Privacy Policy

• Account information: name, email address, password (hashed), and authentication identifier from Google, GitHub, Facebook, or another OAuth provider if you sign in with one.
• Billing information: when you subscribe to Growth or Pro, our payment processor (Stripe) collects your payment method on our behalf. We never see or store your full card number — we receive only a Stripe customer ID, the last four digits of your card, the expiration date, and the country.
• Brand information: the website URL you submit, business name, contact details, and any other information you provide during onboarding or in your account settings.
• Content you create: social media posts, captions, images, and other content you generate using Lume's AI tools. You retain ownership of this content (see Section 8).

• Usage data: pages visited, features used, audits run, fixes applied, and timestamps.
• Device & log data: IP address, browser type, operating system, referring URL, and pages viewed.
• Cookies and similar technologies: see Section 5.

When you connect a third-party service to Lume — Google Search Console, Google Analytics, Google Business Profile, Meta (Facebook/Instagram), GitHub, WordPress, Shopify, or others — we receive data from that service through OAuth. The specific data depends on which service you connect. See Section 4 for the per-integration breakdown.

When you submit a URL for audit, we crawl publicly accessible pages on that website. We send the crawled content (HTML, meta tags, structured data) and the URL itself to our AI providers (see Section 4) to score it and generate recommendations. We do not crawl pages behind authentication or password walls.

By design, sub-processors receive only the minimum data needed to perform their function. We select sub-processors that publish data-protection terms or DPAs consistent with our obligations to you, and we make those terms available on request.

We may update this list as we add or change vendors. Material changes will be reflected in the “Last updated” date at the top of this policy and, where required by applicable law, communicated in advance.

Data Processing Addendum. A standard Data Processing Addendum (DPA) compliant with GDPR Article 28 is available on request to legal@getlumeai.com for customers acting as data controllers of end-user data they process through the Service.

When you connect a third-party service, we receive data from it through OAuth. Here's what we access and what we do with it:

You can disconnect any integration at any time from /settings/integrations. Disconnecting revokes our OAuth token; we will cease receiving new data from that integration without undue delay and delete cached data within a reasonable period, subject to the backup-rotation cycles described in Section 7.

We comply with the Google API Services User Data Policy, including the Limited Use requirements. Specifically, we do not use Google data for advertising; we do not transfer Google data except as necessary to provide your requested service or as required by law; and we do not allow humans to read Google data except with your consent or for security purposes.

We may disclose information when we reasonably believe it's necessary to: comply with a law, regulation, subpoena, or court order; protect the safety of any person; investigate fraud or abuse; or enforce our Terms of Service.

If Lume AI is acquired, merges with another company, or sells substantially all of its assets, your information may be transferred as part of that transaction. The acquiring company will be bound by this Privacy Policy or one with equivalent protections.

• Access and update your information — sign in and visit /settings.
• Delete your account — sign in, visit /settings/account, and click “Delete account.” This permanently deletes your account and associated data, subject to the retention periods in Section 7.
• Export your data — email legal@getlumeai.com and we will provide a machine-readable export of your data within the timeframe required by applicable law.
• Opt out of marketing emails — every marketing email has an unsubscribe link. Service-related emails (billing, security, audit completion) cannot be unsubscribed while your account is active.

You have the following rights under the GDPR or UK GDPR:

• Right of access — get a copy of your personal data
• Right to rectification — correct inaccurate data
• Right to erasure — delete your personal data
• Right to restrict processing — limit how we use your data
• Right to data portability — receive your data in a machine-readable format
• Right to object — object to processing based on legitimate interests
• Right to withdraw consent — at any time, where consent is the legal basis

Legal bases for processing. We process your personal data on the following legal bases: (a) contract — to deliver the Service you've subscribed to; (b) legitimate interests — to operate, secure, and improve the Service; (c) consent — for marketing emails and optional integrations; (d) legal obligation — to meet tax and regulatory requirements.

International transfers. Lume's servers are in the United States. If you're in the EEA, UK, or Switzerland, we transfer your data to the US under the European Commission's Standard Contractual Clauses. For transfers from the United Kingdom, we rely on the UK International Data Transfer Addendum (IDTA) or the UK Addendum to the EU SCCs, as applicable. For transfers from Switzerland, we rely on the SCCs as recognized by the Swiss Federal Data Protection and Information Commissioner. You can request a copy from legal@getlumeai.com.

To exercise any right, email legal@getlumeai.com. We will respond within the timeframe required by applicable law (typically within 30 days). If you're not satisfied with our response, you have the right to lodge a complaint with your local data protection authority.

You have the following rights under the California Consumer Privacy Act (CCPA), as amended by the California Privacy Rights Act (CPRA):

• Right to know what personal information we collect, use, and share
• Right to delete your personal information
• Right to correct inaccurate personal information
• Right to opt out of the sale or sharing of your personal information
• Right to limit the use of sensitive personal information
• Right to non-discrimination — we won't deny you service or charge you a different price for exercising your rights

Categories of personal information we collect. Identifiers (name, email, IP address); commercial information (subscription history); internet activity (usage data); geolocation (city/country level); inferences (audit results); customer records.

Sources — directly from you, automatically through your use of the Service, and from third-party services you connect.

Business purposes — delivering the Service, billing, security, support, product improvement.

Categories disclosed to third parties — to the sub-processors listed in Section 4.1.

Do Not Sell or Share My Personal Information. Lume AI does not sell personal information for monetary consideration. We use service providers (sub-processors) to deliver the Service, which under CCPA may be considered “sharing.” To opt out of any such sharing, email legal@getlumeai.com with the subject line “CCPA Opt-Out — Do Not Sell or Share.” Include the email address associated with your account. We will process your request within the timeframe required by California law.

You may also designate an authorized agent to make a request on your behalf. We'll require proof of authorization.

If you live in Colorado, Connecticut, Delaware, Iowa, Montana, Nebraska, New Hampshire, New Jersey, Oregon, Rhode Island, Tennessee, Texas, Utah, or Virginia, you have similar rights to know, delete, correct, and opt out of certain processing under your state's privacy law. Email legal@getlumeai.com to exercise any of these rights.

If you reside in Australia, Brazil, Canada, India, Japan, Singapore, or another jurisdiction with applicable data-protection law, you may have rights to access, correct, delete, or port your personal information, and to lodge a complaint with your supervisory authority. Email legal@getlumeai.com to exercise any such right; we will respond within the timeframe required by applicable law.