Privacy Policy

At Lumina, we believe that privacy is a fundamental human right. This Privacy Policy explains how we collect, use, and protect your personal information when you use our software, website, and related services.

We designed this policy with transparency in mind. Our goal is to ensure you fully understand our data practices, empowering you to make informed decisions about your privacy. If you have any questions, our dedicated privacy team is always available to assist you.

We collect only the information necessary to provide and improve our services. This falls into three primary categories:

• Account & Profile Data: Information you provide when creating an account, such as your name, email address, and billing details.
• Usage Data: Automated insights into how you interact with our platform, including feature usage, performance metrics, and navigation paths.
• Device & Technical Data: IP addresses, browser types, and operating systems to ensure compatibility and detect security threats.

We use your data strictly to deliver value back to you. We do not sell your personal information to data brokers or third-party advertisers. Our primary uses include:

• Service Delivery: Authenticating your identity, processing transactions, and maintaining your account functionality.
• Product Improvement: Analyzing aggregated usage patterns to fix bugs and develop requested features.
• Security: Monitoring suspicious activity to protect your account against unauthorized access and fraud.

We share your information only in limited, carefully controlled circumstances:

• Trusted Service Providers: We employ third-party infrastructure providers bound by strict confidentiality agreements to host our servers and process payments.
• Legal Compliance: We may disclose information if required by a valid legal process, such as a subpoena or court order, while aggressively pushing back on overbroad requests.
• Business Transfers: In the event of an acquisition or merger, your data may be transferred, subject to the acquiring entity upholding this policy.

We retain your personal data only for as long as your account is active or as needed to provide our services and comply with legal obligations.

When you delete your account, we initiate a deletion sequence that purges your personal data from our primary production systems within 30 days. Encrypted backups are routinely overwritten and fully cleared within 90 days.

Depending on your jurisdiction (including GDPR and CCPA), you possess significant rights regarding your data:

• Right to Access: You can request a complete export of the data we hold about you.
• Right to Rectification: You may correct inaccurate or incomplete information.
• Right to Erasure: You can request the permanent deletion of your account and associated data.
• Right to Object: You can opt-out of promotional communications and certain processing activities.

You can exercise these rights directly within your account settings or by contacting our privacy team.

Our application uses cookies and similar technologies to remember your preferences and secure your session.

We categorize cookies into "Essential" (required for login and security) and "Analytics" (used to understand platform performance). You have full control over non-essential cookies through our preference center, and we honor "Do Not Track" and Global Privacy Control signals from your browser.

Security is foundational to our architecture. We implement industry-leading safeguards to protect your data:

• Encryption: All data is encrypted in transit (TLS 1.3) and at rest (AES-256).
• Access Controls: Strict role-based access limits internal data exposure to essential personnel only.
• Audits: We undergo annual independent SOC 2 Type II audits and regular penetration testing.

In the unlikely event of a security breach affecting your data, we are committed to notifying you within 72 hours with a transparent mitigation plan.

Our platform is designed for professionals and is not directed at children under the age of 16. We do not knowingly collect personal information from individuals under 16.

If we become aware that a child has provided us with personal data without verifiable parental consent, we will take immediate steps to delete that information from our servers. If you believe a child has provided us with their data, please contact us immediately.