In short: we keep only what we need to run your account, take payment and keep you informed if you asked us to. Bank statements you convert are processed in memory and not stored. Scanned pages are read in the UK and not kept. Documents sent for signing are stored securely in the UK until they are deleted. We never sell your data or use it for advertising.
Who we are
[Company legal name] Ltd (trading as Lumos), registered in England and Wales under company number [company number], registered office [registered office address], is the controller of the personal data described here, except where we process data on a business customer's behalf (see "Statements and documents you upload"). We are registered with the Information Commissioner's Office (ICO) under number [ICO registration number]. Contact us about privacy at hello@lumoshub.com.
What we collect and why
We don't make decisions about you by automated means that have legal or similarly significant effects, and we don't use your data for advertising or sell it to anyone.
Visiting our website
Our website, lumoshub.com, is hosted by Webflow. When you visit, Webflow and its content delivery network process your IP address and browser details to show you the pages and protect the site. The pages load fonts from Google Fonts, which means Google receives your IP address; Google does not set cookies for this. Our website does not use analytics or advertising cookies. If you fill in a waiting list form, Webflow stores what you entered on our behalf so we can contact you.
Statements and documents you upload
- Downloaded PDF statements are sent to our server over an encrypted connection, read in memory to produce your results, and discarded as soon as the results are returned to you. They are not saved to disk or to our database.
- Scanned statements are sent, encrypted, to our OCR provider Microsoft (Azure AI Document Intelligence), which reads them in its UK South data centre and deletes the document and extracted text within 24 hours.
- Handwritten notes are sent, encrypted, to our AI provider Anthropic, whose Claude model reads and organises them. Anthropic processes them in the USA, does not use them to train its models, and deletes them within 30 days. Lumos does not store your pages or the organised notes.
- PDF to Excel or Word, PDF Merge and PDF Split work in your web browser. Those files never leave your device.
- Documents you send for signing are stored, encrypted, in our private file store in London until they are deleted (see "How long we keep it"), so your signers can open them and we can create the signed copy.
- Statements can contain personal data about other people, such as payees, and occasionally information that reveals sensitive matters (for example payments to a health provider or a trade union). We don't analyse, profile or keep any of it.
- If you use Lumos for a business and upload documents about other people (such as your clients), you are the controller of that data and we act as your processor under our data processing agreement. If you use Lumos as an individual for your own documents, we process them as controller only to provide what you asked for.
If you have been asked to sign a document
If someone has sent you a document to sign using Lumos E-Signature:
- Who is responsible. If the sender is a business, such as your accountant, they are the controller and we process your details on their behalf. If the sender is an individual, we are the controller for providing the signing service. Contact the sender with questions about the document itself.
- What we collect. Your name and email address (from the sender); the document; when you opened, signed or declined it; your IP address and device or browser; the signature and initials you choose and anything you type into the boxes; that you agreed to sign electronically; and any reason you give for declining.
- Why. To let you sign, send you the signed copy, and create a signing certificate recording how and when the document was signed. The lawful basis is the sender's legitimate interests (or ours, where we are the controller) in having documents signed and being able to prove it.
- Who sees it. The sender, the other signers on the same document, and anyone the sender asks us to send the signed copy to. The signing certificate shows each signer's name, email, IP address, device and signing times.
- How long. Deleted 12 months after everyone has signed, or 30 days after a request is declined, cancelled or expires, unless the sender deletes it sooner. Copies people downloaded or were emailed are theirs to keep.
- Fonts. The signing page loads handwriting fonts from Google Fonts, so Google receives your IP address. Google doesn't set cookies for this.
Who we share it with
We use these suppliers to run Lumos. They may only use your data to provide their service to us.
We may also share information if the law requires it, to protect our rights, or with a buyer if our business is sold (in which case we will tell you).
International transfers
Some of our suppliers are based in, or may access data from, the USA. Where personal data leaves the UK, we make sure it is protected by UK adequacy regulations (including the UK Extension to the EU-US Data Privacy Framework where the supplier is certified) or by the UK International Data Transfer Agreement or Addendum. Ask us for details.
How long we keep it
Keeping it safe
Everything is encrypted in transit. Passwords are hashed. Statements are processed in memory and not written to storage. Documents sent for signing are stored encrypted in a private file store that only our server can access, and signing links are unique to each signer and stop working when a request closes. Access to our systems is restricted to the people who need it and protected by multi-factor authentication. Card details are handled only by Stripe and never reach our systems.
Your rights
You have the right to ask for a copy of your personal data, to have it corrected or deleted, to restrict or object to how we use it, to have it transferred to you or someone else, and to withdraw consent at any time where we rely on consent. To use any of these rights, email hello@lumoshub.com. We respond within one month, and there is no charge.
Complaints about how we use your data
You have the right to complain to us if you think we have not handled your personal data properly. Email hello@lumoshub.com or write to us at [postal address for complaints and notices]. We acknowledge data protection complaints within 30 days (usually much sooner), look into them without delay, keep you updated and tell you the outcome. Our complaints procedure has the details.
You can also complain to the Information Commissioner's Office at ico.org.uk/make-a-complaint or on 0303 123 1113. The ICO usually expects you to have complained to us first.
Children
Lumos is not for anyone under 18, and we don't knowingly collect children's data.
Cookies
We use only the storage needed to keep you signed in, remember your settings and take payment. See our cookies and storage notice.
Changes to this notice
We will update this notice if how we use data changes, and email customers about significant changes.