Terms, privacy and data processing

Effective date: September 3, 2026. These documents govern the use of the Lutecia service, the Lutecia plugin for WooCommerce and lutecia.app.

Part I. Terms of service

1. Who we are

Lutecia is operated from France. Write to contact@lutecia.app for any matter covered by these documents. The service is hosted by Railway Corporation (railway.com). We may transfer this agreement to a company formed to operate Lutecia; any change of operator is announced on this page.

2. Scope and acceptance

This agreement is between you, the merchant who connects a store, and the operator of Lutecia. It covers the Lutecia plugin for WooCommerce, the service at api.lutecia.app and this website. You accept it when you connect a store. The service is for business use, and you must be entitled to administer the store you connect.

3. The service

Lutecia reads your product catalog, keeps a normalized copy, and makes it available to AI shopping channels in two ways: a live connection, where an assistant queries your catalog while it is answering a shopper, and catalog files in the format a given channel requires. Where you enable it, assistants can also create orders in your store.

4. Access to your store

4.1. When you click Connect, the plugin creates a WooCommerce REST API key with read permission and transmits it to us. WooCommerce keys cannot be restricted to the catalog alone, so a read key grants access beyond what we use. We call only the product, variant, category and shipping endpoints. We do not access your customer records, and the only orders we read are those created through Lutecia. We do not modify your products, your settings or your orders.

4.2. If you enable order creation by assistants, the plugin raises that key to read and write permission, because creating an order in WooCommerce requires write access. We use it for that purpose only. Orders created this way arrive on hold and are paid on your site, with your own payment methods. When you disable the option, the plugin returns the key to read permission.

4.3. The key remains visible and revocable at any time in your store, under WooCommerce, Settings, Advanced, REST API. Revoking it ends our access immediately.

5. What you authorize

By connecting, you authorize us:

5.1. to read your catalog, convert it, store a normalized copy, and transmit your product data to the channels you enable;
5.2. to answer assistants on your behalf, in real time, with that product data;
5.3. to publish through the plugin, at /.well-known/ucpon your domain, a small public discovery file, defined by the Universal Commerce Protocol, that tells assistants where to query your catalog;
5.4. to add an attribution parameter to the product links we serve to assistants and, where you turn on sales attribution in the plugin, to receive the sale details described in Part II, section 7;
5.5. where you enable order creation, to create orders in your store as described in section 4.

6. Your responsibilities

6.1. You remain the seller. Your prices, stock, product descriptions, delivery, returns, taxes, consumer information and legal pages are yours, and you keep them accurate and lawful. You must not connect a store selling goods you are not allowed to sell.

6.2. You hold the rights to the catalog data you connect. If a third party brings a claim against us because of that data, you will defend us against it and cover what we are ordered to pay.

6.3. If you enable order creation, you confirm that your own privacy notice covers the disclosure of buyer data to us and to the channels you enable, and that you have a lawful basis for it. If you turn on sales attribution, you must disclose its cookie (Part II, section 7) in your own privacy or cookie notice and collect consent where your law requires it.

7. Channels

Admission to any consumer channel (ChatGPT, Google, Microsoft, Perplexity and others) is decided by that channel, not by Lutecia. You apply yourself, you hold your own accounts, and you accept their terms directly. Channels change their programs and formats without notice to us, and we may change or withdraw an integration in response.

8. Fees

The service is free of charge as at the effective date above. We take no payment from you and no share of your buyers' payments. Any future price will be announced at least 30 days in advance, will not apply retroactively, and you may disconnect before it takes effect.

9. Availability and changes to the service

The service is provided without a service level commitment. We may change, add or withdraw features, and we may interrupt the service for maintenance.

10. Intellectual property

Your catalog and your data remain yours; you grant us only the rights needed to operate the service for you. The Lutecia service, its interfaces and its name remain ours. The WooCommerce plugin is distributed under the GPLv2 or later, and nothing in this agreement restricts the rights that licence grants you over the plugin itself.

11. Suspension and termination

11.1. You may disconnect at any time from the plugin dashboard: the API key is revoked on your store and your catalog stops being served to assistants.

11.2. Catalog files already delivered to a channel before you disconnect are held by that channel under its own terms with you. We stop sending updates and, on your request, ask the channel to remove your catalog.

11.3. We may suspend a store that is unlawful, that abuses the service or that threatens its security, and we give the reason on request. Either party may terminate this agreement at any time.

12. Warranties and liability

12.1. The service is provided as is, without warranty of any kind. We do not warrant that a channel will accept you, that an assistant will show your products, or that the service will be uninterrupted or error free.

12.2. To the extent permitted by law, our total liability arising from the service is limited to the greater of the amount you paid us in the twelve months preceding the claim and one thousand euros, and we are not liable for indirect or consequential loss, including lost sales or lost profits.

12.3. Nothing in this agreement excludes or limits liability that cannot be excluded or limited by law, including liability for fraud, for gross negligence, and for breach of an essential obligation of this agreement.

