Lumin ("we", "us", or "our") is an AI visibility intelligence platform operated by Seed. This Privacy Policy explains how we collect, use, disclose, and protect information about you when you visit lumin-llm.com and use our platform at app.lumin-llm.com (together, the "Service").
By accessing or using the Service you agree to the practices described in this policy. If you do not agree, please do not use the Service.
1. Information we collect
1.1 Information you provide directly
- Account information — name, email address, and password when you create an account or join the waitlist.
- Profile information — company name, job title, and other details you choose to add.
- Communications — messages, feedback, or support requests you send us.
- Payment information — billing details when you subscribe to a paid plan. Payment card data is processed directly by our payment processor and is not stored on our servers.
1.2 Information collected automatically
- Usage data — pages visited, features used, queries run, click patterns, and session duration.
- Device and browser data — IP address, browser type and version, operating system, device identifiers, and time zone.
- Log data — server logs including access times, referring URLs, and error information.
- Cookies and similar technologies — see Section 5 below.
1.3 Google Analytics data you choose to connect
Lumin offers an optional integration that lets you connect your own Google Analytics 4 (GA4) property, so you can see traffic referred to your site by AI assistants (ChatGPT, Gemini, Claude, Perplexity and similar) alongside your AI visibility data. The integration is entirely optional — Lumin works without it, and you can disconnect at any time.
Scopes we request. When you start the connection, Google shows you a consent screen listing exactly what we ask for. We request only two scopes, and only the minimum needed for the feature:
https://www.googleapis.com/auth/analytics.readonly— read-only access to your GA4 account, used to list the GA4 properties you can choose from and to run aggregated traffic reports for the single property you select. This access is read-only: Lumin cannot create, edit, or delete anything in your Google Analytics account.https://www.googleapis.com/auth/userinfo.email— your Google account email address, shown in the app so you can see which Google account a connection belongs to before disconnecting or reconnecting it.
What we retrieve. For the GA4 property you select, we retrieve aggregated report data only: sessions, new users, engaged sessions, event counts, purchase revenue and transactions, broken down by date, traffic source, landing page and event name. We do not retrieve, and have no access to, individual visitor identifiers, user-level records, or raw event streams from your GA4 property.
How we use it. This data is used solely to display your own reporting inside Lumin — attributing referral traffic, landing pages, events and revenue to AI assistants and correlating that with your brand's AI visibility. It is not used for advertising, not sold, and not shared with third parties, other than the infrastructure providers that host the Service on our behalf under contract.
How we store it. Google OAuth access and refresh tokens are encrypted at rest with AES-256-GCM before being written to our database, and are used only to make requests to the Google Analytics Data and Admin APIs on your behalf.
How to revoke. You can disconnect at any time in Lumin under Settings → Integrations → Google Analytics 4, which deletes the stored connection and its tokens from our database. You can also revoke Lumin's access directly from your Google Account at myaccount.google.com/permissions.
Limited Use. Lumin's use and transfer of information received from Google APIs adheres to the Google API Services User Data Policy, including the Limited Use requirements.
AI and machine learning. We do not use data obtained through Google APIs to develop, improve, or train generalised or non-personalised AI or machine learning models. Google Analytics data connected to Lumin is never sent to any third-party AI model provider.
1.4 Information from third-party services
- Authentication (Clerk) — if you sign in via a third-party provider (e.g. Google), we receive basic profile information such as name and email address. Clerk's privacy practices are described at clerk.com/legal/privacy.
2. How we use your information
We use the information we collect to:
- Provide, operate, and improve the Service.
- Create and manage your account.
- Process payments and send billing communications.
- Send transactional emails (account confirmation, password reset, service updates).
- Send marketing communications where you have opted in or where permitted by law — you can opt out at any time.
- Respond to support requests and provide customer service.
- Monitor usage patterns and perform analytics to improve the platform.
- Detect, investigate, and prevent fraudulent or unauthorised activity.
- Comply with legal obligations.
3. Legal bases for processing (EEA / UK users)
Where the GDPR or UK GDPR applies, we process your personal data on the following legal bases:
- Contract — to fulfil our obligations under the Terms of Service.
- Legitimate interests — to improve and secure the Service, prevent fraud, and market to existing customers.
- Consent — for optional marketing emails and non-essential cookies.
- Legal obligation — to comply with applicable laws and regulations.
4. How we share your information
We do not sell your personal data. We may share it with:
- Service providers — third parties that help us operate the Service (authentication, hosting, analytics, email delivery, payment processing). These providers may only process your data on our instructions.
- Business transfers — if we are involved in a merger, acquisition, or sale of assets, your data may be transferred as part of that transaction.
- Legal requirements — if required by law, court order, or governmental authority.
- Protection of rights — to protect the rights, property, or safety of Lumin, our users, or others.
5. Cookies
We use the following categories of cookies:
- Strictly necessary — required for the Service to function (e.g. authentication session cookies).
- Analytics — privacy-friendly product analytics (Vercel Analytics) that help us understand how visitors interact with the site.
- Advertising measurement — a first-party cookie that records whether you arrived from one of our ads, so we can measure campaign performance. It is not used to build advertising profiles.
- Preferences — cookies that remember your settings.
You can control cookies through your browser settings. Disabling certain cookies may affect the functionality of the Service.
6. Data retention
We retain your personal data for as long as your account is active or as necessary to provide the Service. We may also retain data to comply with legal obligations, resolve disputes, and enforce agreements. When data is no longer needed, we delete or anonymise it securely.
7. International transfers
Our servers and service providers may be located outside your country of residence, including in the United States. When we transfer personal data internationally, we ensure appropriate safeguards are in place, such as Standard Contractual Clauses approved by the European Commission.
8. Your rights
Depending on your location, you may have the right to:
- Access — request a copy of the personal data we hold about you.
- Rectification — request correction of inaccurate or incomplete data.
- Erasure — request deletion of your personal data.
- Restriction — request that we limit how we process your data.
- Portability — receive your data in a structured, commonly used format.
- Objection — object to processing based on legitimate interests.
- Withdraw consent — where processing is based on consent, withdraw it at any time.
To exercise any of these rights, email us at support@lumin-llm.com. We will respond within 30 days. You also have the right to lodge a complaint with your local data protection authority.
9. Children's privacy
The Service is not directed at children under the age of 16. We do not knowingly collect personal data from children. If you believe we have inadvertently collected data from a child, please contact us and we will delete it promptly.
10. Security
We implement industry-standard technical and organisational measures to protect your personal data against unauthorised access, loss, or disclosure. However, no method of transmission over the internet or electronic storage is completely secure, and we cannot guarantee absolute security.
11. Third-party links
The Service may contain links to third-party websites. We are not responsible for the privacy practices of those sites and encourage you to review their privacy policies.
12. Changes to this policy
We may update this Privacy Policy from time to time. When we do, we will revise the "Last updated" date at the top of this page. If changes are material, we will notify you by email or through a prominent notice on the Service. Your continued use of the Service after the effective date constitutes acceptance of the revised policy.
13. Contact us
If you have any questions or concerns about this Privacy Policy, please contact us: