Privacy Policy

Lumexa (“Lumexa”, “we”, “us”) provides an AI-powered platform that turns plain-language ideas into working software. This Privacy Policy applies to our websites, applications, and related services (the “Service”) and describes how we handle personal data.

For most personal data processed through your account and projects, Lumexa acts as the data controller. Where you use Lumexa to process personal data contained in your own Inputs (for example, data inside a document you upload), you are the controller of that data and Lumexa acts as a processor on your behalf. This Policy should be read together with our Terms of Service.

We collect the following categories of information:

Information you provide

• Account information — name, email address, password (stored hashed), and organization details.
• Phone number — if you choose to provide it, we collect your mobile phone number so we can send the WhatsApp and/or SMS notifications you opt into (for example, an alert when your app build is ready). This is optional — see Phone numbers & messaging.
• Project Inputs — the ideas, prompts, chat messages, and instructions you submit, and documents you upload such as PRDs, specifications, and designs.
• Payment information — when you purchase a plan or download, our payment processor collects your payment details. We receive limited information such as the last four digits, card brand, and transaction status; we do not store full card numbers.
• Communications — messages you send to support, feedback, and survey responses.

Information we collect automatically

• Usage data — actions you take in the Service, features used, projects and builds created, and timestamps.
• Device & log data — IP address, browser and device type, operating system, referring pages, and diagnostic logs.
• Cookies & similar technologies — used to keep you signed in, remember preferences, and understand product usage (see Cookies & analytics).

Information from third parties

• Authentication or identity providers if you sign in through them, and our payment processor for billing status.

We use personal data to:

• provide, operate, and maintain the Service, including generating PRDs, code, previews, and downloads from your Inputs;
• create and secure your account and authenticate you;
• process payments, manage subscriptions, and prevent fraud;
• respond to your requests and provide customer support;
• monitor, debug, and improve the performance, reliability, and security of the Service;
• analyze usage to understand how the Service is used and to develop new features;
• send you service-related and, where permitted, product update communications (you can opt out of marketing at any time);
• where you have provided your phone number and opted in, send you WhatsApp and/or SMS notifications about your account and projects — such as when your app build is ready — and related service or security alerts;
• comply with legal obligations and enforce our Terms.

To generate Output, Lumexa sends relevant portions of your Inputs (such as your prompts and uploaded documents) to AI model providers and our own AI orchestration systems. This processing is necessary to deliver the core function of the Service.

• We do not sell your Inputs or Output, and we do not use your private project content to train publicly shared foundation models.
• We contractually require our AI sub-processors to process your content only to provide their service to us and not to train their general models on it, to the extent their offerings allow.
• Please avoid submitting sensitive personal data, secrets, or information you are not authorized to share with third-party AI providers. You are responsible for the content of your Inputs.

If you are in the European Economic Area or the United Kingdom, we process personal data on the following legal bases:

• Contract — to provide the Service you have requested and perform our agreement with you.
• Legitimate interests — to secure, improve, and promote the Service, where not overridden by your rights.
• Consent — for certain cookies, analytics, and marketing, which you may withdraw at any time.
• Legal obligation — to comply with applicable laws, such as tax and accounting requirements.

We share personal data only as described here:

• Service providers / sub-processors — vendors that host, process, or support the Service under contract (see below).
• Messaging providers — to deliver the WhatsApp and/or SMS notifications you opt into (for example, Twilio and the WhatsApp/Meta and mobile carrier networks). They receive your phone number solely to transmit those messages on our behalf, not for their own purposes.
• Payment processor — to complete transactions and manage subscriptions.
• At your direction — for example, when you enable repository mirroring or exports to a code-hosting provider.
• Legal & safety — when required by law, to respond to lawful requests, or to protect the rights, safety, and security of Lumexa, our users, or the public.
• Business transfers — in connection with a merger, acquisition, financing, or sale of assets, subject to this Policy.

We do not sell your personal data, and we do not share it for cross-context behavioral advertising. In particular, we do not sell, rent, or share your phone number, mobile opt-in, or messaging consent with any third parties or affiliates for their own marketing or promotional purposes — see Phone numbers & messaging.

