Privacy Policy

• We process personal data only to run Lumi, keep it secure and meet legal obligations. We never sell your data.
• Your conversations are stored encrypted at rest. Our staff do not browse them.
• Your chats are used to improve Lumi only if you allow it via the “Help improve Lumi” setting.
• We use no advertising cookies. Google Analytics runs only if you agree in our cookie notice - you can change your choice at any time.
• Fonts are served from our own servers; your browser does not connect to Google Fonts.
• You can export or delete your data yourself at any time in Lumi's Settings.

The controller within the meaning of the General Data Protection Regulation (GDPR) is:

For all questions about data protection and to exercise your rights, please contact us at [email protected] or by post at the address above (“Data protection”).

We process personal data on the following legal bases:

• Art. 6 (1)(a) GDPR - your consent (e.g. Google Analytics, the “Help improve Lumi” setting). You can withdraw consent at any time with effect for the future (Art. 7 (3) GDPR).
• Art. 6 (1)(b) GDPR - performance of a contract with you or pre-contractual steps (e.g. your Lumi account, answering your messages).
• Art. 6 (1)(c) GDPR - legal obligations (e.g. tax and commercial retention duties).
• Art. 6 (1)(f) GDPR - our legitimate interests (e.g. secure and stable operation, abuse prevention, sending invitations you ask us to send), provided your interests do not override them.

Storing information on your device or reading it from there is based on § 25 (2) No. 2 Telekommunikation-Digitale-Dienste-Datenschutz-Gesetz (TDDDG) where it is strictly necessary for the service you requested, and otherwise on your consent (§ 25 (1) TDDDG).

When you visit orbitlumi.com or app.orbitlumi.com, your browser automatically transmits data that is stored in server log files: IP address, date and time of the request, the page requested, referrer URL, browser type and version, operating system, HTTP status code and amount of data transferred.

We process this data to deliver the website and app, ensure their stability and security, and defend against attacks (Art. 6 (1)(f) GDPR). Log data is deleted or anonymised after no more than 30 days, unless a longer retention is required to investigate a specific security incident.

The website and the app are hosted and delivered via the network of Cloudflare (see section 16). Fonts, images and scripts of the website and the app are served from our own servers; no connection to Google Fonts or other font services is made.

When you first visit, we ask in a cookie notice whether you agree to analytics. Your answer applies to orbitlumi.com and app.orbitlumi.com together.

Strictly necessary (always active, § 25 (2) No. 2 TDDDG):

• Sign-in session in the Lumi app: a secure, http-only cookie that keeps you signed in, plus your in-app settings stored locally (e.g. theme, background, widgets, units, to-dos and notes).
• Your cookie choice: a cookie (lumi_consent, 12 months) that remembers your answer to the cookie notice - shared by orbitlumi.com and app.orbitlumi.com, so you're only asked once.
• A random device identifier in the app's local storage, used to protect accounts and invitations against misuse (see section 9).
• Security cookies that Cloudflare may set to protect our services against bots and attacks.

Analytics - only with your consent (§ 25 (1) TDDDG): Google Analytics cookies (_ga, _ga_<ID>, up to 2 years), see section 6.

You can change your choice at any time: “Cookie settings” at the bottom of the website, or Settings → Privacy in the app. If you withdraw your consent, we remove the analytics cookies. You can also delete stored data via your browser settings; you may then have to sign in again.

If you agree in our cookie notice, we use Google Analytics 4 - where applicable loaded via Google Tag Manager - services of Google Ireland Limited, Gordon House, Barrow Street, Dublin 4, Ireland (“Google”), to understand how our website and app are used and to improve them. Without your consent, neither is loaded.

What is processed: an identifier stored in a cookie that recognises your browser, the pages and screens you view, time spent, the website you came from, your device type, operating system, browser and screen size, and your approximate location (country, region, city) derived from your IP address. Google Analytics does not log or store IP addresses of users in the EU. We do not send your name, email address or the content of your conversations to Google. Google Signals and advertising features are switched off.

Legal basis: your consent (Art. 6 (1)(a) GDPR, § 25 (1) TDDDG), which you can withdraw at any time with effect for the future via “Cookie settings”.

Recipient and transfer: Google processes the data on our behalf (Art. 28 GDPR). The data may also be processed by Google LLC in the USA; Google LLC is certified under the EU-U.S. Data Privacy Framework (Art. 45 GDPR). Analytics data is deleted after 14 months at the latest. More: Google's privacy policy and Google's data processing terms.

To protect our contact form, sign-up and sign-in against spam and automated abuse, we use Cloudflare Turnstile. Turnstile checks whether a request comes from a human by evaluating technical information such as your IP address and browser characteristics. The legal basis is our legitimate interest in protecting our services (Art. 6 (1)(f) GDPR) and § 25 (2) No. 2 TDDDG.

If you contact us via the form or by email, we process your name, email address, subject, message and the time of your request to handle your enquiry (Art. 6 (1)(b) GDPR where it relates to a contract, otherwise Art. 6 (1)(f) GDPR). We delete this data once your enquiry has been fully handled, unless statutory retention obligations apply.

To use Lumi you create an account. We process:

• Account data: email address, first and last name, password (stored only as a salted hash), email verification status, plan.
• Optional profile data: what Lumi should call you, your line of work, custom instructions, and your preferences (e.g. theme, chat font, default model).
• Security data: sign-in sessions (device, browser, operating system, IP address, last activity), the country of your last sign-in (derived from your IP address by Cloudflare), two-factor authentication settings, failed sign-in attempts, and a hash of the random device identifier and of the network (IP range) you use Lumi from.

We process this data to provide your account and the Lumi service (Art. 6 (1)(b) GDPR) and to protect your account and our invitation rewards against misuse (Art. 6 (1)(f) GDPR). We send you service emails, such as verification codes, password resets and security notices.

Password check. When you choose a password, we check whether it has appeared in known data breaches using the Pwned Passwords service (haveibeenpwned.com). Only the first five characters of a hash of the password are sent, which does not reveal the password and does not identify you (Art. 6 (1)(f) GDPR).

You can optionally sign in with your Google account. Google Ireland Limited, Gordon House, Barrow Street, Dublin 4, Ireland then transmits your name, email address and profile picture to us. We use this data only to create and sign in to your account (Art. 6 (1)(b) GDPR). Google's sign-in script is only loaded when you open the sign-in or sign-up form. Google may process data in the USA; see Google's privacy policy.

What we process. The messages you send to Lumi and the answers Lumi generates (“conversations”), together with metadata such as the title, timestamps, the Lumi tier and message counts. To personalise answers, your custom instructions and the name you chose are added to your requests.

Purpose and legal basis. We process conversations to generate answers, show you your chat history and provide features such as search, export and regeneration (Art. 6 (1)(b) GDPR).

How answers are generated. Your messages are processed by the AI infrastructure of Cloudflare, Inc. (Workers AI), which acts as our processor under a data processing agreement and processes the content only on our instructions to generate the answer. Titles for your chats are generated the same way.

Storage and encryption. Conversation contents are stored in Cloudflare R2 object storage in the EU, encrypted at rest with keys managed by us. Our database only holds an index (e.g. title, timestamps, counts), not the message texts. Our staff do not browse conversations. They only see a message excerpt if you report it to us, or where we are legally required to disclose data.

Private chats. A private chat does not appear in your history and is deleted as soon as you leave it.

Help improve Lumi. If you turn on the “Help improve Lumi” setting, we may use de-identified excerpts of your conversations to evaluate and improve the quality and safety of Lumi (Art. 6 (1)(a) GDPR). You can switch this off at any time in Settings → Privacy.

Safety. We may use automated checks to detect and prevent abusive or illegal use of Lumi (Art. 6 (1)(f) GDPR).

No automated decisions. We do not make decisions based solely on automated processing that produce legal effects concerning you or similarly significantly affect you (Art. 22 GDPR).

AI-generated content. Answers in Lumi are generated by artificial intelligence and are marked as coming from Lumi. They can be inaccurate - please check important information.

If you invite someone. When you invite a friend by email, we process the email address you enter and, if you add one, your personal message, to send a single invitation email in your name and to show you whether the invitation was accepted (Art. 6 (1)(f) GDPR - your interest and ours in inviting people you know). Please only invite people who are happy to hear from you. If you share your personal invite link instead, we don't learn anything about the people you send it to until they sign up.

If you were invited. We received your email address from the person who invited you (Art. 14 GDPR). We use it only to send you that one invitation - and, if you sign up, to credit the person who invited you. You can object to this at any time or ask us to delete your address by writing to [email protected]; we will not contact you again.

Rewards and fairness. To check whether an invitation counts, we compare the (hashed) device identifier and network of the new account with those of the person who invited them (Art. 6 (1)(f) GDPR - preventing self-invitations and fake accounts). The inviter only sees the friend's first name and the initial of their last name (link invitations) or the address they entered (email invitations), and whether the invitation counted.

The weather widget in the app shows the weather for your location or for cities you add. Your browser only shares your location if you allow it. We round the coordinates to about 1 km and send them, or the name of the city you search for, from our server to our weather and place providers: the Norwegian Meteorological Institute (MET Norway, Oslo, Norway) for forecasts, and OpenStreetMap Nominatim (OpenStreetMap Foundation, Cambridge, United Kingdom) and Photon (komoot GmbH, Potsdam, Germany) for place names. These providers receive the request from our server, not your IP address. The last location, your saved cities and the last forecast are stored in your browser only. The legal basis is Art. 6 (1)(b) GDPR (the feature you use).

When you tilt or shake your phone, the app reads its motion sensors to animate the weather and Lumi. This data never leaves your device.

Usage. We count how many messages you send per day and on which plan, to apply plan limits, prevent abuse and plan capacity (Art. 6 (1)(b) and (f) GDPR).

Time in Lumi. While you're signed in, the app measures how long you actively use Lumi - only while it is open on your screen and in use - and sends us the total per day. We use it to understand how Lumi is used and to improve it (Art. 6 (1)(f) GDPR). Nothing is stored on your device for this.

