This policy is written to reflect GDPR expectations for an EU-based service. Confirm the specifics — legal bases, retention periods, sub-processors — with a data-protection advisor before publishing.
1. Who controls your data
Lumo Labs Ltd is the data controller for personal data processed through the Service. For the content and audience data you bring into Lumo through connected channels, we act as your data processor, processing it on your instructions. You can reach our privacy team at privacy@trylumo.ai.
2. What we collect
| Category | Examples |
|---|---|
| Account data | Name, email, workspace details, password (hashed) or Google sign-in identifier. |
| Billing data | Plan, billing address, transaction history. Card details are handled by our payment processor, not stored by us. |
| Content and media | Brand materials, uploaded files, drafts, and posts you create or store in Lumo. |
| Connected channel data | Access tokens and the account data and performance metrics returned by platforms you connect. |
| Usage data | Log data, device and browser information, IP address, and how you interact with the Service. |
3. How and why we use it
- To provide the Service — learning your brand, drafting content, scheduling, publishing, and reporting.
- To operate connected channels on your behalf within the permissions you grant.
- To process payments, manage subscriptions, and prevent fraud.
- To improve reliability, security, and product quality. We do not use your private content to train third-party models except as needed to deliver the Service to you.
- To communicate with you about your account, updates, and support.
4. Legal bases
We rely on: performance of a contract to deliver the Service you signed up for; legitimate interests for security, service improvement, and non-intrusive analytics; consent for optional cookies and marketing emails, which you can withdraw at any time; and legal obligation for tax and accounting records.
5. Who we share it with
We share personal data only with service providers who help us run Lumo, under contract and appropriate safeguards. Categories include cloud hosting, payment processing, email delivery, product analytics, customer support, and the AI providers that generate content. We do not sell your personal data. We may disclose data where legally required, or as part of a merger or acquisition, with notice where feasible.
6. International transfers
Where personal data is transferred outside the EEA, we use safeguards such as the European Commission's Standard Contractual Clauses or transfers to countries with an adequacy decision. You can request details of the safeguards in place.
7. How long we keep it
We keep account and content data for as long as your account is active. After closure, we delete or anonymise personal data within a reasonable period, except where we must retain records to meet legal, tax, or dispute-resolution obligations. Access tokens are deleted when you disconnect a channel or close your account.
8. Your rights
Under GDPR you have the right to access, correct, delete, restrict, or object to processing of your personal data, to data portability, and to withdraw consent where processing is based on it. To exercise any of these, email privacy@trylumo.ai. We will respond within the timeframes required by law.
9. Security
We use encryption in transit, access controls, and regular review of our practices to protect your data. No system is perfectly secure, but we work to limit risk and will notify you and the relevant authority of a qualifying breach as required by law.
10. Contact and complaints
Questions or concerns go to privacy@trylumo.ai. If you are in the EU and believe we have not handled your data properly, you may lodge a complaint with your local data protection authority.