Privacy Policy

• We process personal data only to run Lumi, keep it secure and meet legal obligations. We never sell your data.
• Your conversations are stored encrypted at rest. Our staff do not browse them.
• Your chats are used to improve Lumi only if you allow it via the “Help improve Lumi” setting.
• We use no advertising cookies. Google Analytics runs only if you agree in our cookie notice - you can change your choice at any time.
• Fonts are served from our own servers; your browser does not connect to Google Fonts.
• You can export or delete your data yourself at any time in Lumi's Settings.

The controller within the meaning of the General Data Protection Regulation (GDPR) is:

For all questions about data protection and to exercise your rights, please contact us at [email protected] or by post at the address above (“Data protection”).

We process personal data on the following legal bases:

• Art. 6 (1)(a) GDPR - your consent (e.g. Google Analytics, the “Help improve Lumi” setting). You can withdraw consent at any time with effect for the future (Art. 7 (3) GDPR).
• Art. 6 (1)(b) GDPR - performance of a contract with you or pre-contractual steps (e.g. your Lumi account, answering your messages).
• Art. 6 (1)(c) GDPR - legal obligations (e.g. tax and commercial retention duties).
• Art. 6 (1)(f) GDPR - our legitimate interests (e.g. secure and stable operation, abuse prevention, sending invitations you ask us to send), provided your interests do not override them.

Storing information on your device or reading it from there is based on § 25 (2) No. 2 Telekommunikation-Digitale-Dienste-Datenschutz-Gesetz (TDDDG) where it is strictly necessary for the service you requested, and otherwise on your consent (§ 25 (1) TDDDG).

When you visit orbitlumi.com or app.orbitlumi.com, your browser automatically transmits data that is stored in server log files: IP address, date and time of the request, the page requested, referrer URL, browser type and version, operating system, HTTP status code and amount of data transferred.

We process this data to deliver the website and app, ensure their stability and security, and defend against attacks (Art. 6 (1)(f) GDPR). Log data is deleted or anonymised after no more than 30 days, unless a longer retention is required to investigate a specific security incident.

The website and the app are hosted and delivered via the network of Cloudflare (see section 16). Fonts, images and scripts of the website and the app are served from our own servers; no connection to Google Fonts or other font services is made.

When you first visit, we ask in a cookie notice whether you agree to analytics. Your answer applies to orbitlumi.com and app.orbitlumi.com together.

Strictly necessary (always active, § 25 (2) No. 2 TDDDG):

• Sign-in session in the Lumi app: a secure, http-only cookie that keeps you signed in, plus your in-app settings stored locally (e.g. theme, background, widgets, units, to-dos and notes).
• Your cookie choice: a cookie (lumi_consent, 12 months) that remembers your answer to the cookie notice - shared by orbitlumi.com and app.orbitlumi.com, so you're only asked once.
• A random device identifier in the app's local storage, used to protect accounts and invitations against misuse (see section 9).
• Security cookies that Cloudflare may set to protect our services against bots and attacks.

Analytics - only with your consent (§ 25 (1) TDDDG): Google Analytics cookies (_ga, _ga_<ID>, up to 2 years), see section 6.

You can change your choice at any time: “Cookie settings” at the bottom of the website, or Settings → Privacy in the app. If you withdraw your consent, we remove the analytics cookies. You can also delete stored data via your browser settings; you may then have to sign in again.

If you agree in our cookie notice, we use Google Analytics 4 - where applicable loaded via Google Tag Manager - services of Google Ireland Limited, Gordon House, Barrow Street, Dublin 4, Ireland (“Google”), to understand how our website and app are used and to improve them. Without your consent, neither is loaded.

What is processed: an identifier stored in a cookie that recognises your browser, the pages and screens you view, time spent, the website you came from, your device type, operating system, browser and screen size, and your approximate location (country, region, city) derived from your IP address. Google Analytics does not log or store IP addresses of users in the EU. We do not send your name, email address or the content of your conversations to Google. Google Signals and advertising features are switched off.

Legal basis: your consent (Art. 6 (1)(a) GDPR, § 25 (1) TDDDG), which you can withdraw at any time with effect for the future via “Cookie settings”.

Recipient and transfer: Google processes the data on our behalf (Art. 28 GDPR). The data may also be processed by Google LLC in the USA; Google LLC is certified under the EU-U.S. Data Privacy Framework (Art. 45 GDPR). Analytics data is deleted after 14 months at the latest. More: Google's privacy policy and Google's data processing terms.

To protect our contact form, sign-up and sign-in against spam and automated abuse, we use Cloudflare Turnstile. Turnstile checks whether a request comes from a human by evaluating technical information such as your IP address and browser characteristics. The legal basis is our legitimate interest in protecting our services (Art. 6 (1)(f) GDPR) and § 25 (2) No. 2 TDDDG.

If you contact us via the form or by email, we process your name, email address, subject, message and the time of your request to handle your enquiry (Art. 6 (1)(b) GDPR where it relates to a contract, otherwise Art. 6 (1)(f) GDPR). We delete this data once your enquiry has been fully handled, unless statutory retention obligations apply.

To use Lumi you create an account. We process:

• Account data: email address, first and last name, password (stored only as a salted hash), email verification status, plan.
• Your age: the age you choose when signing up or in Settings (with the date it was given, so it can count up over the years) and, if you are under 16, the time you confirmed that a parent or legal guardian agrees to your use of Lumi (see section 23).
• Optional profile data: what Lumi should call you, your line of work, custom instructions, and your preferences (e.g. theme, chat font, default model).
• Security data: sign-in sessions (device, browser, operating system, IP address, last activity), the country of your last sign-in (derived from your IP address by Cloudflare), two-factor authentication settings, failed sign-in attempts, and a hash of the random device identifier and of the network (IP range) you use Lumi from.

We process this data to provide your account and the Lumi service (Art. 6 (1)(b) GDPR) and to protect your account and our invitation rewards against misuse (Art. 6 (1)(f) GDPR). We send you service emails, such as verification codes, password resets and security notices.

Your age. We use your age to adapt Lumi's answers to you and, for users under 18, to apply additional safety rules (Art. 6 (1)(b) GDPR, and Art. 6 (1)(f) GDPR - our interest in protecting minors). We keep the record of a parent's or guardian's agreement so that we can demonstrate it (Art. 6 (1)(c) and (f) GDPR, Art. 8 GDPR). Your age is not used for advertising.

Password check. When you choose a password, we check whether it has appeared in known data breaches using the Pwned Passwords service (haveibeenpwned.com). Only the first five characters of a hash of the password are sent, which does not reveal the password and does not identify you (Art. 6 (1)(f) GDPR).

You can optionally sign in with your Google account. Google Ireland Limited, Gordon House, Barrow Street, Dublin 4, Ireland then transmits your name, email address and profile picture to us. We use this data only to create and sign in to your account (Art. 6 (1)(b) GDPR). Google's sign-in script is only loaded when you open the sign-in or sign-up form. Google may process data in the USA; see Google's privacy policy.

What we process. The messages you send to Lumi and the answers Lumi generates (“conversations”), together with metadata such as the title, timestamps, the Lumi tier and message counts. To personalise answers, your custom instructions, the name you chose and your age are added to your requests.

Purpose and legal basis. We process conversations to generate answers, show you your chat history and provide features such as search, export and regeneration (Art. 6 (1)(b) GDPR).

How answers are generated. Your messages are processed by the AI infrastructure of Cloudflare, Inc. (Workers AI), which acts as our processor under a data processing agreement and processes the content only on our instructions to generate the answer. Titles for your chats are generated the same way.

Storage and encryption. Conversation contents are stored in Cloudflare R2 object storage in the EU, encrypted at rest with keys managed by us. Our database only holds an index (e.g. title, timestamps, counts), not the message texts. Our staff do not browse conversations. They only see a message excerpt if you report it to us, or where we are legally required to disclose data.

Private chats. A private chat does not appear in your history and is deleted as soon as you leave it.

Help improve Lumi. If you turn on the “Help improve Lumi” setting, we may use de-identified excerpts of your conversations to evaluate and improve the quality and safety of Lumi (Art. 6 (1)(a) GDPR). You can switch this off at any time in Settings → Privacy.

Talking to Lumi out loud. On the start screen you can talk to Lumi in a little field. If you tap the microphone, your browser asks for your permission first - nothing is ever recorded without that tap, and your browser shows while the microphone is on. The few seconds you record are sent through our server to the AI infrastructure of Cloudflare (Workers AI), which turns them into text as our processor and on our instructions; Lumi's spoken answers are generated the same way. Recordings are not stored: they are used for the transcript and then dropped, and this little chat is never saved to your account (Art. 6 (1)(b) GDPR). Whether Lumi speaks at all, and whether he does so for children without being asked, is set by us and can be switched off.

Talking to Lumi beside his orb. The little chat next to Lumi on the start screen is not stored anywhere: it lives in the page you have open, is sent to the AI infrastructure of Cloudflare (Workers AI) as our processor so that Lumi can answer, and is gone the moment you close the app or reload the page - including the comic view of it. What is on your screen at that moment (what your weather card shows, which cards you have switched on, which plan is picked) is sent with your message so that Lumi can answer questions about it instead of guessing; it is used for that answer and not stored either (Art. 6 (1)(b) GDPR).

