Lumous Privacy Policy

Last Updated: September 12th, 2026

Your privacy is important to us. This Privacy Policy explains what information Lumous (“we,” “us,” or “our”) collects, how we use it, who we share it with, and what measures we take to protect it. By using our website (lumous.app) and software (“Software”), you agree to the practices described in this policy.

1. Information We Collect

We collect the following categories of information:

a) Information You Provide Directly

Contact form submissions: When you use our contact form, we collect your name, email address, subscription status, contact reason, and message content.
Payment information: When you subscribe, we collect your name and email address. All payment card details are processed and stored exclusively by our payment processor, Stripe. We never see or store your full card number.
Account information: Upon subscribing, we store your name, email address, Stripe customer ID, and subscription ID to manage your license.

b) Information Collected Automatically

Device and license data: When you activate and use the Lumous Software, we collect a device identifier, install identifier, and license-validation timestamps. We use this data to manage access, enforce single-device licensing, and provide support.
Billing protection: We use protected representations of billing-identity signals, such as a normalized email address and a payment-method fingerprint when available, to manage trials and prevent billing abuse. We do not store your full card number.
Product usage and technical diagnostics: The Software sends limited product usage information, app and device details, and sanitized technical errors. This information is associated with a pseudonymous installation and may be linked to its license when needed for support.
Website analytics data: We use Google Analytics (GA4) to collect page URLs, referrers, interaction events, browser and operating-system information, approximate region, and pseudonymous analytics identifiers. Google may process IP addresses to provide and secure the service. When a website analytics identifier is available, we also associate confirmed trial starts, the first automation start, and payments with the source and landing page that brought you to Lumous. These events do not include your email address, license key or payment-card details.
Cookies and local storage: Google Analytics and administrative functions may use cookies or similar storage. We also preserve campaign parameters during a browsing session and the first observed source and landing page for up to 30 days. A browser analytics identifier may be linked to a checkout in our database for up to 90 days. You can restrict storage through your browser and provider controls.

c) Information We Do Not Collect

The Lumous Software does not monitor, record, or transmit your screen or typed content, browsing activity, files or clipboard, application or window names, precise location, or detailed individual keyboard, mouse, or click activity. We do not upload raw logs or use session replay.
We do not collect biometric data, social security numbers, or government-issued identification.

2. How We Use Your Information

We use the information we collect for the following purposes:

Providing and managing the Service: To create and manage your subscription, issue license keys, deliver software updates, and enforce license terms (such as single-device usage).
Communication: To respond to your contact form inquiries, send transactional emails (e.g., license keys, subscription confirmations), and provide customer support.
Improving our website: To analyze aggregated analytics reports and pseudonymous usage events to understand how visitors use our site and to improve performance, content, and user experience.
Maintaining and improving the Software: To maintain compatibility, improve reliability, understand how product features are used, and help resolve technical issues.
Payment processing: To facilitate recurring subscription billing through Stripe.
Legal compliance: To comply with applicable laws, regulations, or legal processes.

3. How We Share Your Information

We do not sell, rent, or trade your personal information. We share the categories of data described below with the following providers for payments, support, analytics, testimonials, hosting, delivery, and security:

Stripe (payment processing): Receives your name, email, and payment details to process subscription payments. Stripe’s privacy policy is available at stripe.com/privacy.
Formspree (contact form processing): Receives your name, email, and message when you submit our contact form. Formspree’s privacy policy is available at formspree.io/legal/privacy-policy.
Google Analytics (website analytics): Receives pseudonymous identifiers and usage, device, referrer, page, and approximate-location data about website visits, plus the confirmed trial, first-use and payment events described above. Google’s privacy policy is available at policies.google.com/privacy.
Testimonial.to (customer testimonial display): Hosts the testimonial wall embedded on our homepage and may receive standard request data such as IP address, browser information, and referring page when the wall loads. Its privacy policy is available at testimonial.to/privacy.
Cloudflare (content delivery, security, and traffic insights): May process IP addresses, request headers, device information, and security events when delivering or protecting our web properties and media. Cloudflare’s privacy policy is available at cloudflare.com/privacypolicy.
Vercel (website hosting): Our website is hosted on Vercel. Vercel may process server logs that include IP addresses. Vercel’s privacy policy is available at vercel.com/legal/privacy-policy.
Heroku (API and database hosting): Hosts the Lumous API and its first-party license and product telemetry data. Heroku may process standard request and infrastructure data while providing these services. Its privacy policy is available at salesforce.com/company/privacy.
Law enforcement or legal authorities: We may disclose information if required by law, subpoena, court order, or other legal process, or if we believe disclosure is necessary to protect our rights or the safety of others.

