Legal Document

Privacy Policy

Company: Lumor Technologies Pvt. Ltd. · Effective: 16 April 2026 · Applies to: lumor.tech & app.lumor.tech

This Privacy Policy explains what personal data Lumor Technologies Pvt. Ltd. collects, why we collect it, how we use and protect it, and what rights you have. Please read it carefully before using our platform. If you have any questions, contact us at contact@lumor.tech.

01 · Who We Are

Lumor Technologies Pvt. Ltd. (“Lumor”, “we”, “us”, “our”) is a company incorporated under the Companies Act, 2013, with its registered office at:

38, 1st Floor, Aswini Layout, 2nd Main Rd, Viveknagar, Ejipura, Bengaluru, Karnataka – 560047

We operate an AI-powered user research platform accessible at lumor.tech (the “Website”) and app.lumor.tech (the “Platform”), and we are the data controller in respect of the personal data described in this Privacy Policy. For privacy-related enquiries, contact us at: contact@lumor.tech

02 · Scope of This Policy

This Privacy Policy applies to personal data collected when you:

• Visit or browse lumor.tech or app.lumor.tech
• Create an account and use the Lumor platform as a customer or team member
• Respond to a survey that has been distributed via a Lumor survey link (as a survey respondent)
• Participate in our managed panel recruitment programme
• Contact us for sales, support, or general enquiries

This policy does not apply to third-party websites that may be linked from our platform. We encourage you to review the privacy policies of any third-party services you access.

03 · The Personal Data We Collect

3.1 Account and Registration Data. When you create a Lumor account, we collect: full name, gender, date of birth, email address and password (passwords are stored as a cryptographic hash — never in plaintext), company / organisation name, work profile (industry, job role, job type, and company size), and education level.

3.2 Survey and Research Data. We store the content of your survey (questions, structure, logic, and settings) on your behalf; the responses submitted by your survey participants, including all answers provided; and metadata associated with each response: timestamp, completion status, collector source, and session identifiers.

3.3 Respondent Data (Survey Participants). When a person submits responses through a Lumor-distributed survey link, we may collect: all answers and content submitted through the survey form, IP address, browser type and version, operating system and device type, and timestamp of submission. If you are a Lumor customer distributing surveys to your participants, you are the data controller for your respondents’ personal data. Lumor acts as a data processor on your behalf (see Section 11).

3.4 Technical and Usage Data. IP address and approximate geographic location (country / city level); browser type, version, and language settings; operating system and device type; pages visited, features used, clicks, and session duration; referring URLs and exit pages; and error logs and performance data. This data is collected using cookies, server logs, and Google Analytics 4.

3.5 Communications Data. When you contact us by email, telephone, or via our contact form, we retain the content of that communication and any associated contact details, in order to respond to and resolve your enquiry.

3.6 Payment and Billing Data. We do not store full credit card or banking details on our servers. All payment processing is handled by Razorpay (for Indian Customers) and Stripe (for international Customers). We store only the transaction reference number, plan type, billing amount, invoice status, and date — which is necessary for subscription management and statutory accounting records.

3.7 Special Categories of Data. We do not intentionally collect or process special categories of personal data — such as data relating to racial or ethnic origin, religious beliefs, health, biometrics, or sexual orientation — through the Lumor platform itself. However, if your survey questions gather such data from your participants, that data will be processed by Lumor as your data processor. You must ensure appropriate safeguards and consents are in place before collecting such data using our platform.

04 · Cookies and Similar Technologies

We use cookies and similar tracking technologies on lumor.tech and app.lumor.tech.

• Essential cookies: Required for the platform to function. Include session authentication cookies and security tokens. Cannot be disabled.
• Analytics cookies: We use Google Analytics 4 to understand how visitors use our website. GA4 collects IP addresses, which are used by Google to derive approximate geographic location before being discarded.
• Preference cookies: These remember your settings and UI preferences across sessions.

We use CookieYes as our consent management platform. A cookie consent banner is displayed on lumor.tech. You may change your cookie preferences at any time through the CookieYes banner or your browser settings. Refusing analytics or preference cookies will not affect your ability to use the core platform. We do not use advertising cookies, and we do not sell or share data with advertising networks.

05 · How We Use Your Personal Data

We will only use your personal data where we have a lawful basis to do so.

06 · Legal Basis for Processing

For users in the EEA, United Kingdom, or other jurisdictions where equivalent data-protection legislation applies, our legal bases are:

• Contract: Processing necessary to provide the Lumor platform to you under our Terms of Use.
• Legitimate interests: Processing necessary for our legitimate business interests, such as improving the platform, preventing fraud, and communicating relevant product updates.
• Legal obligation: Processing required to comply with applicable laws, including Indian tax law and data protection regulations.
• Consent: Where you have explicitly opted in, for example by accepting non-essential cookies.

07 · Data Sharing and Third-Party Processors

We do not sell your personal data to third parties, and we do not share your data with advertisers. Our key sub-processors include:

• Amazon Web Services (AWS) — cloud infrastructure and data storage. Primary region: ap-south-1 (Mumbai, India).
• Third-party AI service providers — used to power AI analysis, Slide, and Doc Report features. Our contracts with these providers prohibit them from using your data for their own purposes.
• Razorpay — payment processing for Indian Customers. Regulated by the Reserve Bank of India.
• Stripe — payment processing for international Customers.
• Google Analytics 4 — website and platform usage analytics.
• Amazon SES — transactional and product update emails.
• CookieYes — cookie consent management platform.
• Recall.ai — video and meeting recording API integration, where used. We have contractual data processing terms in place with Recall.ai.