What Lumi remembers from that little chat. So that Lumi can pick a conversation up again ("how did it go with your test?"), he may keep a few very short notes about you from that chat - for example that a friend upset you, or that something is coming up this week. The notes are written by the AI on the same answer it is already giving, they are kept with your account, they are deleted automatically after 30 days, and there are never more than a few dozen of them (Art. 6 (1)(b) GDPR - the companion you asked for only works if he can remember a little, so that talking to him feels like talking to someone who knows you). He is instructed never to note passwords, addresses, payment details, health or beliefs. The notes are part of your data export, you can have them deleted at any time by writing to [email protected], and they are deleted with your account. We can switch this off entirely, or for individual plans.

Safety. We may use automated checks to detect and prevent abusive or illegal use of Lumi (Art. 6 (1)(f) GDPR).

No automated decisions. We do not make decisions based solely on automated processing that produce legal effects concerning you or similarly significantly affect you (Art. 22 GDPR).

AI-generated content. Answers in Lumi are generated by artificial intelligence and are marked as coming from Lumi. They can be inaccurate - please check important information.

If you invite someone. When you invite a friend by email, we process the email address you enter and, if you add one, your personal message, to send a single invitation email in your name and to show you whether the invitation was accepted (Art. 6 (1)(f) GDPR - your interest and ours in inviting people you know). Please only invite people who are happy to hear from you. If you share your personal invite link instead, we don't learn anything about the people you send it to until they sign up.

If you were invited. We received your email address from the person who invited you (Art. 14 GDPR). We use it only to send you that one invitation - and, if you sign up, to credit the person who invited you. You can object to this at any time or ask us to delete your address by writing to [email protected]; we will not contact you again.

Rewards and fairness. To check whether an invitation counts, we compare the (hashed) device identifier and network of the new account with those of the person who invited them (Art. 6 (1)(f) GDPR - preventing self-invitations and fake accounts). The inviter only sees the friend's first name and the initial of their last name (link invitations) or the address they entered (email invitations), and whether the invitation counted.

The weather widget in the app shows the weather for your location or for cities you add. Your browser only shares your location if you allow it. We round the coordinates to about 1 km and send them, or the name of the city you search for, from our server to our weather and place providers: the Norwegian Meteorological Institute (MET Norway, Oslo, Norway) for forecasts, and OpenStreetMap Nominatim (OpenStreetMap Foundation, Cambridge, United Kingdom) and Photon (komoot GmbH, Potsdam, Germany) for place names. These providers receive the request from our server, not your IP address. The last location, your saved cities and the last forecast are stored in your browser only. The legal basis is Art. 6 (1)(b) GDPR (the feature you use).

When you tilt or shake your phone, the app reads its motion sensors to animate the weather and Lumi. This data never leaves your device.

Usage. We count how many messages you send per day and on which plan, to apply plan limits, prevent abuse and plan capacity (Art. 6 (1)(b) and (f) GDPR).

Time in Lumi. While you're signed in, the app measures how long you actively use Lumi - only while it is open on your screen and in use - and sends us the total per day. We use it to understand how Lumi is used and to improve it (Art. 6 (1)(f) GDPR). Nothing is stored on your device for this.

Ads. The free plan may show ads and offers from us or our partners on the start screen. They are not selected using your personal data, and no ad network receives data about you; we only count how often an ad was shown and clicked, without linking this to you. So the same ad doesn't come back too often, the app remembers on your device how often you have seen each ad and which you clicked - this stays on your device. Clicking an ad opens the advertiser's website, where their privacy policy applies.

Payments. Paid plans are sold through our online reseller Paddle.com Market Limited (“Paddle”), which acts as Merchant of Record. Paddle processes your payment and billing data (e.g. name, email, address, payment method, VAT ID) as an independent controller; see Paddle's privacy policy. We receive from Paddle the information needed to manage your subscription, such as customer and subscription IDs, plan, status, country, amounts and invoice references (Art. 6 (1)(b) GDPR).

Teams. Where teams are offered and you join one, the team's owner and admins can see your name, email address, role and when you joined. They cannot see your conversations.

We send emails that are necessary for your account and the service (verification codes, password resets, security notices, invitations you ask us to send, and important changes to the service or these documents). We do not send newsletters or marketing emails without your separate consent.

We only share personal data where this is necessary for the purposes above. We use carefully selected service providers who process data on our behalf under data processing agreements (Art. 28 GDPR):

• Cloudflare, Inc., 101 Townsend St, San Francisco, CA 94107, USA - hosting and delivery of the website and app, network security and bot protection (Turnstile), AI processing (Workers AI) and encrypted storage of conversations (R2, EU region).
• Contabo GmbH, Munich, Germany - servers for our application interface (API) and our email server, in data centres in the European Union.
• netcup GmbH, Karlsruhe, Germany - the server for our database (accounts, settings, conversation index, usage), in a data centre in Nuremberg, Germany.
• Google Ireland Limited, Dublin, Ireland - Google Analytics and Google Tag Manager, only with your consent (section 6).