12.4. If any provision of these documents is held unenforceable, the rest continues to apply.

13. Changes to these terms

We may update these terms. Changes are announced on this page with a new effective date and listed in the revision history below. Material changes are also sent to your administrator email address at least 30 days before they take effect. Continuing to use the service after a change constitutes acceptance of it.

14. Governing law and jurisdiction

This agreement is governed by French law, and the French courts have jurisdiction over any dispute.

Part II. Privacy policy

1. Scope and roles

1.1. This policy covers the Lutecia service and this website.

1.2. For your merchant account, your catalog and the operation and security of the service, we determine the purposes and means of the processing and we act as controller.

1.3. For the buyer details that reach us when you enable order creation, we act only on your instructions and we are your processor. We use that data only as far as transmitting it to your store requires. The terms of that role are in Part III.

2. Merchant data

2.1. When you connect, we receive and store your store URL, your store name, the language and currency of your store, the plugin and WooCommerce versions, the URLs of your store's privacy policy and terms pages, your store's administrator email address, and the WooCommerce API key created by the plugin. The plugin and WooCommerce versions let us support your installation; the policy URLs are shown to buyers by channels that require them.

2.2. We generate a shared secret used to sign messages between your store and the service. The key, the secret and any credentials a channel requires you to hand to us are stored encrypted.

2.3. We use the administrator email address to write to you about the service: a security notice, a change to these terms, or the end of the free period. We do not sell this data, use it for advertising, or send marketing to that address.

2.4. Legal basis: performance of this agreement.

3. Catalog data

3.1. We store a normalized copy of your products: titles, descriptions, prices, stock, images, categories, identifiers and shipping data. The raw responses from your store are discarded once converted; only the normalized copy is kept.

3.2. A catalog can contain personal data, for example the name of a maker in a description or a person in a photograph. Where it does, that data is processed as part of the catalog and sent to the channels you enable. You decide what your catalog contains and you are responsible for having a basis to publish it.

3.3. Legal basis: performance of this agreement.

4. Buyer data, where order creation is enabled

4.1. Where order creation is disabled, the service refuses checkout requests and stores no buyer data. A cart prepared by an assistant holds items only; if buyer details are sent with one, they are discarded on receipt and never written to our database.

4.2. Where you enable it, an assistant preparing a purchase sends us what an order requires: the buyer's name, email address, phone number where given, shipping address, the shipping method chosen, the items and the totals, and the marketing consent choices the buyer makes. We hold these in a checkout session and transmit them to your store to create the order.

4.3. Payment card data is not sent to Lutecia: at the effective date, the buyer pays on your site, with your payment methods.

4.4. The session remains in our database after the order is created. Retention is set out in section 10.

5. Order lookups by assistants

An assistant can read the state of an order it created, which includes the buyer's address. That request must be signed by the assistant, and we verify the signature before answering. Requests for product data are not signed; they return no personal data.

6. Assistant activity logs

6.1. When an assistant queries a catalog, we record the query: the operation called, the parameters of the query, a truncated extract of the answer returned, the store concerned, and the time. We use these records to operate the service, to limit abuse, and to report to you the requests received for your catalog. They are deleted after 30 days.

6.2. Caller IP addresses are held in memory to apply rate limits and are not written to our database. Our hosting provider keeps its own technical logs, which we consult only to investigate an incident or abuse.

6.3. Legal basis: our legitimate interest in operating and securing the service.

7. Attribution parameter and storefront cookie

7.1. The product links we serve to assistants carry a parameter of the form ?ref=lutecia_..., which identifies your store and the product, and nothing else.

7.2. Sales attribution is a setting of the plugin, off by default. While it is on, the plugin stores that parameter in a first-party cookie named lutecia_ref on your domain, for 30 days, when a shopper arrives on your store carrying it. The cookie holds that parameter and nothing else, and cannot be read by scripts. At checkout its value is copied onto the order.

7.3. When the order is paid, your store sends us the order number, the order total, the currency and that parameter, so that we can report which sales came from assistants. That message carries no buyer name, email address or postal address.

7.4. Attribution runs only while you keep the setting on: turning it off, or disconnecting, stops the cookie and the reports, and a cookie already set is expired on the shopper's next visit. The cookie is set on your site and is not strictly necessary to operate it, so where the law applicable to your shoppers requires consent for non-essential cookies, including the European Union and the United Kingdom, you must disclose it and collect consent through your own cookie notice.

7.5. Legal basis: performance of this agreement.

8. This website

lutecia.app sets no cookies, runs no analytics and embeds no third party scripts.

The "Request a demo" form sends the details you type (first name, last name, work email, company, job title) to our server. We store them and use them only to reply to you; they are not passed to anyone other than the hosting provider in section 9. We delete them once the conversation is over and in any case within 12 months, or earlier if you ask by writing to contact@lutecia.app.

9. Hosting, backups and other recipients

9.1. The service and its database run on infrastructure provided by Railway Corporation. Our servers are in the European Union at the effective date above. We may run them in another region; where personal data is processed outside the European Economic Area, we rely on the safeguards the GDPR requires for such transfers, including standard contractual clauses with the provider concerned, and we update this page.

