Privacy Policy

1. Information we collect

1.1 Information you provide directly

• Account information — name, email address, and password when you create an account or join the waitlist.
• Profile information — company name, job title, and other details you choose to add.
• Communications — messages, feedback, or support requests you send us.
• Payment information — billing details when you subscribe to a paid plan. Payment card data is processed directly by our payment processor and is not stored on our servers.

1.2 Information collected automatically

• Usage data — pages visited, features used, queries run, click patterns, and session duration.
• Device and browser data — IP address, browser type and version, operating system, device identifiers, and time zone.
• Log data — server logs including access times, referring URLs, and error information.
• Cookies and similar technologies — see Section 5 below.

1.3 Analytics data via Google Analytics 4

We use Google Analytics 4 (GA4) with the analytics.readonly scope to measure website traffic and user behaviour. GA4 collects data including page views, session duration, acquisition source, and device type. This data is aggregated and used only to improve the Service. Google's collection and use of data is governed by Google's Privacy Policy. You can opt out at any time using the Google Analytics Opt-out Browser Add-on.

1.4 Information from third-party services

• Authentication (Clerk) — if you sign in via a third-party provider (e.g. Google), we receive basic profile information such as name and email address. Clerk's privacy practices are described at clerk.com/legal/privacy.

2. How we use your information

We use the information we collect to:

• Provide, operate, and improve the Service.
• Create and manage your account.
• Process payments and send billing communications.
• Send transactional emails (account confirmation, password reset, service updates).
• Send marketing communications where you have opted in or where permitted by law — you can opt out at any time.
• Respond to support requests and provide customer service.
• Monitor usage patterns and perform analytics to improve the platform.
• Detect, investigate, and prevent fraudulent or unauthorised activity.
• Comply with legal obligations.

3. Legal bases for processing (EEA / UK users)

Where the GDPR or UK GDPR applies, we process your personal data on the following legal bases:

• Contract — to fulfil our obligations under the Terms of Service.
• Legitimate interests — to improve and secure the Service, prevent fraud, and market to existing customers.
• Consent — for optional marketing emails and non-essential cookies.
• Legal obligation — to comply with applicable laws and regulations.

4. How we share your information

We do not sell your personal data. We may share it with:

• Service providers — third parties that help us operate the Service (authentication, hosting, analytics, email delivery, payment processing). These providers may only process your data on our instructions.
• Business transfers — if we are involved in a merger, acquisition, or sale of assets, your data may be transferred as part of that transaction.
• Legal requirements — if required by law, court order, or governmental authority.
• Protection of rights — to protect the rights, property, or safety of Lumin, our users, or others.

5. Cookies

We use the following categories of cookies:

• Strictly necessary — required for the Service to function (e.g. authentication session cookies).
• Analytics — Google Analytics 4 cookies that help us understand how visitors interact with the site.
• Preferences — cookies that remember your settings.

You can control cookies through your browser settings. Disabling certain cookies may affect the functionality of the Service.

6. Data retention

We retain your personal data for as long as your account is active or as necessary to provide the Service. We may also retain data to comply with legal obligations, resolve disputes, and enforce agreements. When data is no longer needed, we delete or anonymise it securely.

7. International transfers

Our servers and service providers may be located outside your country of residence, including in the United States. When we transfer personal data internationally, we ensure appropriate safeguards are in place, such as Standard Contractual Clauses approved by the European Commission.

8. Your rights

Depending on your location, you may have the right to:

• Access — request a copy of the personal data we hold about you.
• Rectification — request correction of inaccurate or incomplete data.
• Erasure — request deletion of your personal data.
• Restriction — request that we limit how we process your data.
• Portability — receive your data in a structured, commonly used format.
• Objection — object to processing based on legitimate interests.
• Withdraw consent — where processing is based on consent, withdraw it at any time.

To exercise any of these rights, email us at support@lumin-llm.com. We will respond within 30 days. You also have the right to lodge a complaint with your local data protection authority.

9. Children's privacy

The Service is not directed at children under the age of 16. We do not knowingly collect personal data from children. If you believe we have inadvertently collected data from a child, please contact us and we will delete it promptly.

10. Security

We implement industry-standard technical and organisational measures to protect your personal data against unauthorised access, loss, or disclosure. However, no method of transmission over the internet or electronic storage is completely secure, and we cannot guarantee absolute security.

11. Third-party links

The Service may contain links to third-party websites. We are not responsible for the privacy practices of those sites and encourage you to review their privacy policies.

12. Changes to this policy

We may update this Privacy Policy from time to time. When we do, we will revise the "Last updated" date at the top of this page. If changes are material, we will notify you by email or through a prominent notice on the Service. Your continued use of the Service after the effective date constitutes acceptance of the revised policy.

13. Contact us

If you have any questions or concerns about this Privacy Policy, please contact us: