Privacy
How Lumialo handles your personal data.
Last updated 2026-09-30.
What we collect
Account data. When you sign in we store your email address so we can send you the magic link and identify your account. We do not ask for, and do not store, a password. Analysis data you give us. To run an AI Visibility analysis we store the brand description, brand or company name, competitor names, question groups and questions you enter. This is the input you provide to the product; we keep it associated with your account so you can re-run or adjust an analysis later. Usage and cost telemetry. For every analysis we record technical metadata: which AI providers were called, response time, token counts, the dollar cost of each call, and the credits charged. We need this to run the credit system, to investigate failed runs, and to keep the service reliable. It is included when you download your data, together with the analysis data above. Activity log. We record what you do in your account — signing in and out, clicking Suggest, starting, running or deleting an analysis, downloading your data, changing your cookie choice — with the time and the key choices (for example how many competitors or questions). Some entries also show credits or AI cost, for example the estimate when you start a paid analysis. We keep the log to answer billing questions and handle complaints; the legal basis is the performance of our contract with you (GDPR Art. 6(1)(b)). We keep each entry for 24 months and then delete it automatically. It is included when you download your data (Account → Privacy & data → Download my data). Product analytics (only with your consent). If — and only if — you click "Accept analytics" on the cookie banner, or switch on Product analytics in Cookie settings, we load PostHog and record product events such as which pages you view and which buttons you click. If you click Reject, or never answer the banner, no analytics are loaded. Session recordings (only if you switch them on). Session recordings are a separate choice in Cookie settings, off by default, and only possible together with product analytics. When on, PostHog records how pages are used — clicks, scrolling and page changes — with the text you type hidden. "Accept analytics" never switches recordings on.
Why we collect it
To deliver the product you asked for. Your email and analysis inputs are what we need to actually run the analysis, email you the report, and let you return to your account later. To run the credit system. Usage and cost telemetry is how we calculate what each paid-plan analysis actually costs in API spend, and deduct it from your credits. To keep the service reliable. The same telemetry tells us when a provider is slow, when costs drift, or when something is broken — so we can fix it before it affects more users. To improve the product (only with your consent). Product analytics and, if you switch them on, session recordings via PostHog help us understand which parts of the product work and which confuse people. The legal basis is your consent (GDPR Art. 6(1)(a)); you can withdraw it at any time under "Cookie settings" at the bottom of every page, and withdrawing is as easy as giving it. If you reject, we improve the product without it. We do not sell your data. We do not share your data with advertisers, data brokers, or third parties for their own marketing. The only third parties involved are the service providers we need to operate (see Cookies and Contact).
Cookies
Consent cookie. We set one strictly necessary cookie, `lumialo_consent`, lifetime one year, to remember your choice. Its value lists what you allowed: `strict,v2` (Reject — nothing optional), `strict,analytics,v2` (product analytics) or `strict,analytics,replay,v2` (product analytics and session recordings). It is set as soon as you choose; without it we would have to ask again on every page. Choices made before our banner named session recordings (older values without `v2`) are read as "no session recordings". Analytics cookies (only after you accept). If you accept product analytics, we start PostHog (EU hosting), which stores its own identifier in a cookie and in your browser's local storage (named `ph_…_posthog`) to count page views and clicks across your visit. Nothing from PostHog is loaded if you reject or have not answered the banner. Session recordings (only if you switch them on). The recording script is not downloaded at all unless you switch Session recordings on in Cookie settings. Text you type is hidden in recordings. No advertising cookies. We do not load advertising trackers, social-media pixels, or third-party marketing cookies. There is no Google Analytics, no Facebook pixel, no remarketing. Changing your mind. Click "Cookie settings" at the bottom of any page — signed in or not — to switch product analytics or session recordings on or off, or to revoke all consent at once. Signed in, the same dialog is also under Account → Privacy & data → "Cookie settings". Your new choice applies immediately.
Your rights
Your privacy rights vary by where you live. The rights below apply to all Lumialo users; EU/EEA residents have additional statutory rights under GDPR — see the EU/EEA section below. - Know what we have. You can ask us what personal data we hold about you and download a machine-readable copy of it directly from your account at any time: Account → Privacy & data → Download my data. - Delete your data. You can permanently delete any individual analysis you have run from your account: Account → Usage history → ⋯ → Delete this analysis. To delete your account, use Account → Danger zone → Delete my account and re-type your email to confirm. We then delete all your analyses and their reports straight away and sign you out everywhere. We keep your email address and account, your credit and payment history, your free-plan usage for the current month, your activity log and any messages you sent us: this stops the free plan from being started again by deleting and signing up, and bookkeeping rules require us to keep payment records. The activity log is kept for 24 months; payment records for as long as bookkeeping law requires. If you sign in again, your account opens again — empty, with your credits. If you cannot reach the Account area, email privacy@lumialo.com and we will process the request within one month. - Withdraw consent for product analytics and session recordings. You can withdraw at any time, signed in or not: click "Cookie settings" at the bottom of any page → "Reject all" (the button reads "Revoke all consent" once you have said yes). PostHog stops straight away, its cookie and stored data in your browser are deleted, and your choice is remembered. - Ask a human. For anything not yet covered by a self-service option in your account, email privacy@lumialo.com. We aim to respond within one month.
