Data we collect: account data (email, name, age confirmation and the Terms/Privacy versions accepted); the content you choose to save in conversations, memory, plans, calendar, business records, map locations and private job photos; payment status from Stripe (never card numbers); feedback and essential security or technical logs.
Shared only with services needed to run features you choose: Stripe (payments), Supabase (authentication, database, Edge Functions and private file storage), Netlify (hosting), OpenAI (AI replies, web research, speech and transcription), OpenStreetMap/Nominatim and postcodes.io (address lookup), CARTO and Esri (map tiles), and Google Maps only when you deliberately open directions. Browser assets may be served by Google Fonts and pinned content-delivery providers until fully self-hosted. Some providers may process data outside the UK under their transfer safeguards. Do not put sensitive information into AI prompts unless you are comfortable with that processing.
Location processing: an address or postcode is sent to the selected lookup provider only when you search or map it. Saved coordinates, notes and uploaded photographs remain in your private Lumen account. Opening external directions sends the chosen coordinates to Google Maps.
Kept while your account is active; deleted within 30 days of account deletion (billing records kept 6 years per HMRC).
Security measures include encrypted transport, private storage buckets, per-account database rules, restricted server credentials, login throttling and access logs. No online service can promise zero risk.