We rely on trusted third parties to run the Service. Current categories of sub-processors include:

• Cloud infrastructure & databases — Amazon Web Services (hosting, storage, build, and compute).
• AI model providers — to generate code, PRDs, and other Output.
• Messaging / notifications — Twilio, used to deliver WhatsApp and SMS notifications to the phone number you provide.
• Source-code hosting — for repository mirroring and exports.
• Payments — our third-party payment processor.
• Product analytics — to understand usage and improve the Service.

We require sub-processors to provide appropriate safeguards for personal data. A current list is available on request at privacy@lumexa.ai.

We keep personal data for as long as needed to provide the Service and for the purposes described in this Policy. Account and project data are retained while your account is active. After you delete a project or close your account, we delete or anonymize associated data within a reasonable period, except where we must retain it to comply with legal obligations, resolve disputes, prevent fraud, or enforce our agreements. Guest session data may be retained only temporarily and deleted automatically if it is not claimed by creating an account.

We implement technical and organizational measures designed to protect personal data, including encryption in transit, access controls and least-privilege access, network isolation, hashed credentials, and logging and monitoring. No method of transmission or storage is completely secure, so we cannot guarantee absolute security. If we become aware of a breach affecting your personal data, we will notify you and the relevant authorities as required by law.

Lumexa and our sub-processors may process personal data in countries other than your own, including the United States. Where we transfer personal data from the EEA, UK, or Switzerland to a country without an adequacy decision, we rely on appropriate safeguards such as the European Commission’s Standard Contractual Clauses, together with additional measures where needed.

Depending on where you live, you may have rights to:

• Access the personal data we hold about you;
• Correct inaccurate or incomplete data;
• Delete your data;
• Restrict or object to certain processing;
• Port your data to another provider;
• Withdraw consent where processing is based on consent;
• Opt out of marketing communications and of any “sale” or “sharing” as defined under applicable U.S. state laws (we do not sell or share your data for advertising).

To exercise these rights, contact privacy@lumexa.ai. We will respond within the timeframe required by law and will not discriminate against you for exercising your rights. If you are in the EEA or UK, you also have the right to lodge a complaint with your local data protection authority.

We use cookies and similar technologies to keep you signed in, remember your preferences, secure the Service, and understand how it is used. We use a product-analytics provider to collect usage events that help us improve features and fix problems. You can control cookies through your browser settings; blocking some cookies may affect how the Service works. Where required, we ask for your consent before setting non-essential cookies.

The Service is not directed to children under 16, and we do not knowingly collect personal data from them. If you believe a child has provided us personal data, contact us at privacy@lumexa.ai and we will delete it.

The Service and generated Output may contain links to third-party websites or services that we do not control. This Policy does not apply to those third parties, and we encourage you to review their privacy practices.

We may update this Privacy Policy from time to time. When we make material changes, we will update the “Last updated” date and, where appropriate, notify you in-product or by email. Your continued use of the Service after an update means you accept the revised Policy.

If you choose to provide your mobile phone number, we use it to send you account- and project-related notifications by WhatsApp and/or SMS — for example, to let you know when your app build is ready, or to send important service and security alerts. Providing your number and enabling these notifications is entirely optional, and the Service is fully usable without it.

Consent

We only send you WhatsApp or SMS messages after you provide your phone number and opt in to receive them. These are transactional, service-related messages tied to your use of Lumexa; we do not require you to receive marketing messages as a condition of using the Service. Message frequency varies based on your activity, and message and data rates may apply from your mobile carrier.

How to opt out

You can stop receiving messages at any time by replying STOP to any WhatsApp or SMS message from us, or by turning off notifications in your account settings. Reply HELP for assistance, or contact us at privacy@lumexa.ai. After you opt out we may send a single confirmation message, and will then stop sending messages except any strictly required to operate or secure your account.

We do not sell or share your number

We do not sell, rent, lease, or trade your phone number, and we do not share your phone number, mobile opt-in, or messaging consent with any third parties or affiliates for their own marketing or promotional purposes. The only parties that receive your phone number are the messaging providers we use strictly to deliver the messages you requested — for example, Twilio and the WhatsApp/Meta and mobile carrier networks — and they may process it only to transmit those messages on our behalf. We may also disclose it where required by law or to protect the Service, as described in How we share information.

For privacy questions or to exercise your rights, contact us:

• Privacy: privacy@lumexa.ai
• Security: security@lumexa.ai
• LinkedIn: linkedin.com/company/lumexa-ai