Privacy Policy

Who we are

Lumi is the data controller for the personal data described in this policy. That means we decide what is collected and why, and we are accountable for it.

For any question about your data, or to exercise any of the rights set out below, write to support@trylumi.co. We answer data requests within one month, as UK GDPR requires.

What we collect

Account data. Your name, email address, authentication identifiers, and the subjects or exam boards you tell us you are studying. Sign-in is handled by Supabase Auth using Google or an emailed sign-in link. Lumi does not collect an account password.

Content you provide. The questions you ask, the conversations you have with Lumi, and any notes, PDFs or past papers you upload so you can return to them.

Billing data. If you subscribe, our payment processor handles your card details. We receive a record that a payment succeeded, the plan, and the billing period. We never see or store your full card number.

Technical data. IP address, browser and device type, and pages visited, collected to keep the service secure and working.

Why we collect it, and our lawful basis

To provide the service you asked for: creating your account, running lessons, storing your uploads. Lawful basis: performance of a contract.

To take payment and meet our accounting obligations. Lawful basis: performance of a contract, and legal obligation for financial records.

To keep the service secure, prevent abuse, and fix faults. Lawful basis: our legitimate interests in running a safe, working product.

To improve how Lumi explains things, using aggregated and de-identified signals such as whether an explanation was marked helpful. Lawful basis: legitimate interests. You can object to this at any time and we will exclude your activity.

What we do not do

We do not sell your personal data, and we never have.

We do not share your uploads or conversations with advertisers, and we do not run behavioural advertising.

We do not use the contents of your notes to build a profile of you for any purpose beyond delivering your own lessons.

Who we share it with

We use a small number of processors to run the service: hosting and infrastructure, a payment processor, an email provider, and the AI model providers that generate explanations. Each is bound by a contract that permits them to process your data only on our instructions.

Where a processor operates outside the UK, transfers are covered by the UK International Data Transfer Addendum or an adequacy decision.

We will disclose personal data if the law requires it, or to protect the safety of a user or the public. We would tell you unless we are legally prevented from doing so.

How long we keep it

Account data and your content are kept while your account is open. If you delete your account, we remove them from live systems immediately and from backups within thirty days.

Billing records are kept for six years, which UK tax law requires.

Security logs are kept for twelve months.

Young people

You must be 13 or over to hold a Lumi account. Most of our users are studying for A-Levels.

Where an account is created for a student by a school or college, that institution is the data controller for the student's data and our agreement with them governs how it is handled.

If you believe a child under 13 has created an account, tell us and we will delete it.

Your rights

You have the right to access a copy of your data, to correct it if it is wrong, to have it erased, to restrict or object to how we process it, and to receive it in a portable format. You can also withdraw consent where we relied on it.

You can export or delete your account and everything in it from your account settings, or by writing to us.

If you think we have handled your data badly, please tell us first so we can put it right. You also have the right to complain to the Information Commissioner's Office at ico.org.uk.

Cookies

We use cookies that are strictly necessary to keep you signed in and to keep the service secure. These do not require consent.

We do not use advertising or cross-site tracking cookies. If that ever changes, we will ask for your consent first.

Changes to this policy

If we make a change that materially affects how your data is handled, we will email you before it takes effect. The date at the top of this page always reflects the current version.