4. Method of Disclosure

Data sent to third-party providers is transmitted using HTTPS. We configure each integration to send the fields described in this policy for its stated function:

Payment data is transmitted directly from your browser to Stripe’s servers and is never stored on our infrastructure.
Contact form data is transmitted from your browser to Formspree’s API endpoint.
Website analytics is sent from your browser to Google. Confirmed trial, first-use and payment events may be sent from our server using the website analytics identifier captured at checkout.
Testimonials and media are requested from their hosting providers only when the relevant content loads.
License, device, and desktop telemetry data is transmitted over HTTPS to our API server. Desktop telemetry is stored in our first-party database. Only the first automation-start outcome may be shared with Google Analytics for acquisition measurement; detailed desktop events and diagnostics remain in our database.

5. Data Retention

Account and license data: Retained for the duration of your subscription and for a reasonable period after cancellation to handle disputes or reactivation.
Contact form submissions: Retained only as long as necessary to respond to and resolve your inquiry.
Analytics data: Retained by Google according to our configured settings and its applicable retention policies.
Desktop telemetry: Raw product-usage and diagnostic events and the recorded first-use outcome are retained for up to 90 days. Latest support snapshots for inactive licenses or revoked installations are removed after 90 days without a report. Statistics that can no longer be linked to a customer, license, or installation may be retained longer.
Payment records: Retained by Stripe in accordance with their data retention policies and applicable financial regulations.

6. Security Practices

We take the security of your information seriously and implement the following measures to safeguard it:

Encryption in transit: All data transmitted between your browser and our servers, and between our servers and third-party providers, is encrypted using TLS/HTTPS.
Secure payment handling: We never store, process, or have access to your full payment card details. All payment processing is handled by Stripe, which is PCI DSS Level 1 certified.
Access controls: Administrative access to our backend systems is protected by authentication and restricted to authorized personnel only.
Data minimization: We limit collection and integration configuration to the categories described in this policy and do not collect screen contents, keystroke contents, browsing activity, files, or personal device content through the Lumous Software.
Secure hosting: Our website is hosted on Vercel, and our API infrastructure uses industry-standard security practices.

While we strive to protect your personal information, no method of transmission over the internet or electronic storage is 100% secure. We cannot guarantee absolute security.

7. Your Rights

Depending on your jurisdiction, you may have the following rights regarding your personal information:

Access: You may request a copy of the personal data we hold about you.
Correction: You may request that we correct inaccurate or incomplete data.
Deletion: You may request that we delete your personal data, subject to legal or contractual retention requirements.
Desktop telemetry requests: You may request access, object to future collection, or request deletion. After verifying the relevant account, we suppress future collection and delete identifiable telemetry. This does not change your license or product access. De-identified aggregate statistics may remain.
Opt out of analytics: You can use the Google Analytics Opt-out Browser Add-on, browser cookie settings, or supported privacy extensions. Blocking analytics does not prevent you from reading the site.

To exercise any of these rights, please contact us at [email protected].

8. Children’s Privacy

Lumous is not intended for use by individuals under the age of 18. We do not knowingly collect personal information from children. If we become aware that we have collected data from a minor, we will take steps to delete it promptly.

9. Third-Party Links

Our website may contain links to third-party websites (e.g., Stripe billing portal, social media profiles). We are not responsible for the privacy practices or content of these external sites. We encourage you to review their privacy policies before providing any personal information.

10. Changes to This Privacy Policy

We reserve the right to update this Privacy Policy at any time. When we do, we will revise the “Last Updated” date at the top of this page. Continued use of our website or Software after changes are posted constitutes your acceptance of the revised policy.

11. Governing Law

This Privacy Policy is governed by the laws of Ontario, Canada.

12. Contact Us

If you have any questions or concerns about this Privacy Policy or our data practices, please contact us at [email protected].