We built Lumeairy on trust. That means being transparent about exactly what data we collect, how we use it, and how we protect it. No legalese. Real answers.
Effective Date: March 22, 2026 · Last Updated: April 2, 2026
Download PDF versionLumeairy is a managed AI operator service that deploys autonomous business operators for small businesses. We handle client communications, lead follow-up, outreach, and daily business operations on behalf of our clients ("Clients").
This Privacy Policy governs how Lumeairy ("we," "us," "our") collects, uses, stores, and protects personal information from:
By using our services, you agree to the practices described in this policy. If you do not agree, please discontinue use of our services.
We do not collect payment card numbers, government ID numbers, Social Security numbers, or sensitive health information. We do not install anything on your devices. Our operator runs entirely on Lumeairy's infrastructure.
We use the information we collect for one primary purpose: delivering the Lumeairy operator service you subscribed to. Specifically:
We do not use your data to train AI models. We do not use your data for advertising. We do not analyze your data in aggregate and sell those insights. Your data works for your business, not ours.
These are not guidelines or defaults. They are absolute commitments that apply without exception.
To deliver our service, we work with a small number of carefully selected sub-processors. Each is contractually bound to protect your data. All core infrastructure providers maintain their own SOC 2 Type II certifications.
We do not share your data with any providers beyond those necessary to deliver the service. Upon request, we can provide a full list of current sub-processors and their data processing agreements.
We take security seriously. Our infrastructure is built on SOC 2 Type II certified providers and we apply security best practices throughout our stack. While Lumeairy is a growing business and has not yet completed its own standalone SOC 2 audit, we operate at or above the control standards required — and we intend to complete a Type I audit when we reach scale.
All client data encrypted at rest using AES-256. API keys and credentials stored encrypted and never logged in plaintext.
All data transmitted over TLS 1.2+. HTTPS enforced with HSTS preload. No unencrypted connections permitted.
Row-level security on all database tables. Principle of least privilege applied. Each client's data is isolated from other clients.
X-Content-Type-Options, X-Frame-Options, X-XSS-Protection, and Referrer-Policy headers enforced on all web responses.
All tool actions are logged with timestamps. Logs retained for 90 days and available to Clients on request.
Any security incident affecting client data triggers a 24-hour notification obligation. Full incident reports provided within 72 hours.
If you discover a security vulnerability, please contact us immediately at shawn@lumeairy.com. We respond to all security reports within 24 hours.
You have the following rights regarding your personal information. To exercise any of them, contact us at shawn@lumeairy.com and we will respond within 5 business days.
If you are a contact in a Client's database and wish to be removed, contact the Client directly or email us at shawn@lumeairy.com and we will facilitate your removal.
When you cancel, we'll export everything we hold on your business and send it to you before deletion. You keep everything we built for you.
We use cookies minimally and only for functional purposes:
We do not use tracking cookies, advertising cookies, or third-party analytics cookies. We do not use Google Analytics or Facebook Pixel. We do not track you across other websites.
You can disable cookies in your browser settings. Disabling authentication cookies will prevent you from staying logged in to your dashboard.
If we make material changes to this Privacy Policy, we will notify active Clients via their daily briefing at least 14 days before the changes take effect. The updated policy will be posted at lumeairy.com/privacy with a new effective date.
For non-material changes (typo corrections, clarifications that don't affect how we handle data), we will update the policy and note the revision date without advance notice.
Your continued use of Lumeairy after the effective date of changes constitutes acceptance of the updated policy. If you disagree with any changes, you may cancel your service before they take effect.
We're a small team and you'll get a real answer. Email us directly.
shawn@lumeairy.com