Privacy Policy

Lumor Technologies Pvt. Ltd. (“Lumor”, “we”, “us”, “our”) is a company incorporated under the Companies Act, 2013, with its registered office at:

We operate an AI-powered user research platform accessible at lumor.tech (the “Website”) and app.lumor.tech (the “Platform”), and we are the data controller in respect of the personal data described in this Privacy Policy.

For privacy-related enquiries, contact us at: contact@lumor.tech

This Privacy Policy applies to personal data collected when you:

• Visit or browse lumor.tech or app.lumor.tech
• Create an account and use the Lumor platform as a customer or team member
• Respond to a survey that has been distributed via a Lumor survey link (as a survey respondent)
• Participate in our managed panel recruitment programme
• Contact us for sales, support, or general enquiries

This policy does not apply to third-party websites that may be linked from our platform. We encourage you to review the privacy policies of any third-party services you access.

We use cookies and similar tracking technologies on lumor.tech and app.lumor.tech.

• Essential cookies: Required for the platform to function. Include session authentication cookies and security tokens. Cannot be disabled.
• Analytics cookies: We use Google Analytics 4 to understand how visitors use our website. GA4 collects IP addresses, which are used by Google to derive approximate geographic location before being discarded. We recommend enabling IP anonymization in your GA4 configuration — if you have questions about your specific settings, contact us at contact@lumor.tech.
• Preference cookies: These remember your settings and UI preferences across sessions.

We use CookieYes as our consent management platform. A cookie consent banner is displayed on lumor.tech. By accepting non-essential cookies, you consent to their use. You may change your cookie preferences at any time through the CookieYes banner or your browser settings. Refusing analytics or preference cookies will not affect your ability to use the core platform. We do not use advertising cookies. We do not sell or share data with advertising networks.

We will only use your personal data where we have a lawful basis to do so.

For users in the EEA, United Kingdom, or other jurisdictions where GDPR or equivalent legislation applies, our legal bases are:

• Contract: Processing necessary to provide the Lumor platform to you under our Terms of Service.
• Legitimate interests: Processing necessary for our legitimate business interests, such as improving the platform, preventing fraud, and communicating relevant product updates.
• Legal obligation: Processing required to comply with applicable laws, including Indian tax law and data protection regulations.
• Consent: Where you have explicitly opted in, for example by accepting non-essential cookies.

We do not sell your personal data to third parties. We do not share your data with advertisers. Our key sub-processors include:

• Amazon Web Services (AWS) — cloud infrastructure and data storage. Primary region: ap-south-1 (Mumbai, India). AWS is ISO 27001 and SOC 2 Type II certified.
• Third-party AI service providers — used to power AI analysis, Slide, and Doc Report features. Our contracts with these providers prohibit them from using your data for their own purposes.
• Razorpay — payment processing for Indian Customers. PCI DSS Level 1 certified and regulated by the Reserve Bank of India.
• Stripe — payment processing for international Customers. PCI DSS Level 1 certified.
• Google Analytics 4 — website and platform usage analytics. GA4 collects IP addresses for geolocation purposes; these are discarded by Google and not stored by Lumor.
• Amazon SES (Simple Email Service) — transactional and product update emails. Amazon SES is part of AWS infrastructure and is ISO 27001 and SOC 2 Type II certified.
• CookieYes — cookie consent management platform. CookieYes processes consent records and cookie preference data on our behalf.
• Recall.ai — video and meeting recording API integration. Recall.ai may process user data in connection with certain platform features. We have contractual data processing terms in place with Recall.ai.

Your data is primarily stored on AWS infrastructure located in Mumbai, India (ap-south-1). Some of our third-party service providers — including certain AI service providers and analytics tools — may process data outside India. Where personal data is transferred outside India, we ensure that appropriate safeguards are in place, including Standard Contractual Clauses (SCCs) or equivalent mechanisms as required under the DPDP Act 2023 and, where applicable, GDPR.

