Privacy Policy

1. Introduction

[COMPANY LEGAL NAME] (“Company”, “we”, “us”, or “our”), located at [REGISTERED ADDRESS], operates LumaForm AI (the “Service”). This Privacy Policy explains how we collect, use, disclose, and safeguard your information when you use the Service. Please read this policy carefully. If you disagree with its terms, please discontinue use of the Service.

2. Information We Collect

2.1 Information You Provide

• Account information: name, email address, and password when you register
• Company information: company name, industry, country, size, and other details you enter in your Business Profile profile
• Business content: business event descriptions, document requests, and any other content you submit to generate documents
• Business Memory: structured knowledge entries you create about your company's operations, HR practices, legal context, and preferences
• Payment information: processed by Stripe. We do not store your full card number. We receive billing details such as last four digits, card type, and billing address.

2.2 Information Collected Automatically

• Usage data: pages visited, features used, document generation history, and interaction timestamps
• Technical data: IP address, browser type, device type, and operating system
• Cookies and session data: used to authenticate your session and remember your preferences

3. How We Use Your Information

We use the information we collect to:

• Provide, operate, and improve the Service
• Generate AI-powered documents tailored to your company and jurisdiction
• Process payments and manage subscriptions
• Send transactional emails (account verification, password reset, receipts)
• Respond to your inquiries and provide customer support
• Monitor usage patterns to detect abuse and protect the Service
• Comply with legal obligations

We do not sell your personal information to third parties. We do not use your business content to train AI models without your explicit consent.

4. Sharing Your Information

We may share your information with:

• Service providers: Supabase (database and authentication), OpenAI (AI document generation), Stripe (payment processing). Each is bound by confidentiality obligations.
• Your organization members: within a shared team account, members of your organization may see shared documents, projects, and scenarios.
• Law enforcement: when required by law, court order, or to protect the rights and safety of our users or others.

We do not disclose your information to third parties for their independent marketing or advertising purposes.

5. Data Retention

We retain your account data and business content for as long as your account is active or as needed to provide the Service. If you delete your account, we will delete or anonymize your personal data within 30 days, except where retention is required by law (e.g., billing records).

6. Security

We implement industry-standard technical and organizational measures to protect your information, including encrypted database storage, row-level security, HTTPS in transit, and access controls. No method of transmission or storage is 100% secure. We cannot guarantee absolute security, but we are committed to protecting your data.

7. Cookies

We use cookies and similar tracking technologies to authenticate your session and maintain your preferences. You can configure your browser to refuse cookies, but some features of the Service may not function correctly without them.

8. Your Rights

Depending on your jurisdiction ([STATE/COUNTRY]), you may have the right to:

• Access the personal data we hold about you
• Correct inaccurate or incomplete data
• Request deletion of your personal data
• Object to or restrict certain processing activities
• Data portability (receive your data in a machine-readable format)
• Withdraw consent where processing is based on consent

To exercise any of these rights, contact us at [SUPPORT EMAIL]. We will respond within 30 days.

9. Children's Privacy

The Service is not intended for individuals under the age of 18. We do not knowingly collect personal data from children. If you believe we have inadvertently collected information from a child, please contact us at [SUPPORT EMAIL] and we will delete it promptly.

10. International Data Transfers

Your information may be transferred to and processed in countries other than your own. We take appropriate steps to ensure adequate protection for data transferred across borders, in accordance with applicable law.

11. Changes to This Policy

We may update this Privacy Policy from time to time. We will notify you of material changes by posting the updated policy on this page and updating the effective date. Continued use of the Service after changes constitutes acceptance of the updated policy.

12. Contact Us

If you have questions or concerns about this Privacy Policy or our data practices, please contact us: