1. Who we are
This Notice is issued by Lumaye Hub ("Lumaye", "we", "us", or "our"), which operates the Lumaye service (the "Service"). Lumaye Hub is the data controller for personal data processed about our website visitors, account holders, and end users of the Service, except where we process data on behalf of a customer organization — in which case we act as a data processor for that organization.
2. Categories of personal data we collect
- Account data: name, email address, hashed password (or federated identity for Google sign-in), organization membership, and role.
- Profile and preference data: display name, avatar, language, preferred display currency, and notification settings.
- Content you submit: documents, images, tag data, maintenance records, chat prompts and messages, memory entries, and other operational data you upload to the Service.
- Support and communications: support tickets, comments, and correspondence with our team.
- Usage and telemetry: pages viewed, features used, AI call metadata, quota usage, error logs, device information, browser information, and IP address.
- Cookies and similar technologies: session cookies for authentication and functional storage for preferences (see section 9).
Payment-card details are collected and processed directly by Paddle (see section 6). We do not receive or store your full card number.
3. Purposes and legal bases
- Providing the Service (creating your account, authenticating you, storing your content, running AI features, delivering alerts and work orders) — performance of a contract.
- Billing and subscription management via Paddle —performance of a contract and compliance with legal obligations (tax and accounting).
- Security, abuse prevention, and audit logging —legitimate interests in protecting the Service and our users.
- Product improvement and diagnostics (aggregated usage analysis, debugging) — legitimate interests.
- Customer support — performance of a contractand legitimate interests.
- Marketing communications, where offered — sent on the basis of consent or legitimate interests where permitted, with an unsubscribe option in every message.
- Compliance with legal obligations — where required by law.
4. AI processing
When you use AI features, the prompts and relevant context (including content you have uploaded to your workspace) are sent to model providers listed in section 6 to generate a response. We do not authorize model providers to train foundation models on your content. Prompt and response metadata is retained for quota accounting, safety review, and debugging.
5. Who we share personal data with
- Subprocessors that host and operate the Service: cloud hosting and database providers, email delivery, error monitoring, and analytics providers. A current list is described on our Trust & Security page.
- AI model providers used to serve AI features (including OpenAI, Anthropic, Google, and other providers accessed via our AI gateway).
- Paddle — our Merchant of Record — for the sale of subscriptions, payment processing, subscription management, tax compliance, invoicing, and refunds.
- Professional advisers such as auditors, lawyers, and accountants, under duties of confidentiality.
- Authorities, where we are legally required to disclose, or to protect rights, property, or safety.
- Acquirers, in the event of a merger, acquisition, or sale of assets, subject to equivalent protection of your data.
6. International transfers
Personal data may be processed in countries outside your country of residence, including in the United States and the European Union. Where data is transferred out of the UK or EEA, we rely on adequacy decisions or appropriate safeguards such as the European Commission's Standard Contractual Clauses and the UK International Data Transfer Addendum.
7. Data retention
We retain personal data for as long as necessary to provide the Service and for the purposes described in this Notice. In practice this means:
- Account and content data: retained for the life of the account; deleted or anonymised within 30 days of account closure, unless we are required to keep it longer.
- Billing records: retained for the period required by tax and accounting law (typically 7 years) by Paddle and by us.
- Security logs and audit events: retained for up to 24 months.
- Support tickets: retained for up to 24 months after resolution.
8. Your rights
Subject to local law, you have the right to:
- access the personal data we hold about you;
- request correction of inaccurate data;
- request deletion of your data ("right to be forgotten");
- restrict or object to certain processing;
- request portability of your data in a structured, machine-readable format;
- withdraw consent where processing is based on consent;
- lodge a complaint with your local data-protection supervisory authority.
To exercise these rights, email support@lumaye.org. We aim to respond within one month.
9. Cookies
We use essential cookies to keep you signed in and to remember functional preferences (such as language and display currency). We use a limited amount of first-party analytics to understand how the Service is used. We do not run third-party advertising cookies. You can control cookies through your browser settings; disabling essential cookies will prevent parts of the Service from working.
10. Security
We apply appropriate technical and organisational measures to protect personal data, including encryption in transit and at rest, row-level access controls, least-privilege access for staff, audit logging, and regular reviews. See our Trust & Security page for details.
11. Children
The Service is not directed to children under 16 and we do not knowingly collect personal data from them.
12. Changes to this Notice
We may update this Notice from time to time. Material changes will be communicated through the Service or by email. The "Last updated" date at the top of this page reflects the latest revision.
13. Contact
Privacy questions and rights requests: support@lumaye.org.