Privacy Policy

1. Who we are

Emerald Pin Ltd, trading as Lumio360 ("Lumio360", "we", "us") operates the website at lumio360.com and the Lumio360 finance operations platform at app.lumio360.com (together, the "Service"). We are registered in England and Wales under company number 14326917. Our registered office is 71-75 Shelton Street, Covent Garden, London, WC2H 9JQ, United Kingdom.

This policy explains what personal data we collect, why we collect it, how we protect it, and the choices and rights you have. For questions, contact privacy@lumio360.com.

2. Our role: controller and processor

We are the controller for data about visitors to our website, people who request a demo, and the account details of people who sign in to the Service.

When a customer (for example, an accounting firm or a finance team) connects its accounting systems and uploads business records, we process that data on the customer's behalf as a processor, under our agreement with that customer. If your data is held in a customer's workspace, please direct requests to that customer first. We will help them respond.

3. Information we collect

• Account information: your name, email address, password (stored only as a secure hash), and multi-factor authentication settings.
• Information from Google: if you choose Sign in with Google, see section 4.
• Demo and contact requests: your name, work email, company, team size, any message you send, and the IP address the request came from (used to prevent spam).
• Business data you connect: financial and accounting records imported from services you authorise, such as Xero, QuickBooks, Stripe or Shopify, and documents you upload. This can include names and contact details of your customers, suppliers and staff as they appear in your records.
• Usage and security data: sign-in times, IP address, browser and device type, and an audit log of actions taken in the Service.

4. Information we receive from Google

If you choose Sign in with Google, Google shares the following with us, with your permission:

• your name
• your email address and whether Google has verified it
• your profile picture
• a unique Google account identifier

These come from the standard openid, email and profile scopes. We do not request access to your Gmail, Google Drive, Google Calendar, contacts, or any other Google data.

How we use it. We use this information only to create your Lumio360 account, sign you in, show your name and picture inside the Service, and contact you about your account. We do not use it for any other purpose.

How we store and protect it. It is stored in our production database, hosted on Google Cloud in the United Kingdom (London region), encrypted in transit and at rest, and accessible only to authorised staff who need it to run the Service. We do not use the sign-in tokens Google issues to access any other Google service.

How we share it. We do not sell Google user data or share it with third parties, except with the infrastructure providers listed in section 7 that host the Service on our behalf, or where the law requires it. We do not use Google user data for advertising, and we do not use it to develop, improve or train generalised artificial intelligence or machine learning models.

Retention and deletion. We keep this information for as long as your account is open. You can ask us to delete your account and your Google-derived data at any time by emailing privacy@lumio360.com. We will delete it within 30 days, except where we must keep limited records for legal or security reasons. You can also remove Lumio360's access at any time from your Google Account at myaccount.google.com/connections.

Limited Use. Lumio360's use and transfer to any other app of information received from Google APIs will adhere to the Google API Services User Data Policy, including the Limited Use requirements.

5. How we use your information

• to provide, operate and secure the Service, including signing you in and preventing fraud and abuse
• to process the business data you connect in order to deliver the features you use, such as reconciliation, consolidation and reporting
• to respond to demo requests, enquiries and support requests
• to send service messages, such as security alerts, verification codes and billing notices
• to meet our legal, tax and accounting obligations

We do not sell personal data, and we do not use customer business data for advertising.

6. Lumi AI

Some features use Lumi AI, which sends relevant parts of your workspace data to an AI model provider to generate a response. By default we use Anthropic under zero-data-retention terms, so your prompts and outputs are not stored by the provider or used to train its models. If your organisation chooses to connect its own AI provider account, data for those features is sent to that provider under your organisation's own agreement with it. To power search across your workspace, we also convert workspace text into numerical representations (embeddings) using Google Cloud's AI services. Google user data described in section 4 is never used to train AI models.

7. Who we share information with

We use the following service providers (sub-processors) to run the Service. Each may process personal data only on our instructions and under a written agreement.

• Google Cloud: application hosting, database and file storage (United Kingdom), and AI text processing for search features (United States)
• Cloudflare: website hosting, content delivery, security (including Turnstile bot checks on our forms) and encrypted backup storage (European Union)
• Upstash: short-lived caching and rate limiting
• Resend: sending transactional emails, such as verification codes and demo request notifications
• Anthropic: Lumi AI processing, under zero-data-retention terms

Where you connect a third-party service (such as Xero or QuickBooks), data moves between that service and Lumio360 as you direct, and that service's own privacy policy applies to it. We may also disclose information if required by law, or as part of a merger or sale of our business, subject to this policy.

8. International transfers

Our primary database is hosted in the United Kingdom. Some processing takes place outside the UK, including AI text processing in the United States and backup storage in the European Union. Where they do, we rely on a UK adequacy decision or on appropriate safeguards, such as the UK International Data Transfer Agreement or the UK Addendum to the EU Standard Contractual Clauses.

9. Security

We protect data with encryption in transit (TLS) and at rest, access controls that separate each organisation's data, multi-factor authentication, role-based access controls and audit logging. No system is completely secure. If a breach affects your personal data, we will notify you and the relevant regulator as the law requires.

10. How long we keep information

• Account data (including Google sign-in data): while your account is open, then deleted within 30 days of closure or of a deletion request.
• Customer business data: for the term of the customer's agreement, then deleted or returned as that agreement sets out.
• Demo requests: up to 24 months after our last contact with you, unless you become a customer.
• Billing and tax records: up to 6 years, as required by UK law.
• Security logs: up to 12 months.

11. Legal basis for processing (UK GDPR)

• Contract: to provide the Service you or your organisation signed up for, including sign-in.
• Legitimate interests: to secure the Service, prevent spam and fraud, respond to demo requests, and improve our product.
• Legal obligation: to keep tax and accounting records.
• Consent: where we ask for it, such as for optional marketing emails. You can withdraw consent at any time.

12. Cookies

We use only essential cookies that are needed to keep you signed in and to protect the Service. We do not use advertising cookies or third-party analytics cookies on lumio360.com or app.lumio360.com. If this changes, we will update this policy and ask for your consent where required.

13. Your rights

Under UK GDPR you have the right to access, correct, delete, restrict or port your personal data, and to object to certain processing. To exercise any right, email privacy@lumio360.com. We will reply within one month.

You also have the right to complain to the UK Information Commissioner's Office at ico.org.uk. We would appreciate the chance to resolve your concern first.

14. Children

The Service is for businesses and is not directed at anyone under 18. We do not knowingly collect data from children.

15. Changes to this policy

We will post any changes on this page and update the date above. If we make a material change, especially to how we use Google user data, we will tell you before it takes effect.

16. Contact

Questions about this policy or your data: privacy@lumio360.com
Post: Emerald Pin Ltd, 71-75 Shelton Street, Covent Garden, London, WC2H 9JQ, United Kingdom