Privacy Policy
Last updated: 28 October 2026
This Privacy Policy explains how LUMIDAY ("Lumiday", "we", "us") collects, uses and protects personal data when you visit lumiday.ai, request early access or use the Lumiday platform (together, the "Service").
1. Who we are
LUMIDAY, SAS, 38 rue des Mathurins, 75008 Paris, France, registered with the Paris Trade and Companies Register under number 108 184 516, is the controller of the personal data described in this Privacy Policy. You can contact us at {CONTACT_EMAIL}.
When our business customers use the Service to process data about their own clients, employees or partners, for example data from their Odoo database or other connected tools, the customer is the controller and Lumiday acts as its processor. That processing is governed by our Data Processing Agreement. If your data is processed in this way, please contact the relevant customer to exercise your rights.
2. Data we collect
Information you provide
- Account information: name, email address, password and, optionally, company name.
- Early access requests: your email address and the information about your business and needs that you choose to share.
- Billing information: name, billing address, VAT number and email address. Payment card details are collected and processed directly by our payment provider; we do not store them.
- Content: the messages, instructions, files and data you submit to the Service, and the content generated for you.
- Communications: the messages you send us.
Information from third parties
- Sign-in providers: if you sign in with Google or GitHub, we receive your name, email address and basic profile information.
- Connected tools: when you connect a tool such as Odoo, GitHub, Gmail or Slack, we access the data available through that connection to carry out your requests, and we store the credentials needed to maintain it.
- Public sources: publicly available information about your business, such as your website and logo, to personalise the Service.
Information collected automatically
- Usage and device data: features used, credits consumed, IP address, browser and device type, and log data.
Providing your account information is necessary to create an account. Without it, we cannot provide the Service.
3. How we use your data
| Purpose | Legal basis |
|---|---|
| Provide, operate and maintain the Service, including processing your requests with AI models | Performance of the contract |
| Create and manage your account and workspace | Performance of the contract |
| Manage billing, payments and invoices | Performance of the contract; legal obligation |
| Send service-related communications, such as invitations and account or security notices | Performance of the contract |
| Respond to early access and support requests | Legitimate interest; steps taken at your request before entering into a contract |
| Secure the Service and prevent fraud and abuse | Legitimate interest |
| Improve the Service using aggregated usage data | Legitimate interest |
| Comply with legal obligations and enforce our rights | Legal obligation; legitimate interest |
We do not sell your personal data or use it for advertising. We do not make decisions that produce legal or similarly significant effects on you based solely on automated processing.
4. Artificial intelligence
Lumiday uses third-party AI model providers to understand your requests and generate software, configurations and answers. The content needed to process each request is shared with these providers, which act as our sub-processors and are contractually prohibited from using it to train their models. We do not use your content to train AI models.
5. How we share your data
We share personal data only with:
- Service providers that process data on our behalf: cloud hosting and infrastructure, AI model providers, payment processing, authentication, code hosting and email delivery. The sub-processors that process customer data are listed in Annex III of our Data Processing Agreement.
- Tools you connect, at your direction. They process data under their own terms.
- Members of your workspace, who can see the projects and content shared in it.
- Authorities, where required by law or to protect our rights.
- A successor, in the event of a merger, acquisition or sale of all or part of our business. The successor remains bound by this Privacy Policy.
6. International transfers
Some of our service providers are located outside the European Economic Area, in particular in the United States. When personal data is transferred outside the European Economic Area, we rely on an adequacy decision of the European Commission, such as the EU-US Data Privacy Framework, or on the Standard Contractual Clauses approved by the European Commission. You can request a copy of these safeguards by contacting us.
7. Data retention
| Data | Retention period |
|---|---|
| Account information | For as long as your account is active, then deleted within 30 days of closure |
| Content and projects | For as long as your account is active, then deleted within 30 days of deletion of the project, workspace or account |
| Early access requests | Up to 3 years after our last contact with you |
| Usage data | For as long as your account is active, then up to 5 years |
| Invoices and accounting records | 10 years, as required by French law |
| Logs | 12 months |
Deleted data may remain in backups for up to 30 additional days. We may keep data longer where required by law or to establish, exercise or defend legal claims.
8. Security
We use industry-standard technical and organisational measures to protect personal data, including encryption in transit and at rest, access controls, isolation of customer environments, monitoring and regular backups. Access to personal data is limited to authorised personnel bound by confidentiality obligations. No system is completely secure. In the event of a personal data breach, we will notify the CNIL and, where required, the people concerned, as provided by the GDPR.
9. Cookies
We use only cookies and similar technologies that are strictly necessary for the website and the Service to work, such as keeping you signed in and remembering your interface preferences. These cookies do not require your consent. We do not use advertising or analytics cookies.
10. Your rights
You have the right to access, rectify and erase your personal data, to restrict or object to its processing, and to receive it in a portable format. Where processing is based on consent, you may withdraw your consent at any time. You may also give instructions on what happens to your data after your death.
To exercise your rights, contact us at {CONTACT_EMAIL}. We may ask you to prove your identity. We respond within one month, which may be extended in accordance with the GDPR.
You can also lodge a complaint with the French data protection authority, the CNIL (www.cnil.fr).
11. Children
The Service is intended for professionals and is not directed at children under 16. We do not knowingly collect personal data from children.
12. Changes to this Privacy Policy
We may update this Privacy Policy from time to time. The date of the latest version appears at the top of this page. We will inform you of significant changes by email or in the platform.
13. Contact us
LUMIDAY, 38 rue des Mathurins, 75008 Paris, France. Email: {CONTACT_EMAIL}