Independent recipients: Paddle.com Market Limited, London, United Kingdom (payments, section 14) and Google Ireland Limited (only if you use Sign in with Google, section 10). Weather and place providers (section 13) and the Pwned Passwords service (section 9) receive only the requests described there. We disclose data to authorities only where we are legally obliged to do so.

Some providers are located in or may process data in countries outside the European Economic Area. Transfers to the USA (Cloudflare, Google) are based on the European Commission's adequacy decision for the EU-U.S. Data Privacy Framework (Art. 45 GDPR) where the recipient is certified, and otherwise on the EU Standard Contractual Clauses (Art. 46 (2)(c) GDPR). Transfers to the United Kingdom (Paddle, OpenStreetMap Foundation) are based on the European Commission's adequacy decision for the United Kingdom (Art. 45 GDPR).

• Account and profile data: for as long as your account exists. When you delete your account, we delete this data, unless statutory retention applies.
• Conversations: until you delete them or your account. Depending on your plan, we may also delete them automatically: on the free plan 30 days after their last message, on Lumi Pro one year after it; on Lumi Max they are kept until you delete them (see Settings → Usage). Private chats are deleted when you leave them. Deleted conversations are removed from active storage immediately and from backups within 30 days.
• Sign-in sessions: until you sign out, or after one year without use.
• Time in Lumi: the totals per day for up to 400 days; the overall total for as long as your account exists.
• Invitations: as long as the inviting account exists (so rewards can be checked), or until the invited person asks us to delete their address.
• Analytics data (Google Analytics): 14 months at the most.
• Server logs: no more than 30 days (see section 4).
• Contact enquiries: until your enquiry has been fully handled.
• Billing records: invoices and accounting records are kept for the statutory periods of 6 or 10 years (§ 257 German Commercial Code, HGB; § 147 German Fiscal Code, AO).

You have the right to:

• access your personal data (Art. 15 GDPR);
• rectification of inaccurate data (Art. 16 GDPR);
• erasure (Art. 17 GDPR);
• restriction of processing (Art. 18 GDPR);
• data portability (Art. 20 GDPR);
• withdraw any consent you have given at any time, with effect for the future (Art. 7 (3) GDPR) - for analytics via “Cookie settings”.

Many rights can be exercised directly in Lumi: Settings → Privacy lets you export all your data, delete your chats and change your cookie choice, and Settings → Account lets you delete your account. For anything else, write to [email protected].

You have the right to lodge a complaint with a data protection supervisory authority (Art. 77 GDPR), in particular in the Member State of your habitual residence, place of work or the place of the alleged infringement. The authority responsible for us is:

We protect your data with appropriate technical and organisational measures, including TLS encryption for all connections, encryption of conversations at rest, salted password hashing, optional two-factor authentication, strict access controls for our staff and audit logging of administrative actions.

You are not legally obliged to provide personal data. However, we need your email address, your name and a password (or a Google sign-in) to create an account; without them you cannot use the Lumi app. We ask for your age when you sign up so that Lumi can answer in a way that suits you; you can change it at any time in Settings. Other profile details, custom instructions, your location and the microphone are optional - Lumi works without them.

Lumi can be used by children and teenagers from the age of 5. Anyone under 16 may only use Lumi with the consent of a parent or legal guardian (Art. 8 GDPR). When signing up with - or later entering - an age under 16, the user confirms that this consent has been given, and we store the time of this confirmation. For children under 7, a parent or legal guardian should create the account for them. We may ask for proof of consent and delete accounts for which it was not given.

How we use the age. We use a user's age only to adapt Lumi's answers - for example simpler words and explanations for younger users - and, for users under 18, to apply stricter safety rules: no sexual or graphically violent content, no help with dangerous or illegal activities, no requests for personal details, and a reminder to talk to a parent, teacher or another trusted adult about serious problems. The age is never used to select ads; ads on the free plan are not selected using personal data (section 14).

Parents and guardians can exercise the rights described in section 19 on behalf of their child - including access to, correction and deletion of the child's data and deletion of the account - by writing to [email protected].

Even with these safeguards, AI answers can be wrong or unsuitable. We recommend that parents accompany younger children when they use Lumi.

We update this privacy policy when our services or the law change. The current version is always available at orbitlumi.com/privacy. If changes significantly affect how we use data you have already provided, we will inform you in the app or by email.