LuHoCh AI

1. Who we are

LuHoCh AI is operated by LUHOCH SOFTWARE DEVELOPMENT SERVICES, Hyderabad, Telangana, India ("LuHoCh", "we", "us", or "our"). For applicable Indian data-protection law, we act as the Data Fiduciary for personal data processed through the service.

2. Information we process

  • Account information: name, email address, authentication records, account status, preferences, locale, and timezone.
  • Connected-account information: provider and account identifiers, authorization credentials, connection status, and the email or calendar content and metadata required for features you choose to use.
  • Assistant information: instructions, rules, schedules, summaries, reminders, confirmations, and conversation state.
  • Channel information: WhatsApp, Slack or enabled Teams identifiers, messages and interactions sent to the assistant, webhook metadata, and message-delivery status.
  • Optional voice commands: when the voice pilot is enabled and you send a recording, the audio and its transcript or translated request are processed to understand your command.
  • Service and security information: request, diagnostic, audit, abuse-prevention, and security-event records needed to operate and protect the service.
  • Subscription information: plan, entitlement, usage, billing-customer, and transaction references when paid features are enabled. Payment providers process full payment-card details; LuHoCh does not need to store them.

Please do not send passwords, access tokens, payment-card numbers, or other unnecessary sensitive information in assistant messages.

Does LuHoCh read email bodies?

Yes. For connected Gmail, Outlook and Yahoo accounts, LuHoCh retrieves email bodies and metadata to provide the features you use. Digest processing checks batches of unread messages, applies rules and exclusions, and analyzes eligible important messages. This is automated processing; it is not a complete historical mailbox index.

Plain text is preferred; HTML messages are converted to readable text. Digest analysis uses up to 4,000 characters of cleaned body text by default, with a configurable maximum of 12,000. The current limit is shown in Settings → Privacy & data. This limits AI input, not the amount fetched from your provider. Quoted replies, signatures and text beyond the limit may be omitted. A preview is used when readable body text is unavailable. Check the original email before relying on a summary or extracted deadline.

3. Why we process information

We process information to:

  • create and secure your account;
  • connect the email, calendar, and communication services you select;
  • classify email, prepare summaries and agendas, manage rules and schedules, and perform actions you request or confirm;
  • send requested notifications through enabled channels;
  • provide support, prevent misuse, troubleshoot failures, and improve reliability;
  • administer subscriptions when billing is enabled; and
  • meet legal, regulatory, and security obligations.

Processing is based on your consent and requests, performance of the service you ask us to provide, and other uses permitted by applicable law. You may withdraw consent, but this can prevent affected features from working.

4. Service providers and connected platforms

We disclose only the information reasonably required to providers that help deliver the service. Depending on the features you enable, these may include hosting and infrastructure providers; Google services, including Gemini; Google, Microsoft, or Yahoo account services; Meta WhatsApp; Slack; Microsoft Teams; email-delivery providers; and Stripe when billing is enabled. Connected platforms process information under their own terms and privacy policies.

Private Teams delivery

Where Teams delivery is enabled, LuHoCh processes a connection code and Microsoft organization, user and private-chat identifiers to link your accounts. Connection codes are stored as hashes, and private delivery references are encrypted. Notifications are sent to Microsoft only after you connect and choose Teams for delivery, or explicitly request a test notification. Microsoft and your organization control retention of delivered messages. Disconnecting Teams stops future delivery but does not delete messages already in Teams. Teams supports private notifications and connection codes. Use the web workspace for commands and actions.

AI processing details

For the optional voice-command pilot, LuHoCh retrieves the recording from your linked WhatsApp or private Slack conversation and sends the audio to Google Gemini for transcription and interpretation. Audio is sent as recorded; text redaction cannot remove sensitive spoken details before transcription. LuHoCh processes the bounded recording in memory rather than saving an audio file or uploading it to the Gemini Files API. Transcripts returned in chat and resulting assistant requests follow the applicable conversation and connected-platform retention rules. This processing is separate from the email-text minimization below.

