PRIVACY
POLICY

What is LUMENIRO

LUMENIRO ("we", "us", "our") is a productivity software application that helps individuals capture thoughts, organise ideas, track personal goals, and engage in Socratic reasoning through an AI conversation interface. LUMEN is categorised as a personal productivity and knowledge management tool — in the same category as note-taking apps, task managers, and journaling tools.

LUMENIRO is operated by its founder and is subject to Canadian federal privacy law (PIPEDA — the Personal Information Protection and Electronic Documents Act) and applicable provincial privacy legislation.

Information We Collect

Information you provide directly

• Account registration data: your name (optional) and email address
• Conversation content: text messages you send to LUMENIRO
• Voice recordings: audio you record using the voice input feature (transcribed and not stored as raw audio beyond the session)
• Journal entries: structured thought captures you create
• Goals and tasks you set within the app

Information generated automatically

• Session data: timestamps, session counts, last-seen dates
• Mood signals: emotional tone inferred from your messages used solely to personalise your experience and show you your own trends — not shared or sold
• Idea graph nodes and edges: conceptual relationships extracted from conversations to build your personal idea map

Information we do NOT collect

• We do not collect payment information (no billing at this time)
• We do not use advertising tracking, third-party analytics pixels, or cookies for marketing
• We do not collect health or medical information — mood data is a productivity metric, not a clinical measure

How We Use Your Information

Under PIPEDA, we only use personal information for the purposes identified at collection. Your data is used exclusively to:

• Operate and deliver the LUMENIRO service to you
• Provide AI-powered responses personalised to your conversation history
• Generate your weekly digest, idea graph, and dashboard
• Authenticate your account and keep your data secure
• Improve the service (only in aggregate, anonymised form — never your individual data)

We will never use your conversation content to train AI models without your explicit, separate consent. We will never sell your data. Ever.

Third-Party Services

LUMENIRO uses the following third-party services to operate. Each receives only the minimum data necessary:

OpenAI (openai.com)

Your messages are sent to OpenAI's API to generate AI responses. OpenAI processes this data under their API data usage policies. As of the date of this policy, OpenAI does not use API data to train models by default. Review OpenAI's privacy policy at openai.com/policies/privacy-policy.

Supabase (supabase.com)

Your account data, conversation memories, goals, tasks, and journal entries are stored in a Supabase-hosted Postgres database. Supabase is SOC 2 Type II certified. Data is stored on servers located in the United States. Review Supabase's privacy policy at supabase.com/privacy.

Render (render.com)

LUMENIRO's server application is hosted on Render. Render processes requests but does not store your personal data. Review Render's privacy policy at render.com/privacy.

Data Retention

We retain your personal information for as long as your account is active. You may request deletion of your account and all associated data at any time by emailing us (see contact below). We will action deletion requests within 30 days.

Voice audio files are deleted immediately after transcription — they are never stored.

Your Rights Under PIPEDA

As a user, you have the right to:

• Access — request a copy of all personal information we hold about you
• Correction — request that inaccurate information be corrected
• Deletion — request that your account and all data be permanently deleted
• Withdrawal of consent — withdraw consent at any time, which will result in account closure
• Challenge compliance — file a complaint with the Office of the Privacy Commissioner of Canada (priv.gc.ca) if you believe your rights have been violated

Data Security

We implement appropriate technical and organisational safeguards including:

• Row Level Security (RLS) at the database level — your data is isolated from all other users at the database layer
• HTTPS encryption for all data in transit
• Supabase authentication with secure httpOnly cookies
• No raw passwords stored — authentication is handled by Supabase Auth

Children's Privacy

LUMENIRO is not intended for users under the age of 13. We do not knowingly collect personal information from children. If you believe a child has created an account, contact us immediately and we will delete it.

Cross-Border Data Transfers

Your data is stored and processed in the United States (Supabase, OpenAI, Render). By using LUMEN, you consent to this transfer. We ensure appropriate contractual protections are in place with all third-party processors as required by PIPEDA.

Changes to This Policy

We may update this Privacy Policy from time to time. We will notify you of material changes by email or by a prominent notice within the app at least 14 days before changes take effect. Continued use after the effective date constitutes acceptance.