Who we are
Lumina Labs Ltd (company number 17275042), registered at 1st Floor Woodgate Studios, 2-8 Games Road, Cockfosters, Hertfordshire, EN4 9HN, United Kingdom, provides the Lumina reporting platform at app.luminainsights.co. In this policy "Lumina", "we" and "us" mean Lumina Labs Ltd. For the personal data of our own users — your account and billing details — we are the data controller. For the marketing data you connect to Lumina about your clients, you are the controller and we act as your processor under our Data Processing Agreement. Questions about this policy: privacy@luminainsights.co.
What we collect
Account data — your name, email address, agency name and a hashed password. If you sign in with Google we receive your name, email address and profile picture from your Google account. Connected platform data — the read-only marketing metrics you authorise us to fetch, such as Search Console queries, Google Analytics sessions, ad spend and social engagement. This is the data your reports are built from. Usage data — product events, pages viewed and performance metrics, used to understand how the product is used and to fix problems. Billing data — your billing contact and the last four digits and expiry of your card. Card numbers are handled by Stripe and never reach our servers. Support data — anything you send us by email or through a form.
Google user data
When you connect Google, Lumina requests these read-only scopes: webmasters.readonly — Search Console clicks, impressions, CTR and position. analytics.readonly — Google Analytics 4 traffic and conversion metrics. adwords — Google Ads campaign spend and performance. yt-analytics.readonly — YouTube channel and video performance metrics. youtube.readonly — YouTube channel and video titles, so metrics are readable. Lumina's use and transfer of information received from Google APIs adheres to the Google API Services User Data Policy, including the Limited Use requirements. Concretely, that means we use Google user data only to build the dashboards, insights and reports you asked us to build. We do not sell it, we do not use it for advertising, and we do not use it to develop, improve or train generalised AI or machine learning models. Humans do not read it except where you ask us to help with a specific support issue, where it is needed to investigate a security incident, or where the law requires it. We never request write access. Lumina cannot change a campaign, edit a property or modify anything in your Google account. You can disconnect Google at any time from Integrations in the app, or revoke access directly at myaccount.google.com/permissions. Once revoked we stop fetching new data, and data already synced is deleted with your workspace or on request.
How we use your data
To provide the service — connect your platforms, build dashboards and reports, and deliver them on the schedule you set. To generate AI summaries — when you use an AI feature, the relevant report metrics are sent to our AI provider to draft a summary, which is returned to you to edit. Our AI providers do not use data submitted through their APIs to train their models. To operate the business — take payment, provide support, prevent fraud and abuse, and meet our legal obligations. To improve the product — using aggregated usage data about how features are used. To send email — transactional messages about your account and your scheduled reports, and marketing email only where you have opted in. You can unsubscribe from marketing at any time. We do not sell personal data, and we do not share it with third parties for their own advertising.
Legal bases (UK and EU GDPR)
Performance of a contract — providing the platform you signed up for and taking payment. Legitimate interests — securing the service, preventing abuse, and understanding product usage so we can improve it. We balance these against your rights. Consent — marketing email and non-essential analytics cookies. You can withdraw consent at any time. Legal obligation — keeping financial records and responding to lawful requests.
Who processes your data
We use the following subprocessors. Each is bound by a data processing agreement and may only process data on our instructions: Vercel — Application hosting and content delivery (United States). Turso — Primary database (account, client and report data) (United States). Upstash — Cache and rate limiting (United States). Stripe — Subscription billing and payment processing (United States / Ireland). Anthropic — Generating AI report summaries and insights (United States). OpenAI — Fallback provider for AI summaries (United States). Browserless — Rendering reports to PDF (United States / Europe). PostHog — Product analytics on our own website and app (United States / Europe). We will update this list before adding a new subprocessor. Email privacy@luminainsights.co to be notified of changes. Beyond these, your data goes to a third party only when you authorise it — for example by connecting an integration — or where we are legally required to disclose it.
Cookies and analytics
We use strictly necessary cookies to keep you signed in and to protect against cross-site request forgery. These cannot be turned off without breaking the service. We use PostHog for product analytics inside the Lumina app, to see which features are used and where people get stuck. It records page views and interactions and sets a cookie. It is not used for advertising and we do not sell the data. Analytics cookies are only set if you accept them. You are asked before anything non-essential is stored, "reject" is a single click, and rejecting leaves the app fully usable. You can change your mind at any time by clearing this site's data in your browser. You can also block cookies in your browser. Blocking strictly necessary cookies will prevent you from signing in.
Where your data is held
Our infrastructure currently runs in a single United States region, and several of our subprocessors are based in the United States. Regional data residency is on our roadmap but is not available today. Where personal data is transferred out of the UK or EEA, we rely on the European Commission's Standard Contractual Clauses together with the UK International Data Transfer Addendum, and on the EU-US and UK-US Data Privacy Framework where the recipient is certified.
How long we keep it
Account and workspace data — for as long as your account is open. After you close it, we delete your workspace data within 30 days. Connected platform data — kept while the integration is connected, and deleted when you disconnect it or delete the workspace. Billing records — six years after the end of the relevant financial year, because UK tax law requires it. Usage logs — 13 months. Backups — deleted data may persist in encrypted backups for up to 35 days before being overwritten.
Security
Integration credentials are encrypted at rest with AES-256-GCM before they are written to the database, and all traffic is encrypted in transit with TLS. Passwords are hashed with bcrypt and never stored in a readable form. Access is role-based, and account actions are recorded in an audit log. Our security page sets out exactly which controls are in place and which are not, including the certifications we have not yet obtained. If you believe you have found a vulnerability, email security@luminainsights.co.
Your rights
You have the right to access your data, to correct it, to have it deleted, to receive a portable copy, to object to or restrict processing, and to withdraw consent where we rely on it. You can export your reports and dashboards from the app at any time. For anything else, email privacy@luminainsights.co and we will respond within one month. If you are in the UK you may complain to the Information Commissioner's Office (ico.org.uk). If you are in the EEA you may complain to your local supervisory authority. We would rather you came to us first. If you are a California resident, you have the right to know what personal information we collect, to request deletion, to request correction, and not to be discriminated against for exercising those rights. We do not sell or share personal information as those terms are defined by the CCPA.
Children
Lumina is a business tool and is not directed at children. We do not knowingly collect personal data from anyone under 16. If you believe a child has provided us with personal data, email privacy@luminainsights.co and we will delete it.
Changes to this policy
If we make a material change we will email registered users before it takes effect. The current version always lives at /privacy, with the last-updated date at the top.
Contact
Questions? Email legal@luminainsights.co.