Privacy Policy

This Privacy Policy explains how Lumina, of Galveston, Texas, United States (“we”, “us”, the “Controller”), collects, uses, discloses, retains and protects personal data in connection with the Lumina service (the “Service”). It should be read together with the Terms of Service.

1. Categories of Personal Data Processed

1.1 Account data: email address, hashed authentication credentials, display name, and where you sign in with a third-party identity provider, the identifiers and profile fields that provider releases to us. 1.2 Content data: prompts, chat messages, uploaded documents, spreadsheets, presentations, photographs, audio recordings, transcripts, generated images and saved workspace items. 1.3 Usage data:timestamps, model identifiers, token counts, estimated processing cost, feature interactions and error diagnostics. 1.4 Technical data: IP address, device and browser characteristics, and session identifiers. 1.5 Billing data: subscription status, plan, and transaction references. Full payment card details are processed directly by our payment processor and are never stored by us.

2. Purposes and Lawful Bases

Where the EU or UK General Data Protection Regulation applies, we rely on the following lawful bases: (a) performance of a contract, to create and maintain your account, deliver AI responses, store your files and provide support; (b) legitimate interests, to secure the Service, prevent abuse and fraud, monitor capacity and cost, and improve reliability; (c) consent, for optional features such as microphone access, personalised memory and non-essential communications, which you may withdraw at any time; and (d) compliance with legal obligations, including accounting and lawful requests from authorities.

3. Artificial Intelligence Processing

3.1 To generate a response, the relevant portion of your Input is transmitted to one or more model providers acting as processors or independent controllers, as applicable. 3.2 Do not submit information you are not permitted to disclose to such providers. 3.3 We do not sell personal data and we do not use your Input to train foundation models. 3.4 Automated processing produces content but is not used to take decisions producing legal effects concerning you.

4. Recipients and Sub-Processors

We disclose personal data to: cloud hosting and database providers; artificial intelligence model and inference providers; speech transcription providers; search index providers; email delivery providers; payment processors; and professional advisers, auditors or authorities where legally required. Each is bound by contractual confidentiality and data protection obligations. A current list of sub-processors is available on request to legal@lumina.app.

5. International Transfers

Personal data may be transferred to and processed in countries other than your own, including the United States. Where such transfers occur from the European Economic Area, the United Kingdom or Switzerland, we rely on adequacy decisions or on the European Commission's Standard Contractual Clauses, together with supplementary technical and organisational measures.

6. Retention

6.1 Account data is retained for the life of the account and for a limited period thereafter to resolve disputes and comply with statutory obligations. 6.2 Content data is retained until you delete it or delete your account. 6.3 Usage and security logs are retained for a rolling period not normally exceeding twenty-four (24) months. 6.4 Billing records are retained for the period required by applicable tax and accounting law.

7. Your Rights

7.1 Subject to applicable law you may request access to, rectification of, erasure of, or restriction of processing of your personal data; you may object to processing based on legitimate interests; you may request portability of data you provided; and you may withdraw consent. 7.2 Residents of California may, under the CCPA as amended by the CPRA, request disclosure of categories and specific pieces of personal information collected, request deletion or correction, and opt out of any sale or sharing of personal information; we do not sell or share personal information as those terms are defined. 7.3 We will not discriminate against you for exercising any right. 7.4 Requests may be submitted to legal@lumina.app and will be answered within the statutory period. 7.5 You have the right to lodge a complaint with your competent supervisory authority.

8. Children

The Service is not directed to children under sixteen (16) years of age and we do not knowingly collect their personal data. Where we become aware that such data has been collected, we will delete it without undue delay.

9. Security

We apply encryption in transit, encryption of stored provider credentials, role-based access control, row-level authorisation so that each account can access only its own records, audit logging and least-privilege administrative access. No system can be guaranteed absolutely secure. Where a personal data breach is likely to result in a risk to your rights and freedoms, we will notify the competent authority and, where required, affected users without undue delay.

10. Cookies and Local Storage

The Service relies on strictly necessary cookies and browser storage for authentication, session continuity and interface preferences, as described in the Cookie Policy.

11. Changes

We may update this Privacy Policy from time to time. The effective date above indicates the latest revision, and material changes will be communicated through the Service or by email.

12. Contact

Data protection enquiries should be addressed to Lumina, Galveston, Texas, United States, or by email to legal@lumina.app.