Privacy Policy — Lumova

This Privacy Policy explains how Lumova ("we", "us", or "our") collects, uses, and protects your personal information when you use our Platform.

1. Information We Collect

We collect information you provide directly:

Account information: name, email address, password (hashed)
Profile information: field of expertise, country of birth
Assessment responses and criterion evidence notes
Petition drafts and letter content you generate
Filing outcome data (if voluntarily submitted)

We also collect automatically:

Usage data: pages visited, features used, session duration
Device information: browser type, operating system, IP address
Cookies and similar tracking technologies (see our Cookie Policy)

2. How We Use Your Information

To provide, maintain, and improve the Platform
To personalise AI feedback and analysis to your specific profile
To process payments and manage your subscription
To send service-related notifications (policy updates, RFE alerts)
To improve our AI models using anonymised, aggregated patterns (only with your explicit consent via the Filing Outcomes feature)
To comply with legal obligations

3. Data Sharing

We do not sell your personal data. We share data only with:

Anthropic — AI processing (petition text and evidence notes are sent to Lumova's AI engine to generate feedback). Anthropic's API usage policies apply.
OpenAI — Embedding generation for semantic search features
Supabase — Database and authentication infrastructure
Stripe — Payment processing (we never see your full card number)
Service providers under confidentiality agreements, as necessary to operate the Platform
Law enforcement when required by applicable law

4. Data Retention

We retain your account data for as long as your account is active. If you delete your account, we will delete your personal data within 30 days, except where retention is required by law or legitimate business purposes (e.g., fraud prevention records).

5. Your Rights

Depending on your location, you may have the right to:

Access the personal data we hold about you
Correct inaccurate data
Request deletion of your data
Export your data in a portable format
Opt out of marketing communications

To exercise these rights, contact us at privacy@ebvisamadeeasy.com.

6. Security

We use industry-standard security measures including encryption in transit (TLS), encryption at rest, and row-level security in our database to protect your data. No system is perfectly secure — if you believe your account has been compromised, contact us immediately.

7. Children

The Platform is not directed at children under 18. We do not knowingly collect personal information from anyone under 18. If you believe we have inadvertently collected such data, please contact us and we will delete it promptly.

8. Cookies

We use cookies and similar technologies. See our Cookie Policy for details.

9. Changes to This Policy

We may update this Privacy Policy from time to time. We will notify you of material changes via email or an in-app notice at least 14 days before they take effect.

10. Contact

For privacy questions or requests, contact us at privacy@ebvisamadeeasy.com.