Legal disclosures. We may disclose personal data if required to do so by applicable law, a court order, or a government authority. We will notify you of any such disclosure where we are legally permitted to do so. Business transfers. If Lumor is acquired by or merged with another entity, your personal data may be transferred as part of that transaction; we will notify you before your data becomes subject to a different privacy policy.

08 · International Data Transfers

Your data is primarily stored on AWS infrastructure located in Mumbai, India (ap-south-1). Some of our third-party service providers — including certain AI service providers and analytics tools — may process data outside India. Where personal data is transferred outside India, we ensure that appropriate safeguards are in place, including Standard Contractual Clauses (SCCs) or equivalent mechanisms as required under the DPDP Act 2023 and other applicable law.

09 · Data Retention

• Account and registration data — retained for the duration of your subscription and for 12 months after account closure.
• Survey and response data — retained for the duration of your subscription. Following account closure, data is retained for 30 days to allow export, then deleted.
• Payment and billing records — retained for 7 years, as required under Indian accounting and GST law.
• Technical and usage data (logs) — retained for 12 months.
• Support and communications data — retained for 3 years from the date of last contact.

You may request deletion of your personal data at any time by writing to contact@lumor.tech. We will action your request within 30 days, subject to any legal retention obligations that may apply.

10 · Your Rights

• Right of access — Request a copy of the personal data we hold about you.
• Right to rectification — Request correction of inaccurate or incomplete data.
• Right to erasure — Request deletion of your personal data, subject to legal retention obligations.
• Right to restriction — Request that we restrict processing of your data in certain circumstances.
• Right to data portability — Receive your data in a structured, machine-readable format.
• Right to object — Object to processing based on legitimate interests, including profiling for direct marketing.
• Right to withdraw consent — Withdraw consent where processing is based on your consent.

Indian residents also have rights under the Digital Personal Data Protection (DPDP) Act 2023, including the right to access a summary of personal data held, the right to correction and erasure, and the right to nominate another person to exercise these rights on their behalf. To exercise any of your rights, please write to us at contact@lumor.tech.

11 · Our Role as Data Processor

When a Lumor customer creates and distributes a survey, the customer is the data controller for the personal data collected from those participants. Lumor acts as a data processor, processing respondent data on the customer’s behalf and under the customer’s instructions. As a Lumor customer, you are responsible for:

• Ensuring you have a lawful basis for collecting personal data from your survey participants
• Providing respondents with an appropriate privacy notice before they complete your survey
• Ensuring your use of respondent data complies with applicable law, including the DPDP Act 2023

Enterprise customers may request a Data Processing Agreement (DPA) from us. Please contact contact@lumor.tech to request a DPA.

12 · Data Security

• TLS 1.2 or higher encryption for all data in transit between your browser and our servers
• AES-256 encryption for data at rest on AWS
• Bcrypt password hashing — passwords are never stored in plaintext
• Role-based access controls (RBAC) within the platform
• Multi-factor authentication (MFA) required for all internal access to production infrastructure
• Principle of least privilege — Lumor employees do not have standing access to customer data
• Regular dependency audits and security patching

In the event of a personal data breach that is likely to result in risk to your rights and freedoms, we will notify you and the relevant authorities as required by applicable law. Under the Digital Personal Data Protection (DPDP) Act 2023, we will report eligible breaches to the Data Protection Board of India (DPBI) without undue delay.

13 · Children’s Data

The Lumor platform is intended for use by business professionals aged 18 and above. We do not knowingly collect personal data from individuals under the age of 18. If you are a Lumor customer and you intend to conduct research involving participants under 18, you must ensure that you obtain appropriate parental or guardian consent before collecting their data through our platform. If you believe that a minor has submitted personal data through our platform, please contact us at contact@lumor.tech and we will delete it promptly.

14 · Third-Party Links

Our platform may contain links to third-party websites or integrations with third-party services. This Privacy Policy applies only to data collected by Lumor. We are not responsible for the privacy practices of third-party services, and we encourage you to review their privacy policies before sharing your data with them.

15 · Changes to This Privacy Policy

We may update this Privacy Policy from time to time. When we make material changes, we will notify you by email, display a prominent notice on the Lumor platform, and update the effective date at the top of this document. We will provide at least 14 days’ notice before material changes take effect. Your continued use of the platform after that date constitutes acceptance of the updated policy.

16 · Grievance Officer

In accordance with the Digital Personal Data Protection Act 2023 and the Information Technology Act 2000, Lumor has designated a Grievance Officer to address data-related complaints and requests from users in India:

Name: Somnath Chakraborty
Designation: Co-Founder & Grievance Officer
Email: contact@lumor.tech
Phone: +91 98898 81155
Address: 38, 1st Floor, Aswini Layout, 2nd Main Rd, Viveknagar, Ejipura, Bengaluru, Karnataka – 560047

We will acknowledge your grievance within 48 hours and endeavour to resolve it within 30 days of receipt.

17 · Contact Us

For any questions, concerns, or requests relating to this Privacy Policy or your personal data, please contact us:

Lumor Technologies Pvt. Ltd.
38, 1st Floor, Aswini Layout, 2nd Main Rd, Viveknagar, Ejipura, Bengaluru, Karnataka – 560047
Email: contact@lumor.tech · Phone: +91 98898 81155

© 2026 Lumor Technologies Pvt. Ltd. All rights reserved.