LEGAL

1. Who We Are

Lumen is a product of Ocularity Analytics Private Limited, a Private Limited Company registered in India.

2. What Data We Collect

We collect only the data necessary to provide Lumen's services. This falls into three categories:

2a. Account Data

• Your name and email address (provided at registration or via Google OAuth)
• Your brand name and contact details
• Your WhatsApp number (if you use WhatsApp features)
• Your chosen subscription plan and account preferences

2b. Platform Data (via OAuth and API)

When you connect a third-party platform, we access data from that platform on your behalf to answer your business questions. We access only what is necessary:

We do not access, store, or process your end-customers' personal data (such as individual customer names, email addresses, or payment card details) beyond what is aggregated and anonymised within platform reporting APIs.

2c. Usage Data

• Questions and queries you ask Lumen (to generate answers and improve response quality)
• Session history and conversation logs
• WhatsApp message logs (inbound and outbound) where WhatsApp is used
• Feature usage patterns (to improve the product)

3. How We Use Your Data

• To provide the Lumen service — answering your business questions by fetching and analysing data from your connected platforms
• To personalise your experience — remembering context about your business to give better, more relevant answers over time
• To process payments — managing your Lumen subscription via Razorpay; processing renewals, refunds, and plan changes
• To deliver communications — sending answers, reports, and notifications via WhatsApp or email
• To operate and improve the platform — monitoring system health, diagnosing errors, and improving response quality
• To manage your account — billing, plan management, and customer support

We do not sell your data. We do not use your data for advertising. We do not share your data with third parties except as described in Section 5.

4. Google API Services — Limited Use Disclosure

Specifically, with respect to data obtained via Google APIs:

• We access Google Search Console data solely to display your own search performance metrics within Lumen
• We do not use Google user data to develop, improve, or train generalised AI or machine learning models
• We do not transfer Google user data to third parties except as necessary to provide the Lumen service
• We do not use Google user data for serving advertisements
• We do not allow humans to read Google user data unless you have given explicit permission, or it is necessary for security purposes, or required by law
• You may disconnect Google Search Console at any time from your Lumen settings, which will revoke our access and delete your stored Search Console data

5. Payments and Billing

Lumen uses Razorpay as its payment processor for subscription billing. Razorpay is a PCI-DSS compliant payment gateway regulated by the Reserve Bank of India.

• We do not store your card, UPI, or bank account details. All payment information is entered directly on Razorpay's secure payment interface and processed by Razorpay. Lumen never has access to your full card number, CVV, or banking credentials.
• We store only the transaction ID, payment status, amount, and plan details returned by Razorpay after a successful transaction.
• Subscription renewals are processed automatically by Razorpay on your billing cycle date. You will receive an email confirmation for every charge.
• Refund requests can be raised by contacting us at lumen@ocularityanalytics.com. Refunds are processed within 5–7 business days to the original payment method, subject to our refund policy.
• In the event of a payment dispute, Razorpay's dispute resolution process applies. We will cooperate fully with any chargeback or dispute investigation.
• Separately, brands may connect their own Razorpay accounts to Lumen for finance analytics. In this case, Lumen accesses your Razorpay transaction data in read-only mode solely to generate business insights. We do not initiate any transactions on your behalf through this integration.

6. Data Sharing and Third-Party Processors

We share data only with the following service providers, solely to operate Lumen:

We do not sell, rent, or trade your data with any third party for their own purposes.

7. Data Storage and Security

Your account data and conversation history are stored in Supabase (Mumbai region, India). Platform OAuth tokens are stored encrypted at rest. We implement the following security measures:

• HTTPS encryption for all data in transit
• HMAC-signed session cookies for authenticated dashboard access
• OAuth tokens stored server-side and never exposed to the browser
• Access controls limiting data access to authorised personnel only
• Two-factor authentication available for admin accounts

No method of transmission or storage is 100% secure. We take commercially reasonable steps to protect your data and will notify you promptly in the event of a breach affecting your personal data.

8. Data Retention

• Account data — retained while your account is active and for 90 days after closure
• Conversation history — retained while your account is active; you may delete individual sessions at any time
• Platform data — fetched on demand; not permanently cached except where required for performance (e.g. Microsoft Clarity data cached for up to 3 days)
• OAuth tokens — retained until you disconnect the platform or close your account
• Payment records — retained for 7 years as required under Indian tax and accounting law
• WhatsApp logs — retained for 12 months for support and audit purposes

9. Your Rights

• Access — request a copy of the personal data we hold about you
• Correction — request correction of inaccurate data
• Deletion — request deletion of your account and associated data
• Portability — request your data in a machine-readable format
• Withdrawal of consent — disconnect any platform integration at any time from your settings; this revokes our access immediately
• Objection — object to processing of your data in certain circumstances

To exercise any of these rights, contact us at lumen@ocularityanalytics.com. We will respond within 30 days.

10. Cookies

Lumen uses one cookie:

• lumen_user_session — a secure, HttpOnly, HMAC-signed session cookie used to authenticate your dashboard session. Strictly necessary for the service to function. Does not track you across other websites and contains no personal data beyond a session identifier.

We do not use advertising cookies, third-party tracking cookies, or analytics cookies.

11. Children's Privacy

Lumen is a business tool intended for adults operating commercial brands. We do not knowingly collect data from anyone under the age of 18. If you believe a minor has provided us with personal data, contact us and we will delete it promptly.

12. International Data Transfers

Ocularity Analytics Private Limited is incorporated in India. Your data is primarily stored in India (Supabase, Mumbai region). Some processing occurs in the United States (Railway hosting, Anthropic AI inference, OpenAI Whisper). Where data is transferred internationally, we ensure appropriate safeguards are in place through contractual arrangements with our service providers.

13. Changes to This Policy

We may update this Privacy Policy from time to time. When we do, we will update the "Last updated" date at the top of this page and, where changes are material, notify you by email. Your continued use of Lumen after changes are posted constitutes your acceptance of the updated policy.

14. Contact Us

For any questions, concerns, or requests relating to this Privacy Policy or your personal data: