Privacy Policy

This Privacy Policy is about how Lumevo handles personal information. Lumevo is a company AI workspace operated by Dian Van Rensburg, a sole trader in Brisbane, Queensland 4020, Australia (ABN 22 169 955 404). Privacy contact: support@lumevo.digital.

Lumevo currently sells to Australian businesses through enquiry, invitation and a monthly written quote. If annual turnover is A$3 million or less, the Privacy Act 1988 small-business exemption may apply unless an exception does (for example trading in personal information, providing a health service, or contracting to the Commonwealth). Lumevo still follows this policy, and intends to opt in to the Australian Privacy Principles rather than rely on the exemption. Customers who are APP entities should also use the Data Processing Addendum.

For account, billing, enquiry and security records, Lumevo decides why the information is handled. That is controller activity.

For Customer Content in a workspace — tasks, chat, library files, artifacts, approvals, connected mailbox contents, connector reads — Lumevo handles personal information on the Customer’s instructions. That is processor activity. The Customer’s own privacy policy and collection notices cover the people in that content (staff, customers, suppliers). Lumevo does not use Customer Content for Lumevo marketing.

Account and workspace membership

• name, work email, authentication identifiers, and email-verification status
• company membership, role (owner, manager, staff), and invitation records
• sign-in method (email and password, or Google)

Enquiries

• name, work email, company name, phone if provided, and the message
• whether the sender happened to be signed in, used only to understand lock-out enquiries

Workspace activity (processor records, on the Customer’s instructions)

• Ask AI messages and attachments, kept for 30 days after a thread goes quiet
• My Work tasks, input answers, drafts, review comments, approvals and completion records
• Company Library files and extracted text
• brand and design references used to format documents
• activity records visible to owners and managers

Connections

• encrypted mailbox refresh tokens for Members who connect Microsoft Outlook
• mail metadata and message content read for a task that Member owns
• read-only data from company connectors the operator has installed for that company

We do not ask for government identifiers, payment-card numbers, or health information as a product feature. A Customer might still put that kind of information into a file or an email. That is why the Acceptable Use Policy asks Customers not to upload sensitive information unless they have a lawful reason and have scoped it with us.

• directly from a person: contact form, registration, sign-in, invitations, chat, tasks, uploads, mailbox connection
• from the Customer: when an owner or manager invites a Member or uploads company files
• from providers: Google if used to sign in; Microsoft if a mailbox is connected; Base44 for authentication
• automatically: security logs, coarse request metadata, and the minimum cookies needed to keep a signed-in session

We do not buy marketing lists. We do not use advertising pixels or analytics packages on the public site. The site loads fonts from Google Fonts, which means Google may see the visitor’s IP address. Session cookies come from the authentication provider, Base44.

• to decide whether an enquiry is a fit for a focused pilot, and to reply
• to create and authenticate accounts, and to enforce invitation-only membership
• to run the workspace: drafts, tasks, review, approvals, automations, library retrieval
• to show owners and managers activity and access state
• to secure the service, investigate abuse, and recover from faults
• to invoice, collect GST, and keep tax records once paid services start
• to meet the law, including a notifiable data breach assessment if we are an APP entity

We do not sell personal information. We do not use Customer Content to train Lumevo-owned models. Workspace content is sent to the configured inference provider so the product can produce a draft. See the AI Use Disclosure and Subprocessor List.

Lumevo uses computer programs, including large language models, to draft replies, rank library passages, extract text from uploads, and move a task into a named state such as Needs Review or Needs Input.

Lumevo does not arrange for a computer program to make a decision that could reasonably be expected to significantly affect an individual’s rights or interests. It does not decide employment, credit, housing, immigration, insurance, or access to a significant government or health service. It does not send external communications or change external records without a person. A task cannot reach Done without a recorded human outcome.

If a Customer uses a Lumevo draft as an input to one of those decisions, that is the Customer’s decision, not Lumevo’s. The kinds of personal information that may appear in a draft are the kinds the Customer put into the workspace or allowed the AI to read.

Some providers are outside Australia. Before we disclose personal information to them we take the steps that are reasonable in the circumstances, including contracts and access control, as described in Australian Privacy Principle 8.

Recipients are likely to be located in:

• Australia — application server (Atlas), company files, and Hermes agent runtime
• locations used by Base44 for authentication, the dashboard, serverless functions, and contact-form email
• locations used by the database host (currently a Supabase-hosted PostgreSQL service; region to be confirmed in the Subprocessor List)
• United States and other regions used by Cloudflare for the tunnel and access layer
• United States (and any other Microsoft region for the mailbox) when a Member connects Outlook
• the region of the configured AI inference provider, which must be named in the Subprocessor List before paid production use

Exact country lists for Base44, Supabase and the inference provider are still an operator task. Until they are confirmed, treat overseas disclosure as likely and do not claim “Australia-only processing”.

Application files live in private server storage, not a public bucket. Connector and mailbox tokens are encrypted at rest. Identity and role are enforced on the server. AI turns run in a restricted subprocess. External writes go through a human approval gate and a server executor. Details and remaining risks are in the Data and Security Terms.

We do not claim SOC 2, ISO 27001, or “enclave isolation” as a certified state. Those words appear in unused prototype screens and are not part of the live product.

• Ask AI threads: purged 30 days after last activity
• enquiries: kept long enough to reply and to see whether the same person writes again, then deleted or archived with ordinary email retention
• account and membership records: for the life of the membership, then as needed for security and tax
• workspace tasks, library files, approvals and activity: for the life of the workspace, then as in the Terms when the workspace ends
• backups: bounded backup generations on the server backup cycle
• security logs: as long as needed to investigate incidents

The product does not yet offer a Member self-service download of everything we hold about them. Access and deletion requests are handled by email, as below.

You can ask for access to the personal information Lumevo holds about you, or ask us to correct it. Write to support@lumevo.digital. We will respond within a reasonable time, usually 30 days. There is no fee to make the request. We may need to confirm it is you, and for workspace content we may need the Customer owner to authorise the release.

If you have a privacy complaint, write to the same address first and give us a chance to fix it. If you are not satisfied, you can contact the Office of the Australian Information Commissioner (oaic.gov.au).

From 10 June 2025 a statutory tort for serious invasion of privacy exists in Australia. This policy does not limit that right.

We use enquiry details to reply about a possible pilot. We do not add people to a marketing list from the contact form. If we later send commercial electronic messages that are not just a reply to an enquiry, we will identify Lumevo, send only with consent or a fair inferred-consent relationship, and include a working unsubscribe facility.

Lumevo is a workplace product. It is not directed at children and is not an online service likely to be accessed by children for the Children’s Online Privacy Code. Do not invite anyone under 18 into a workspace.

First customers are Australian companies only. Lumevo does not currently offer the workspace to businesses or staff in the UK, EEA, New Zealand or California. Extra rules would apply there (UK GDPR / GDPR, New Zealand Privacy Act 2020, US state privacy laws). Do not onboard those people until the DPA and subprocessor terms have been checked for that transfer. Lumevo does not currently offer a GDPR adequacy solution or SCCs as a standard pack.

We will update this policy when the product or the law changes. The date at the top is the current version. Material changes that affect existing Members will be noted to the workspace owner.