Privacy policy
1. Controller
Jürgen Deutschmann, Auerbergsiedlung 9, 8850 Murau, Austria
Phone: +43 660 4068222
Email: office@lumoai.at
2. Hosting and server logs
The site is hosted by World4You Internet Services GmbH. Technical server logs may be processed, including IP address, time, requested URL, referrer, browser and system information. This supports secure and stable operation.
3. Free website-readiness check
The check processes the entered website or business name, industry and publicly accessible content from the analysed website. Lumo may retrieve up to eight relevant pages selected from internal links and the public XML sitemap. Every page actually retrieved is listed in the report. Retrieved content is processed server-side through the OpenAI API to create the report. Public website content may contain personal data.
The application uses the OpenAI Responses API with application storage disabled (store: false). According to the applicable API data controls, API content is not used for training by default; limited retention may still apply for abuse and security monitoring. Do not submit confidential or non-public data.
4. Report data, trends and sharing
The report, website, industry, report time and a random retrieval token are stored for up to 180 days. Identical inputs reuse the same report within 24 hours. Later reports can be compared with the previous result.
Using or forwarding the share link makes the report accessible to anyone who has this non-guessable link. The public report does not contain an email address detected for follow-ups. Report links expire no later than 180 days. Industry values appear only after three different businesses have been checked and are shown as an aggregate average.
5. Email report and follow-up tips
The email sequence is optional and requires explicit consent plus link confirmation. The report is sent immediately after confirmation, followed by tips after approximately three hours, 24 hours and three days. The sequence then ends. Every message includes an unsubscribe link. A public email address detected on the checked site may be prefilled and must be verified before sending. Lumo images embedded in the messages are loaded from the LumoAi web server and may create ordinary image-request server logs. Consent, email, report and delivery status are automatically deleted no later than 180 days after registration unless legal duties or an active customer relationship require longer retention.
6. Products, orders, monitoring and Stripe payments
For an enquiry or order for Lumo Plan, Fix Pack, Lumo Strategy, Sprint or Lumo Monitor, data including name, email address, website, industry, selected product, order number, payment and fulfilment status, delivery times, confirmed B2B status, accepted terms version and acceptance time are processed. The product, price, billing type, delivery statement and service description are stored as an order snapshot. A secure result link and short delivery message may be stored and emailed for completed bespoke deliverables. Active customer data is retained as required by law and until the contract is fully completed; stand-alone enquiries that do not progress are generally deleted no later than 180 days.
For Lumo Monitor, the agreed publicly accessible pages are retrieved repeatedly, analysed through the OpenAI API and the readiness result, trend, report token, delivery status and technical errors are processed. The monthly report is sent to the supplied email address. Monitoring can be terminated or paused in the system.
Order-bound Stripe Checkout Sessions are used for enabled online payments. Stripe Checkout opens only after a deliberate click and processes the payment and transaction data needed for payment, fraud prevention, invoicing and fulfilment. Through a signed webhook, LumoAi receives data including payment status, amount, currency, checkout or subscription reference and an internal LUMO order number; complete card details are not stored in the LumoAi data store. For Lumo Monitor, payment failures or cancellations are processed to pause monitoring automatically. See the Stripe Privacy Policy for further information.
7. Cookies and partner attribution
The site uses a technically necessary session cookie for security, form protection and protected admin login. When the site is deliberately opened through a Lumo partner link, LumoAi also stores the first-party attribution cookie lumo_partner for no more than 30 days. It contains only the random partner code and is used to attribute checks, enquiries and confirmed payments to the referring partner. No third-party analytics, advertising or social-media cookies are set.
8. Interactions, campaigns, partners and WhatsApp
LumoAi stores selected, privacy-conscious server-side interaction events such as page view, check start and completion, score-card creation, product click, payment redirect, start request, completed quiz, video CTA, referral or partner visit, campaign parameters and clicks from follow-up emails or to WhatsApp. Partner code, partner name and related funnel events may be processed for partner links. No IP address is stored in this event data. Events support attribution, commission accounting and user-journey improvements and are deleted no later than 180 days.
WhatsApp opens only after a deliberate click. A prefilled message and, depending on the starting point, product, website, score or report link are then passed to WhatsApp. The message can be edited or discarded before sending. WhatsApp connects directly to a staff member; LumoAi does not send automated replies there. From that point, the privacy terms of WhatsApp or Meta apply. Merely displaying the button does not set a WhatsApp cookie or embed WhatsApp tracking code.
9. Recipients and transfers
Recipients or processors may include World4You as hosting and email provider and OpenAI as the AI API provider. Where processing occurs outside the European Economic Area, the transfer mechanisms provided by the relevant supplier are used.
10. Rights
Subject to statutory requirements, data subjects may request access, correction, deletion, restriction, portability and objection, and may withdraw consent for the future. Complaints may be submitted to the Austrian Data Protection Authority, Barichgasse 40–42, 1030 Vienna.
11. Security and updates
Appropriate technical and organisational safeguards are used. This information will be updated when functions, suppliers or legal requirements change.