• Account and registration data — retained for the duration of your subscription and for 12 months after account closure.
• Survey and response data — retained for the duration of your subscription. Following account closure, data is retained for 30 days to allow export, then deleted.
• Payment and billing records — retained for 7 years, as required under Indian accounting and GST law.
• Technical and usage data (logs) — retained for 12 months.
• Support and communications data — retained for 3 years from the date of last contact.

You may request deletion of your personal data at any time by writing to contact@lumor.tech. We will action your request within 30 days, subject to any legal retention obligations that may apply.

• Right of access — Request a copy of the personal data we hold about you.
• Right to rectification — Request correction of inaccurate or incomplete data.
• Right to erasure — Request deletion of your personal data, subject to legal retention obligations.
• Right to restriction — Request that we restrict processing of your data in certain circumstances.
• Right to data portability — Receive your data in a structured, machine-readable format.
• Right to object — Object to processing based on legitimate interests, including profiling for direct marketing.
• Right to withdraw consent — Withdraw consent where processing is based on your consent.

Indian residents also have rights under the Digital Personal Data Protection (DPDP) Act 2023, including the right to access a summary of personal data held, the right to correction and erasure, and the right to nominate another person to exercise these rights on their behalf.

To exercise any of your rights, please write to us at contact@lumor.tech. We will respond within 30 days. We do not charge a fee for reasonable requests. If you are in the EEA or the UK and are not satisfied with our response, you have the right to lodge a complaint with your local data protection authority.

When a Lumor customer creates and distributes a survey, the customer is the data controller for the personal data collected from those participants. Lumor acts as a data processor, processing respondent data on the customer's behalf and under the customer's instructions.

As a Lumor customer, you are responsible for:

• Ensuring you have a lawful basis for collecting personal data from your survey participants
• Providing respondents with an appropriate privacy notice before they complete your survey
• Ensuring your use of respondent data complies with applicable law, including the DPDP Act 2023 and GDPR where relevant

Enterprise customers may request a Data Processing Agreement (DPA) from us. Please contact contact@lumor.tech to request a DPA.

• TLS 1.2 or higher encryption for all data in transit between your browser and our servers
• AES-256 encryption for data at rest on AWS
• Bcrypt password hashing — passwords are never stored in plaintext
• Role-based access controls (RBAC) within the platform
• Multi-factor authentication (MFA) required for all internal access to production infrastructure
• Principle of least privilege — Lumor employees do not have standing access to customer data
• Regular dependency audits and security patching

In the event of a personal data breach that is likely to result in risk to your rights and freedoms, we will notify you and the relevant authorities as required by applicable law. Under the Digital Personal Data Protection (DPDP) Act 2023, we will report eligible breaches to the Data Protection Board of India (DPBI) without undue delay. Where GDPR applies, we will notify the relevant supervisory authority within 72 hours of becoming aware of the breach. You can find further details about our security practices at lumor.tech/security.

The Lumor platform is intended for use by business professionals aged 18 and above. We do not knowingly collect personal data from individuals under the age of 18. If you are a Lumor customer and you intend to conduct research involving participants under 18, you must ensure that you obtain appropriate parental or guardian consent before collecting their data through our platform. If you believe that a minor has submitted personal data through our platform, please contact us at contact@lumor.tech and we will delete it promptly.

Our platform may contain links to third-party websites or integrations with third-party services. This Privacy Policy applies only to data collected by Lumor. We are not responsible for the privacy practices of third-party services, and we encourage you to review their privacy policies before sharing your data with them.

We may update this Privacy Policy from time to time. When we make material changes, we will notify you by email, display a prominent notice on the Lumor platform, and update the effective date at the top of this document. We will provide at least 14 days' notice before material changes take effect. Your continued use of the platform after that date constitutes acceptance of the updated policy.

For any questions, concerns, or requests relating to this Privacy Policy or your personal data, please contact us:

For data access requests, erasure requests, or to request a Data Processing Agreement (DPA), please write to contact@lumor.tech with the subject line matching your request type.