Privacy Policy
This policy describes information processed when you use Lumkaro. Visitors to a website you create may also need a separate privacy notice from you.
1. Information we process
We process account information such as your email, sign-in and linked Google-account identifiers; project prompts, conversations, scopes, code and versions; build and hosting records; and billing identifiers, payment status and subscription details. Requests also expose technical information such as IP addresses and browser details to the systems that serve them. Support information you send is used to handle your request.
2. Why we use it
We use this information to authenticate you, save and build projects, publish and host sites, process payments, prevent abuse, investigate failures and provide support. Payment and operational records also help us reconcile costs and meet applicable obligations.
3. AI and service providers
OpenAI processes project prompts, conversations and scope to plan your site with Lumi. Anthropic (Claude) processes the approved scope and project source to generate code. Modal runs isolated build and test sandboxes with generated source. Railway hosts the app, databases, previews and published sites in the US and processes account, project and site data. Cloudflare provides DNS for lumkaro.com and lumkaro.app and receives hostnames for that purpose. Stripe processes billing and card information; card data does not reach Lumkaro. Resend processes email addresses and sign-in codes to deliver sign-in emails and operator alerts. Google processes your account identifier and email when you choose Google sign-in. Do not include passwords, payment-card numbers or sensitive personal information in prompts. Provider processing and retention depend on the services and settings in use; we do not promise zero retention or exclusion from training by every provider.
4. Cookies and browser storage
Authentication uses cookies, including cookies for Google sign-in. Local browser storage remembers preferences and project selection; session storage helps prevent duplicate checkout requests. Clearing storage can sign you out or reset these preferences. These cookies and browser storage support sign-in, preferences and checkout.
5. Published websites
Publishing makes the content of your site available to its visitors. Generated sites may collect their own customer or booking information. As the site owner, you are responsible for deciding what to collect and providing appropriate privacy information. Avoid publishing private information, secrets or content you lack permission to share.
6. Retention and security
Projects and accounts are kept until deletion is requested, subject to records that must be preserved for billing, security or legal reasons. Previews idle for 7 days are deleted along with their DNS records. Unpaid published sites go offline, but their databases are kept so they can be reactivated; stopping payment does not delete that data. Database backups are being implemented. We will update this policy with their retention and deletion details when available. Access controls and security measures reduce risk, but no internet service can guarantee absolute security.
7. Your choices and requests
You may ask to access, correct, export or delete your personal information, subject to identity verification and applicable exceptions. The owner handles privacy requests manually for now; automated account deletion and export are not yet available. Send privacy requests to support@lumkaro.com. You can choose email sign-in rather than linking Google.
8. International processing and updates
Providers may process information outside your country. Applicable rights and transfer requirements depend on where you are and the processing involved. Lumkaro is not intended for children under 18. We will update this notice when processing changes and provide additional notice where required.
9. WhatsApp messaging
Lumkaro sends WhatsApp messages through Meta's WhatsApp Business Platform. Sites can alert a business's team about new requests, and businesses can connect their own WhatsApp Business account to Lumkaro so we can send order, booking and request updates and reply to their customers on their behalf. For a connected account we process its business account and phone-number identifiers, approved message templates, message content and delivery status, and the phone numbers and names of the customers it messages. We use this only to send and receive that business's messages, manage its templates and report on delivery; we do not sell it or use it for our own marketing. Meta processes these messages under its own terms and privacy policy. A business can disconnect its account at any time in Meta Business Settings or by writing to support@lumkaro.com; we then stop accessing it and delete its stored message data within 30 days, except records we must keep for billing, security or legal reasons. The connected business is responsible for its customers' consent to receive messages.