Privacy Notice

1. Who we are

Lumis OS LLC (trading as Lumis OS) is the controller of your personal data. You can reach us at team@lumisos.ai.

2. Data we collect

• Account data — name, email, password hash, display name, profile picture.
• Workspace content — companies, contacts, projects, tasks, notes, meeting transcripts, files, and any other content you create or upload.
• AI prompts and outputs — text you submit to the AI assistant or AI executives, and the responses returned.
• Communications — support messages, email opt-in preferences, signed documents.
• Usage and telemetry — pages viewed, actions taken, feature usage, errors encountered, approximate device and browser information.
• Technical data — IP address, session identifiers, cookies necessary to keep you signed in.
• Billing data — handled by Stripe (see Section 4). We receive limited information such as your subscription tier, billing country, and the last four digits of your payment method.

3. How we use your data

We do not sell your personal data. We do not use your workspace content or AI prompts to train third-party foundation models.

4. Who we share data with

• Hosting & infrastructure — Supabase / Lovable Cloud (database, authentication, file storage).
• AI model providers — Google, OpenAI, and similar providers process prompts you submit to AI features in order to generate responses. Providers do not retain your prompts for model training.
• Payments — Stripe, Inc. processes all payments, subscription management, tax, and invoicing on our behalf.
• Email delivery — Resend (or similar transactional email provider) sends account and notification emails on our behalf.
• Professional advisers — legal, accounting, and tax advisers under confidentiality obligations.
• Authorities — where required by law, court order, or to protect our rights and the safety of users.
• Successors — in the event of a merger, acquisition, or sale of assets, subject to equivalent privacy commitments.

4a. Google user data (Calendar integration)

When you connect a Google account to Lumis OS for calendar-based booking, we request the following OAuth scope:

• https://www.googleapis.com/auth/calendar.readonly — read-only access to your Google Calendar events.

For parity with Microsoft accounts, connecting an Outlook / Microsoft 365 calendar requests the equivalent Calendars.Read scope.

What we access: event start and end times and busy/free blocks, and only from the calendars you explicitly connect. We use this to compute your availability so booking pages can show open time slots.

What we do not access or store: we do not store event titles, descriptions, locations, attendee lists, or attachments. We do not create, modify, delete, or share your calendar events. We do not request access to Gmail, Google Drive, Google Contacts, or any other Google service.

Storage: OAuth refresh tokens are stored encrypted so we can query availability on your behalf. Free/busy results are computed on demand and are not retained beyond the request that needs them.

No secondary use: we do not sell Google user data, we do not use it for advertising, and we do not transfer it to third parties except as required to provide the calendar-availability feature to you. Lumis OS's use and transfer of information received from Google APIs to any other app will adhere to the Google API Services User Data Policy, including the Limited Use requirements.

AI/ML model training: Lumis OS does not use raw or aggregated/anonymized data received from Google Workspace APIs (including Google Calendar) to develop, improve, or train generalized AI or machine-learning models. We do not transfer Google Workspace API data to any third-party AI/ML service for training purposes. The use of raw or derived user data received from Workspace APIs will adhere to the Google User Data Policy, including the Limited Use requirements.

How to revoke: you can disconnect your calendar at any time from within Lumis OS (Settings → Integrations, or Bookings → Connected Calendars) or by revoking access at myaccount.google.com/permissions. Revoking access invalidates our stored tokens and stops all further access.

5. International data transfers

Our hosting and subprocessors may be located outside the EEA or UK (primarily in the United States). Where personal data is transferred internationally, we rely on appropriate safeguards such as the Standard Contractual Clauses, the UK International Data Transfer Addendum, or adequacy decisions where available.

6. How long we keep data

We keep account and workspace data for as long as your account is active. If you delete your account or your workspace, we delete or anonymise the associated data within 90 days, except where we are required to retain it for legal, accounting, or fraud-prevention purposes. Backups are rotated and aged out within a further 90 days. You may export your workspace data at any time before deletion.

7. Security

We use appropriate technical and organisational measures to protect your data, including encryption in transit (TLS), encryption at rest, role-based access control, row-level security on user data, secrets management, audit logging, and least-privilege access for staff. No system is completely secure — please notify us immediately if you suspect a security incident.

8. Your rights

Depending on where you live, you may have the right to:

• access the personal data we hold about you;
• correct inaccurate or incomplete data;
• delete your data ("right to be forgotten");
• restrict or object to certain processing;
• receive your data in a portable format;
• withdraw consent at any time, where processing is based on consent;
• lodge a complaint with your local data-protection authority.

To exercise any of these rights, email team@lumisos.ai. We aim to respond within 30 days.

9. Cookies

We use only strictly-necessary cookies — to keep you signed in, remember your workspace, and protect against cross-site request forgery. We do not use advertising or cross-site tracking cookies. If we add analytics cookies in the future, we will update this notice and ask for your consent where required.

10. Children

The Service is not directed at children under 16. We do not knowingly collect personal data from children. If you believe a child has provided us personal data, contact team@lumisos.ai and we will delete it.

11. Changes

We may update this notice from time to time. If a change is material, we will give reasonable notice before it takes effect. The "Effective" date at the top of this page shows when it was last updated.

12. Contact

Questions or privacy requests: team@lumisos.ai.