繁EN
← Back to home
← Back to home

Lugoffice Privacy Policy

Effective date: 2026-11-04 · Version: 1.4

1. Who we are

Lugoffice is provided by LUGJI LIMITED (incorporated in Hong Kong · Company No. 80568856 · registered office: Unit 2904-05, 29/F, Universal Trade Centre, 3 Arbuthnot Road, Central, Hong Kong). Privacy enquiries: info@lugji.app.

Lugoffice and Lugji are two separate apps from the same company. Lugji is on-device private capture (no cloud AI); Lugoffice is opt-in cloud AI document processing. This policy covers Lugoffice only.

2. What Lugoffice does

Lugoffice reads meeting transcripts from your own vault. When you initiate it, per document, it sends the text you select to enterprise Google Vertex AI (Gemini) to generate written-language documents (minutes / reports / announcements / formal email), or to translate a document. Results are saved automatically to Lugoffice's folder in your iCloud (or on your device if iCloud is off); if you connect Obsidian, a copy is also synced to your Obsidian vault.

3. You control every send

  • Only the document you initiate is sent — every cloud-AI flow (meetings, pasted text, weekly reports, and translation) is triggered by you, and each time before anything is sent a consent screen shows the exact text that will be sent for you to confirm. Nothing is uploaded to cloud AI in the background.
  • Lugbox sync runs automatically — if your organisation uses a Lugbox, documents you have marked are synced to its Lugbox automatically when you open the app (see section 4.1).
  • Text only, never audio — Lugoffice only handles text and never sends your recordings; only the text you choose is sent.
  • No accounts — Lugoffice has no user accounts today, and collects no contacts, location, advertising identifiers, or browsing history.
  • No third-party analytics / ads / crash-reporting SDKs.

4. Where the data goes (the processing chain)

When you start a generation or translation, the selected text is:

  1. Relayed via Lugoffice's proxy (Google Cloud Run · hosted in asia-east2, Hong Kong) — the proxy logs metadata only (time, size, status, token counts, etc.) and never stores your transcript content / prompt / response; the proxy has no database and no persistent storage.
  2. Processed by Google Vertex AI (Gemini). AI inference runs via Vertex's global endpoint (Google may process in any of its regions); because it is not bound to a single region, we make no "data stays in Hong Kong" claim. Vertex is an enterprise service, and your content is not used to train Google's models.
  3. Returned to the app and saved to Lugoffice's folder in your iCloud (or on your device if iCloud is off). Lugoffice keeps no copy of your content or outputs on any Lugoffice server.

At the network layer: any HTTPS request causes your IP address to reach Google's hosting edge; this is transient infrastructure-level handling — our proxy does not log IP and does not use it to identify you.

International transfers: because the global endpoint is used, by using the cloud-generation feature you acknowledge and agree that processing may occur outside your country or region.

4.1 Lugbox (enterprise · organisation licence required)

Lugbox is an on-premises server that we install for organisations (for example, companies and law firms) on their own internal network. It is an enterprise offering that must be activated with an organisation licence; until then, the related features appear locked in the app.

If your organisation runs a Lugbox with an active licence, documents you choose to mark are sent over your organisation's network (usually its internal network) to its own Lugbox, for local AI search and an organisation shared library. This transfer does not pass through Lugoffice's servers and is not sent to Google. (If a document was generated with cloud AI, see section 4 for where data goes during generation.) Depending on how your organisation sets it up, the connection between the app and the Lugbox may be unencrypted http.

Documents you share to the organisation shared library may be visible to other authorised people in your organisation. If you unshare a document, it is removed from the shared library but stays in your own area on the Lugbox. When you unmark it, the app sends the document once more (with the mark removed) so the Lugbox can remove it; this only happens once your device can reach the Lugbox, and until then the document stays on the box, where administrators can see it. Once removed, the document and its index are no longer on the Lugbox and new conversations will no longer find it. However, content that already appeared in earlier conversations stays in the conversation records, which you and administrators can see, and continuing the same conversation may still draw on it. Some data from removed documents may also temporarily remain inside the system; it cannot be reached through normal queries and is deleted at the latest when the box is cleared at the end of the service.

Your organisation's Lugbox administrators can see all documents and query history on the box. Retention and management of data on the Lugbox are the responsibility of your organisation.

5. Sub-processors

Other than these Google Cloud services, Lugoffice does not sell, rent, or disclose your content to any third party, and does not use it for advertising.

5.1 Security

  • Communication between the app, proxy, and Google Cloud is encrypted in transit via HTTPS/TLS.
  • Access to the proxy infrastructure is restricted to authorised personnel.

6. Retention

  • Your content / outputs: zero retention on any Lugoffice server — processed in transit and discarded; the only lasting copy is in your own vault (under your control).
  • Proxy metadata logs: ~30 days (Google Cloud Logging default), metadata only (e.g. request timestamp, token count, status code, latency), not your transcript, prompt, or output, for service operation / abuse-prevention. Infrastructure request logs (which include IP) follow the same ~30-day default.

7. Legal bases (where applicable)

  • Hong Kong PDPO: we process the content you send based on your explicit consent, limited to delivering the document generation you request.
  • EU visitors (GDPR): legal basis = your consent (Art. 6(1)(a)) + performance of the service you request.
  • California (CCPA/CPRA): we do not sell or "share" (for cross-context advertising) your personal information.

8. Your rights

You may request access to, correction of, or deletion of the (limited) metadata we hold; your content itself lives in your own vault under your direct control. Contact info@lugji.app.

9. Children

Lugoffice is not directed to children under 13 and does not knowingly collect their data.

10. Changes

Updates are posted at lugoffice.app with a revised effective date. If we ever add a new sub-processor, cloud model, or account feature, we will update this policy and the App Store privacy label before that version ships.

11. Contact

LUGJI LIMITED · Unit 2904-05, 29/F, Universal Trade Centre, 3 Arbuthnot Road, Central, Hong Kong · info@lugji.app.

Privacy Policy·Terms of Service·繁體中文