9.2. A backup copy of the database is taken daily. One copy is kept on the service infrastructure for 14 days, and one encrypted copy per day is kept for 30 days with GitHub, Inc. Backups are encrypted before they leave that infrastructure, with a key we hold, so that the storage provider cannot read them.

9.3. Apart from those providers, the only third parties that receive data are the channels you enable. They receive product data, and, where order creation is enabled, the state of an order they created, including the buyer's address, in answer to a signed request.

10. Retention

10.1. Your account, credentials and catalog are kept while your store is connected. When you disconnect, we deactivate the account and stop processing your catalog; the records remain in our database until you ask us to delete them, which we do within 30 days of the request.

10.2. Checkout and cart sessions that were abandoned, cancelled or left to expire are deleted after 30 days.

10.3. A session that produced an order is kept as the record of that sale. Its buyer details are erased automatically 12 months after the order: the name, email address, phone number and postal address are removed, while the items, the amounts and the order reference remain. You may ask us to erase them sooner. The attributed sale records described in section 7 hold no buyer details at any point.

10.4. Assistant activity logs are kept for 30 days.

11. Security

11.1. Traffic runs over TLS. Credentials and channel secrets are encrypted at rest with AES-256-GCM, under a key held outside the database. Messages sent by your store to the service carry an HMAC-SHA256 signature, which we verify before acting on them. Administrative access is restricted to what operating the service requires, and requests are rate limited.

11.2. If a breach affects your data, we inform you without undue delay and tell you what we know of its nature, its consequences and our response.

12. Your rights

Under the GDPR and comparable laws you may request access to your data, its correction, its deletion, a copy of it, or restriction of its processing, at contact@lutecia.app. You may also lodge a complaint with a supervisory authority, in France the CNIL. If a buyer sends us a request concerning an order, we forward it to you and assist you, as that data is yours.

13. California and comparable US state laws

13.1. Where the California Consumer Privacy Act or a comparable state law applies to you, we act as your service provider. We process buyer personal information only to perform the service for you, under our direct business relationship with you.

13.2. We do not sell it, we do not share it for cross-context behavioural advertising, we do not combine it with data from other sources for our own purposes, and we do not retain, use or disclose it for any other purpose.

13.3. We give it the level of protection the Act requires. You may take reasonable steps to verify that we do, and to stop and remediate any unauthorized use. We will tell you if we determine we can no longer meet these obligations.

Part III. Data processing terms

1. Scope

These terms apply where we process personal data on your behalf, which at the effective date above means the buyer details received when you enable order creation by assistants. They form the agreement required by article 28 of the GDPR between you as controller and us as processor.

2. Subject matter, duration, nature and purpose

We receive buyer details from an AI assistant, hold them in a checkout session, and transmit them to your store to create an order. The processing lasts for as long as you keep order creation enabled, and then for the retention periods set out in Part II, section 10. The categories of data subjects are the shoppers who purchase through an assistant. The categories of personal data are name, email address, phone number where given, shipping address, order contents and totals, and marketing consent choices.

3. Our obligations

3.1. We process this data only on your documented instructions, which these terms and your use of the service constitute, unless the law requires otherwise, in which case we inform you first unless that law forbids it. If we consider an instruction infringes data protection law, we tell you before acting on it.

3.2. Anyone with access to the data is bound by an obligation of confidentiality, and we maintain the measures described in Part II, section 11.

3.3. We assist you, taking into account the nature of the processing, in answering requests from data subjects, in notifying breaches, and in any assessment you must carry out. We notify you without undue delay after becoming aware of a personal data breach affecting this data.

3.4. On request we make available the information needed to demonstrate compliance with this Part and allow an audit, by answering a reasonable questionnaire or, at your cost, an inspection agreed in advance.

4. Sub-processors

4.1. You give a general authorization for the following sub-processors: Railway Corporation, hosting and database; and GitHub, Inc., storage of encrypted backup copies.

4.2. We bind each sub-processor by contract to data protection obligations equivalent to those in this Part, and we remain liable to you for their performance.

4.3. We announce any new sub-processor on this page at least 15 days before it begins processing, and you may object during that period by disconnecting.

4.4. The channels you enable are not our sub-processors: they receive data as independent controllers, under their own terms with you.

5. International transfers

Personal data may be processed inside or outside the European Economic Area, as described in Part II, section 9. Where a transfer leaves that area, we rely on the safeguards the GDPR requires, including standard contractual clauses with the provider concerned. Backup copies are encrypted before they leave the service infrastructure.

6. End of processing

When you disconnect, we stop processing buyer data for you. It is then retained as set out in Part II, section 10, and deleted within 30 days of your request, subject to the record of completed transactions and to what the law requires us to keep. Before we delete it you may ask us to return it in a machine-readable format.

Revision history

September 3, 2026. Sales attribution described as an opt-in setting of the plugin, off by default (Part I, 5.4 and 6.3; Part II, section 7).

September 1, 2026. First published version.