Ads. The free plan may show ads and offers from us or our partners on the start screen. They are not selected using your personal data, and no ad network receives data about you; we only count how often an ad was shown and clicked, without linking this to you. Clicking an ad opens the advertiser's website, where their privacy policy applies.

Payments. Paid plans are sold through our online reseller Paddle.com Market Limited (“Paddle”), which acts as Merchant of Record. Paddle processes your payment and billing data (e.g. name, email, address, payment method, VAT ID) as an independent controller; see Paddle's privacy policy. We receive from Paddle the information needed to manage your subscription, such as customer and subscription IDs, plan, status, country, amounts and invoice references (Art. 6 (1)(b) GDPR).

Teams. Where teams are offered and you join one, the team's owner and admins can see your name, email address, role and when you joined. They cannot see your conversations.

We send emails that are necessary for your account and the service (verification codes, password resets, security notices, invitations you ask us to send, and important changes to the service or these documents). We do not send newsletters or marketing emails without your separate consent.

We only share personal data where this is necessary for the purposes above. We use carefully selected service providers who process data on our behalf under data processing agreements (Art. 28 GDPR):

• Cloudflare, Inc., 101 Townsend St, San Francisco, CA 94107, USA - hosting and delivery of the website and app, network security and bot protection (Turnstile), AI processing (Workers AI) and encrypted storage of conversations (R2, EU region).
• Contabo GmbH, Munich, Germany - servers for our application interface (API) and our email server, in data centres in the European Union.
• netcup GmbH, Karlsruhe, Germany - the server for our database (accounts, settings, conversation index, usage), in a data centre in Nuremberg, Germany.
• Google Ireland Limited, Dublin, Ireland - Google Analytics and Google Tag Manager, only with your consent (section 6).

Independent recipients: Paddle.com Market Limited, London, United Kingdom (payments, section 14) and Google Ireland Limited (only if you use Sign in with Google, section 10). Weather and place providers (section 13) and the Pwned Passwords service (section 9) receive only the requests described there. We disclose data to authorities only where we are legally obliged to do so.

Some providers are located in or may process data in countries outside the European Economic Area. Transfers to the USA (Cloudflare, Google) are based on the European Commission's adequacy decision for the EU-U.S. Data Privacy Framework (Art. 45 GDPR) where the recipient is certified, and otherwise on the EU Standard Contractual Clauses (Art. 46 (2)(c) GDPR). Transfers to the United Kingdom (Paddle, OpenStreetMap Foundation) are based on the European Commission's adequacy decision for the United Kingdom (Art. 45 GDPR).

• Account and profile data: for as long as your account exists. When you delete your account, we delete this data, unless statutory retention applies.
• Conversations: until you delete them or your account. Depending on your plan, we may also delete them automatically: on the free plan 30 days after their last message, on Lumi Pro one year after it; on Lumi Max they are kept until you delete them (see Settings → Usage). Private chats are deleted when you leave them. Deleted conversations are removed from active storage immediately and from backups within 30 days.
• Sign-in sessions: until you sign out, or after one year without use.
• Time in Lumi: the totals per day for up to 400 days; the overall total for as long as your account exists.
• Invitations: as long as the inviting account exists (so rewards can be checked), or until the invited person asks us to delete their address.
• Analytics data (Google Analytics): 14 months at the most.
• Server logs: no more than 30 days (see section 4).
• Contact enquiries: until your enquiry has been fully handled.
• Billing records: invoices and accounting records are kept for the statutory periods of 6 or 10 years (§ 257 German Commercial Code, HGB; § 147 German Fiscal Code, AO).

You have the right to:

• access your personal data (Art. 15 GDPR);
• rectification of inaccurate data (Art. 16 GDPR);
• erasure (Art. 17 GDPR);
• restriction of processing (Art. 18 GDPR);
• data portability (Art. 20 GDPR);
• withdraw any consent you have given at any time, with effect for the future (Art. 7 (3) GDPR) - for analytics via “Cookie settings”.

Many rights can be exercised directly in Lumi: Settings → Privacy lets you export all your data, delete your chats and change your cookie choice, and Settings → Account lets you delete your account. For anything else, write to [email protected].

You have the right to lodge a complaint with a data protection supervisory authority (Art. 77 GDPR), in particular in the Member State of your habitual residence, place of work or the place of the alleged infringement. The authority responsible for us is:

We protect your data with appropriate technical and organisational measures, including TLS encryption for all connections, encryption of conversations at rest, salted password hashing, optional two-factor authentication, strict access controls for our staff and audit logging of administrative actions.

You are not legally obliged to provide personal data. However, we need your email address, your name and a password (or a Google sign-in) to create an account; without them you cannot use the Lumi app. Profile details, custom instructions and your location are optional.

Lumi is not directed at children. You must be at least 16 years old to use Lumi, or have the consent of a parent or legal guardian. We do not knowingly process data of children under 13; if we learn that we have, we delete it.

We update this privacy policy when our services or the law change. The current version is always available at orbitlumi.com/privacy. If changes significantly affect how we use data you have already provided, we will inform you in the app or by email.