Privacy Policy

1. About Lumora

Lumora is a software-as-a-service (SaaS) platform that provides an AI receptionist and appointment management functionality. Lumora helps businesses such as salons, clinics, and other small service providers handle inbound customer messages, answer questions about services and availability, and schedule, reschedule, or cancel appointments.

2. Information users may provide

To provide the service, Lumora may process the following categories of information, when users or businesses voluntarily provide them:

• Account and contact information — such as the business name, owner name, email address, and password used to create and access a Lumora account.
• Appointment and scheduling information — such as the customer's name, phone number, requested service, preferred date and time, and any details needed to book, change, or cancel an appointment.
• Messages and information processed through Lumora — including chat messages, booking requests, and other information exchanged through the channels connected to Lumora, which may be analyzed to generate responses and manage appointments.
• Technical and security information — such as basic device, browser, and access logs used to operate, secure, and troubleshoot the service.

3. Why we process information

Lumora processes information only to provide and improve the service. Specifically, we use information to:

• respond to customer inquiries and provide AI receptionist functionality;
• schedule, confirm, reschedule, and cancel appointments;
• send confirmations and reminders related to appointments;
• sync appointments with connected calendars where the user has enabled this;
• operate, monitor, secure, and maintain the service;
• comply with applicable legal obligations.

4. Service providers and processors

To operate the service, Lumora may use trusted third-party service providers and processors that perform necessary technical functions, such as hosting, database storage, email delivery, messaging channels, calendar providers, and AI services used to generate responses. These providers process information only on Lumora's behalf and under appropriate agreements to help operate and secure the service.

5. Security measures

Lumora applies reasonable technical and organizational measures to protect information against unauthorized access, loss, misuse, or disclosure. These include secure connections, access controls, and regular monitoring. However, no system can guarantee absolute security, and we cannot guarantee the security of information transmitted over the internet.

6. Data retention

We retain information only for as long as reasonably necessary to provide the service, meet legal obligations, resolve disputes, prevent abuse, and maintain security. After the retention period expires, information is deleted or anonymized where appropriate.

7. Google User Data

When a business owner voluntarily connects their Google Calendar to Lumora, Lumora requests exactly three Google OAuth scopes and nothing more:

• calendar.calendarlist.readonly — to list the calendars of the connected account so the owner can choose which calendar Lumora should use;
• calendar.freebusy — to check whether a requested time interval is busy before an appointment is offered or booked;
• calendar.events — to create, update, and delete the appointment events belonging to the connected calendar and to keep them in two-way sync with Lumora.

Access is limited strictly to providing the Calendar integration the user requested. Lumora does not sell Google user data, does not use it for advertising or advertising profiles, and does not use it for any purpose beyond the scheduling functionality described above.

Google data and artificial intelligence

• Google Workspace API user data is never used to create, train, improve, fine-tune, or evaluate generalized or foundational artificial intelligence or machine learning models — neither by Lumora nor by any third party.
• Raw Google Calendar event content is not transferred to third-party AI providers. Event titles/summaries, descriptions/notes, attendees, organizer details, and calendar names are excluded from all AI prompts.
• When an external Google Calendar event blocks a time slot, Lumora stores and processes only the minimum scheduling facts — start time, end time/duration and a neutral indicator that the interval is occupied by an external calendar event. Google event titles and descriptions are not copied into Lumora records.
• OpenAI is used as an AI service provider for Lumora's AI features (the customer-facing AI receptionist and the owner business assistant). Google Workspace event content is excluded from those prompts. Lumora does not claim Zero Data Retention or any specific OpenAI enterprise plan.
• The Lovable AI Gateway is used only as a proxy for voice-message speech-to-text transcription of messages sent to Lumora by end customers. No Google Calendar data is sent through it.

Retention, disconnect and deletion

• A user can disconnect Google Calendar at any time from the Lumora dashboard, or revoke access from their Google Account settings.
• On disconnect, Lumora revokes the connection at the connector gateway and deletes the stored Google connection reference and access/refresh credentials, together with the stored calendar selection and sync state.
• On disconnect, all busy-time records imported from Google Calendar are deleted from Lumora.
• Appointments created in Lumora itself are business records and are retained; only their Google event references are cleared, so no Google identifiers remain.

Lumora's use of information received from Google APIs adheres to the Google API Services User Data Policy, including the Limited Use requirements.

8. Your rights (EU/EEA)

For users in the European Union or European Economic Area, the General Data Protection Regulation (GDPR) gives you certain rights regarding your personal data, including:

• the right to access your personal data;
• the right to correct inaccurate personal data;
• the right to erase your personal data ("right to be forgotten");
• the right to restrict processing;
• the right to object to processing;
• the right to data portability, where applicable;
• the right to withdraw consent where processing is based on consent;
• the right to lodge a complaint with a supervisory authority.

To exercise any of these rights, or for any privacy-related question, contact Lumora at the email below.

9. Contact

For any question regarding this Privacy Policy or the processing of your data, contact Lumora at: reception.lumora@gmail.com