Lucid Chart is a productivity platform that provides collaboration for enterprises, schools, and hybrid teams. The privacy policy clearly indicates that users can interact with both trusted and untrusted users by creating, uploading, and copying content into Lucid. The privacy policy also states that Lucid collects users’ names, email addresses, telephone numbers, postal addresses, credit card information, and other contact or identifying information the user chooses to provide. The privacy policy provides a non-exhaustive list of the categories of user information Lucid shares with third parties and discloses that Lucid and third parties may use collected information to serve users targeted advertising. The security program policy states Lucid encrypts users’ personal information both at rest and at transit. The privacy policy provides that users have the right to access, edit, and delete their personal information.

Lucid Chart can be accessed through its website, and is available for download at the iOS App Store, and the Google Play Store. The Privacy Policy and Terms of Use used for this evaluation can be found on Lucid Chart’s website, iOS App Store, and the Google Play Store. Additionally, other policies used for this evaluation include: Sub-Processor List, Cookie Policy, GDPR Compliance, Security Program, Code of Ethics and Conduct, Data Processing Addendum, Education Privacy Policy, Global Anti-Bribery & Anti-Corruption Policy, and Developer Terms of Service. This evaluation only considers policies that have been made publicly available prior to an individual using the application or service.

Safety

The Privacy Policy clearly indicates that users can interact with both trusted and untrusted users by creating, uploading, and copying content into Lucid and sharing it with both people the user knows and people the user does not know, including sharing information in with users participating in a chat function. The Privacy Policy fully discloses that Lucid retains the right to publicize its customers’ identities on its website or in its customer list, blogs, and other marketing materials or public communications. The terms fail to state whether Lucid takes reasonable measures to delete personal information from a user’s posting before it is made publicly available, whether interactions between users are moderated, or whether users have the option of reporting inappropriate content.

Privacy

The Privacy Policy clearly states that in the preceding 12 months, Lucid has collected identifies, financial information, internet or electronic network activity information, professional and employment-related information, and inferences. The terms do not clearly state whether Lucid’s collection of information is limited to only data that are specifically required for the product, or whether Lucid collects geolocation data, health or biometric data, behavioral data, or sensitive data. The Privacy Policy provides that Lucid’s servers automatically collect information about a user’s use of Lucid’s Services, and that third party providers collect user data through cookies, web beacons, device identifiers, and other tracking technologies. The Privacy Policy clearly states that Lucid may share your personal information with third parties and that the categories of information shared with third parties includes identifiers, financial information, internet or electronic network activity information, professional employment-related information, education information, inferences, and other information provided by the user.

The Privacy Policy also indicates that Lucid sells personal information to advertisers so third parties can serve targeted advertisements promoting Lucid to on other properties. However, the Data Processing Addendum, which applies exclusively to enterprise-designated accounts, states that Lucid does not sell the personal information of these types of account holders. The terms provide an extensive list of third party processing providers as well as the roles of the third-party service providers. The Privacy Policy discloses that Lucid shares personal information for analytical and marketing purposes. However, the terms do not clearly disclose whether Lucid shares personal information for product improvement or research purposes. The Privacy Policy provides users a method of opting out of certain targeted advertising vendors and for opting out of the sale and sharing of the user’s personal information.

Security

The Security Program policy clearly dictates that Lucid implements reasonable security standards and encrypts user information both at rest and in transit. Furthermore, the Security Program policy states that Lucid imposes physical security measures to protect the confidentiality of user personal information. The Privacy Policy indicates that Lucid verifies the identity of users requesting to access, edit, or delete their information by requiring the user to receive a verification email with the email associated with the Lucid account. The terms do not dictate whether site visitors must create a Lucid account before using Lucid’s services. The Terms of Service indicate that schools, school districts, and related persons control students’ personal information. The terms state that Lucid obligates third parties with access to users’ information to provide an equivalent level of data protection as Lucid. The terms fail to state whether Lucid will notify users in the event of a data security breach.

Compliance

The Education Privacy Policy states that schools “are responsible for ensuring that they have any parental consent necessary to share personal information with us and to allow us to collect personal information from Students.” The terms are unclear on whether parents can consent to the collection and use of their child’s personal information without also consenting to the disclosure of the information to third parties. However, the Education Privacy Policy clearly provides that parents may withdraw consent for Lucid to collect their child’s personal information.

The terms clearly state that users can create and upload content to Lucid’s services and that the user retains ownership over their content uploaded to Lucid, but grants Lucid a limited license over the content. The Privacy Policy indicates that users can designate an authorized agent to request privacy rights on the users’ behalf, including accessing, editing, deleting, and downloading user personal information. However, the Privacy Policy discloses that even if a user deletes personal information from an account, or deactivates an account, that Lucid “may retain certain information as required by law or for legitimate business purposes. We may also retain cached or archived copies of your information for a certain period of time.” The terms fail to disclose how long it may take to process a privacy rights requests.

• Personal information is sold or rented to third parties.
• Personal information is shared for third-party marketing.
• Personalised advertising is displayed.
• Data are collected by third-parties for their own purposes.
• User's information is used to track and target advertisements on other third-party websites or services.
• Unclear whether this product creates and uses data profiles for personalised advertisements.