LuHoCh uses the paid Google Gemini API as an AI processor for email classification, concise summaries, action extraction, and requested reply suggestions. Before a request is sent, LuHoCh omits the connected-account identity, minimizes the sender to a display label and domain, redacts detected credentials and sensitive identifiers, caps the text length, and excludes attachment names, provider identifiers, download links, and raw files. If optional attachment understanding is enabled, LuHoCh may send a redacted, length-limited excerpt from supported text, CSV, JSON, XML, Markdown, or HTML attachments as explicitly marked untrusted input. Inline, unsupported, unknown-size, and oversized files are skipped. Attachment bytes and extracted text are not stored by LuHoCh after analysis.

Redaction detects known patterns and can miss private details; the remaining text is still email content sent to Google. Requested reply suggestions can use retained summaries and your instructions. An email excluded from AI analysis may already have been retrieved from its provider.

Gemini returns structured classifications or bounded draft text. LuHoCh does not use search or maps grounding, file uploads, model tuning, shared datasets, or stateful Gemini interactions for this processing. Production configuration must use paid-service terms under which customer prompts and responses are not used to improve Google's products. Google may retain limited data for abuse monitoring unless zero-data-retention approval is active. LuHoCh-generated records remain subject to the retention and deletion controls described below.

AI processing, model training and provider retention are separate uses. The AI data terms shown in Settings reflect the environment's configuration; a setting alone does not establish approval for a Google project. See Google's Gemini API terms and abuse-monitoring policy for provider retention and review practices.

We may also disclose information when required by law, to protect users or the service, or as part of a business reorganisation subject to appropriate confidentiality and legal safeguards. We do not sell personal data.

5. International processing

Some connected platforms and service providers may process information outside India. Where this occurs, we use contractual, security, and other safeguards appropriate to the processing and follow applicable Indian restrictions on cross-border transfers.

6. Retention

Saved processed-email content and digest history each have a default retention period of 30 days. Settings shows the periods configured for this environment. Cleanup runs when email processing starts: expired digests are deleted and sender, subject and summary content in older processing records is cleared. Cleanup can be delayed if email processing stops; this is not a guarantee of deletion at an exact time.

Limited processing identifiers and status records remain to prevent duplicate processing. Security activity, pending drafts, reminders and other saved actions have separate lifecycles; the email and digest periods do not erase every related record. You can use Delete stored content in Settings to clear the supported records sooner, without deleting your account. See the scope of this deletion control.

Connected credentials remain while the connection is active and are removed or rendered unusable when disconnected. Restricted backups expire through their separate backup cycle, rather than being erased immediately by the Settings control. Legal, security and billing records may require longer retention. Google and connected messaging platforms apply their own retention rules to information already sent to them.

7. Security

We use access controls, encrypted transport, protected credential storage, least-privilege provider permissions, data minimisation before AI analysis, sensitive email and calendar content protection for WhatsApp, Slack and Teams, request verification, tenant separation, restricted logging, monitoring, and other technical and organisational safeguards. No system can guarantee absolute security, so you should also protect your account and connected services.

8. Your choices and rights

Subject to applicable law, you may request information about processing, correction or completion of inaccurate data, erasure, withdrawal of consent, and grievance redressal. You may also nominate another individual to exercise applicable rights in the event of death or incapacity.

You can disconnect provider accounts in LuHoCh and revoke LuHoCh access through the provider's own security settings. You can delete stored email content from Dashboard → Settings. For full account deletion, follow our data-deletion instructions.

Where sender exclusions are enabled, add an email address or domain in Settings to exclude new matching messages from classification, AI analysis and future digests. The message may already have been fetched before the exclusion is checked. Exclusions do not remove existing saved content or messages already delivered.

Deleting saved content leaves connections and schedules in place, so later checks can create new records. Disconnect an inbox to stop future access through that connection. Disconnecting alone does not delete saved content; use both controls when you want to stop access and clear supported stored records. Original emails remain with your email provider.

9. Children

LuHoCh is not directed to children under 18. If you believe a child's personal data has been submitted to the service, contact us so we can review and take appropriate action under Indian law.

10. Contact and grievances

Privacy and grievance requests may be sent to uat@luhoch.ai . Use the subject “Privacy request” and do not include your password or provider tokens. We may securely verify your identity before acting on a request.

11. Policy updates

We may update this policy as the service, providers, or legal requirements change. The effective date above identifies the current version. Material changes will be communicated through an appropriate service channel.