Additional rights for EU/EEA residents (GDPR)
If you live in the EU or EEA, the GDPR gives you statutory rights in addition to the universal rights above. The self-service buttons listed in Your rights are the same; what changes is the legal basis and the timelines. - Access (Art. 15) — request a copy of the personal data we hold about you. Self-service: Account → Privacy & data → Download my data (JSON). - Rectification (Art. 16) — correct data that is wrong or incomplete. Email-only: privacy@lumialo.com. - Erasure (Art. 17) — delete your data. Self-service per analysis: Account → Usage history → ⋯ → Delete this analysis. Self-service account delete: Account → Danger zone → Delete my account — your analyses and reports are deleted; your email and account, credit and payment history, current free-plan usage, activity log and messages to us are kept, to prevent repeated free trials (our legitimate interest, Art. 6(1)(f)) and because bookkeeping law requires payment records (Art. 6(1)(c)). Email fallback: privacy@lumialo.com — we will process within one month. - Restriction (Art. 18) — ask us to stop processing while a dispute is resolved. Email-only: privacy@lumialo.com. - Portability (Art. 20) — receive your data in a machine-readable format. Self-service: Account → Privacy & data → Download my data (JSON-formatted; satisfies Art. 20). - Withdraw consent (Art. 7(3)) — product analytics and session recordings are based on your consent, which you can withdraw as easily as you gave it. Self-service: click "Cookie settings" at the bottom of any page → "Reject all" (the button reads "Revoke all consent" once you have said yes). - Objection (Art. 21) — object to any processing we base on legitimate interest. Email: privacy@lumialo.com. How long we take. We aim to respond within one month of a request as required by Art. 12(3); if your request is unusually complex we may extend by two further months and will tell you why. Right to complain. If you are not satisfied with how we handle your data, you may complain to a supervisory authority. In Denmark this is Datatilsynet (datatilsynet.dk). If you live in another EU/EEA country you may also contact the supervisory authority in your country of residence. AI transparency. Lumialo uses generative AI models from OpenAI and Anthropic to produce analyses and recommendations. AI outputs vary across runs and can contain inaccuracies. Reports clearly identify AI-generated content. Lumialo is not an AI-model provider; we are a downstream user of third-party AI services. Under the EU AI Act (Regulation (EU) 2024/1689), our use of these services qualifies as low-risk AI deployment. We monitor regulatory developments and will adjust our posture as additional Act articles enter force.
Other regions — UK, US, rest-of-world
Lumialo is operated from Denmark but serves users worldwide. The rights above apply to you wherever you live: you can download your data and delete your account yourself, at any time, from Account → Privacy & data. - United Kingdom. The UK GDPR mirrors the EU GDPR, so the rights and timelines in the EU/EEA section apply to you as well. Complaints go to the Information Commissioner's Office (ico.org.uk). - United States — California. Under CCPA/CPRA you can ask what personal information we hold, ask us to delete it, and opt out of any "sale" or "sharing". We do not sell or share personal information for advertising. Email privacy@lumialo.com with subject `CCPA request`. - Everywhere else. Other state and national laws (Colorado, Virginia, Brazil LGPD, Canada PIPEDA, Australia Privacy Act and others) give similar rights. Use the self-service options above, or email privacy@lumialo.com and we will honour an applicable statutory request.
Which law governs
Lumialo is operated by Bertram Consulting in Denmark. These privacy practices are interpreted under Danish law and, for EU/EEA users, the GDPR. Nothing on this page limits a non-waivable consumer right you may have under the law of your country of residence. The full governing-law clause for the service is on the Terms page (see Governing law).
Contact
Data controller. Lumialo is operated by Bertram Consulting, based in Denmark. Data-protection requests. privacy@lumialo.com Everything else. support@lumialo.com We answer in English. If we are slow it is because Lumialo is a small operation, not because we are ignoring you — please follow up if you have not heard back within a month.