Privacy Policy

Lumoise is operated by Shllok Sahu, Dropekweg 2A, 12353 Berlin, Germany. We are the data controller for the personal data described here, and you can reach us at hello@lumoise.com or at the address in our imprint.

Account data. Your email address and password hash, held by our authentication provider so you can sign in.

Your brand profile. The website URL you give us and the description of your ideal customer we derive from it, so outreach can be written in your voice.

Lead data. Business contact details of the people you choose to contact, together with the messages sent and the replies received.

Billing data. Handled by Stripe. We never see or store your card details.

Waitlist data. While Lumoise is closed to signups, the home page collects your name and email so we can tell you when it opens. We also store a salted hash of your IP address, never the address itself, purely to stop one machine submitting the form hundreds of times.

If you connect a Gmail mailbox, Lumoise requests exactly one Gmail permission, and no others:

• gmail.send — to send your outreach and follow-ups from your own mailbox, so your recipients see your address rather than ours.

Lumoise cannot read your mailbox. We hold no permission to do so. Sending is the only thing we can do with your Google account.

Replies reach us because the outreach we send on your behalf sets a reply address we control, so a reply goes to us rather than to your inbox. We read those replies, which are messages addressed to us, to sort them and to show you the text. Mail sent to your own inbox never passes through Lumoise.

Reply text is sent to Anthropic's Claude API to sort it by intent and, when it looks interested, to draft the follow-up. Anthropic does not use data submitted through its API to train models.

Your Google refresh and access tokens are encrypted at rest with AES-GCM. You can disconnect the mailbox at any time from your Lumoise settings, which deletes the stored tokens, and you can revoke access independently at myaccount.google.com/permissions.

Lumoise's use and transfer of information received from Google APIs to any other app will adhere to the Google API Services User Data Policy, including the Limited Use requirements.

Specifically, we do not use Google user data for advertising, we do not sell it, we do not transfer it except as needed to provide the service you asked for or where required by law, and we do not allow humans to read it except with your explicit consent, for security purposes, to comply with applicable law, or where the data has been aggregated and anonymised.

We process your account and mailbox data to perform our contract with you (Art. 6(1)(b) GDPR). Waitlist entries rest on your consent instead (Art. 6(1)(a) GDPR), given when you submit the form; you can withdraw it at any time by emailing us, and we will delete your entry and any feedback attached to it. We process business contact data of the leads you choose to approach on the basis of legitimate interest (Art. 6(1)(f) GDPR, Recital 47), and every message we send carries a working opt-out link.

You have the right to access, correct, export or delete your data, to object to processing, and to complain to a supervisory authority. Ask us and we will act on it. Anyone who receives outreach through Lumoise can unsubscribe from the link in the message, which adds them to a permanent suppression list for that sender.

Our processors are Supabase (database and authentication), Stripe (billing), Anthropic (reply sorting and follow-up drafting), Brevo (receiving replies and sending notification email) and our hosting provider. Each processes data only on our instructions. We do not sell personal data to anyone.

We keep your account and campaign data for as long as your account is open. Delete your account and we delete the associated data, except where we must keep records for legal or accounting reasons. Suppression list entries are kept indefinitely on purpose, because forgetting them would mean emailing someone who asked us not to.

If this policy changes materially we will say so here and update the date above.