L3 Privacy Notice

Who handles your information

Duke Business Advisors, Inc., doing business as Lucensys Group, provides this engagement and is responsible for the Lucensys handling described here. Contact steve@lucensys.io with privacy questions. This notice supplements the general Lucensys privacy policy at https://lucensys.io/privacy

Information and purposes

We use your authorized representative's name, email, business name, billing address, engagement reference, accepted schedule and payment status to identify and administer the engagement, record agreement, reconcile payments and handle support. The advisory record can include assessment answers, owner-option brief, selected financial and operating records, authorized staff interview notes, bounded continuity-walkthrough observations, Technology & Data findings, report versions, plan, workshop and debrief records. We use these records to save and interpret answers, review evidence, prepare and review reports, clarify facts, plan agreed meetings and actions, handle corrections or refunds, and maintain business and security records. Provide only records you are authorized to share and that matter to the agreed scope. Remove unrelated personal information where practicable. Do not provide passwords, account credentials, payment-card details or unnecessary sensitive data. Staff contact requires the owner's express authorization and notice to participants.

Payments and service providers

Stripe processes payment information on its hosted payment page. Enter card details there; do not send them to Lucensys. The billing integration sends identity and billing details, fee amounts and minimal engagement identifiers, not assessment answers, raw advisory records, report narrative or private advisor notes. Stripe's own handling is explained at https://stripe.com/privacy Vercel hosts the private application. Supabase stores assessment responses, saved drafts, engagement records, report versions and internal review records and supports authentication. These providers also process technical records for their services. When you acknowledge assessment-completion email delivery, Resend processes your email and the completion message and attachments to send your answers/completion information to you and a separate copy to steve@lucensys.io. These can contain business-sensitive information. Completion emails are separate from the later advisor-reviewed report. Agreed correspondence, report exports and supporting records may also be handled through the private communication and document-storage services identified for your engagement. Do not put confidential assessment answers in Stripe invoice descriptions or payment correspondence.

AI assistance and advisor responsibility

AI assistance may be proposed for organizing or drafting advisory material. Before identifiable or confidential client information is provided to an additional AI service, we identify that service and the information involved and agree the handling with you. Without that agreement, the engagement does not authorize such sharing. An advisor remains responsible for reviewing the report and its evidence. No claim of anonymous processing, zero retention or exclusion from a provider's model training is made unless that provider's applicable arrangements support it. Payment does not authorize unrelated AI use or public disclosure.

Access, communications and report controls

Authorized advisors can review your assessment and internal notes. The client report view excludes private advisor notes and other clients' information. Private invitations, resume files and report links can provide access; keep them private and contact Lucensys if they are shared unintentionally. Access cookies and technical records support private access and protect the service. Payment cannot change scores, approve or release a report, or open report access. Approval, payment readiness and report release require separate actions. A released report is a copy of the approved version; a later draft does not silently replace it. Service messages may cover payment, invitations, clarification, private delivery, corrections and meeting arrangements. Buying or completing this engagement does not subscribe you to marketing.

Retention, security and requests

We retain information as needed for the engagement, legitimate business and payment records, disputes and applicable obligations. No automatic deletion deadline is promised. Contact steve@lucensys.io to request access, correction or deletion where applicable, or to discuss which records still need to be kept. Some records may need to remain for business or legal reasons; provider backups and records may follow their own retention arrangements. Corrections to reports are documented without silently rewriting original assessment answers or scores. We use safeguards for the information we handle; no system or transmission can be guaranteed completely secure. The general website privacy policy explains optional website analytics. This notice does not authorize public disclosure of your records.

Effective October 31, 2026. Version L23-2026-10-31.