CPRA)

If you are a California resident, you have the right to:

• Know what personal information we collect, use, and disclose;
• Access a copy of the personal information we hold about you;
• Correct inaccurate personal information;
• Delete your personal information, subject to legal exceptions;
• Opt out of sale or sharing — we do not sell or share, so there is nothing to opt out of;
• Limit the use of sensitive personal information — we do not use personal information for purposes requiring this right;
• Non-discrimination — we will not treat you differently for exercising these rights.

To exercise these rights, email tyler@luuln.com with the subject line "Privacy Request." We will verify your identity before responding, typically by confirming information already in our records. We respond within 45 days, and may extend once by an additional 45 days with notice.

You may use an authorized agent, who must provide written proof of authorization.

9.2 Other Jurisdictions

If you are located outside California, you may have similar rights under your local law. Contact us at tyler@luuln.com and we will honor applicable requests.

9.3 Clients

If you are a client, the fastest route for most requests is to contact us directly. Deletion is handled under our Data Deletion Policy.

10. INTERNATIONAL USERS

LuuLn operates in the United States and our providers process data in the United States and other countries. If you access our services from outside the United States, you understand your information will be transferred to and processed in the United States, where privacy laws may differ from those in your jurisdiction.

Our services are intended for United States healthcare businesses. We do not market to individuals in the European Economic Area or the United Kingdom.

11. THIRD-PARTY LINKS

Our website and content may link to third-party sites and social media platforms. We are not responsible for their privacy practices. Review their policies before providing information.

12. CHANGES TO THIS POLICY

We may update this Policy. When we do, we will revise the "Last Updated" date above. For material changes affecting active clients, we will provide notice by email at least 30 days before the change takes effect. Continued use after the effective date constitutes acceptance.

13. CONTACT

LuuLn Tyler Kai Aguilera, sole proprietor Irvine, California tyler@luuln.com

For privacy requests, use the subject line "Privacy Request."