Privacy policy
Last updated: October 25, 2026
LukoAI ("we"), operated by BBK Wholesale Corp, d/b/a Luko Enterprise, runs a private reporting portal for businesses ("customers") and their staff. This policy explains what we collect and why.
What we collect
- Sign-in details: staff members' name and email address, from their Google account or the email address their employer adds, and, if they set up Face ID or a passkey, a public key from their device (never their face or fingerprint).
- Mobile number (optional): only if a staff member adds it on My settings to receive text messages.
- Business data: information our customers choose to connect (for example sales, payments and bookings from Toast, Stripe or CourtReserve), read-only, to build their reports.
- Questions and answers: what staff ask the assistant and its replies, so they can see their chat history.
- Uploaded documents: files staff upload, such as menus, orders, delivery slips and bills.
How we use it
Only to provide the portal to the customer that owns the data: showing reports, answering questions and checking documents. We don't sell personal information or use it for advertising.
Who processes it
- Our servers run on Amazon Web Services in the United States.
- Questions, and the data needed to answer them, are processed by Anthropic's AI services on our behalf.
- Google handles sign-in with Google accounts.
- Amazon Web Services sends our emails and text messages.
Text messages (SMS)
Staff can choose to receive work reminders and alerts about changes to their company's event bookings by text message. They opt in themselves: they enter their mobile number on My settings, tick a box agreeing to receive texts, and confirm the number with a code we text them.
- Message frequency varies with the reminders and alerts they and their employer set up. Message and data rates may apply.
- Reply STOP to any text to stop receiving them, or turn texts off on My settings. Reply HELP for help.
- We use mobile numbers only to send these texts. Texts are sent through Amazon Web Services.
- No mobile information will be shared with third parties or affiliates for marketing or promotional purposes. Text messaging opt-in data and consent are never shared with or sold to anyone.
Keeping it safe
Each customer's data is kept separate and is only visible to that customer's staff. Connection keys are stored encrypted. Access is limited to people each customer has added, signing in with Google, a one-time email link or a passkey.
How long we keep it
For as long as the customer uses the portal, or until they ask us to delete it.
Your choices
Staff can ask their employer, or contact us, to see or delete information about them.