LumiFamily Hub

Privacy Policy for Lumi

Version 1.0 – Last updated: 10 August 2026

The German version is the reference version of Lumi's Privacy Policy. Translations are provided for convenience and accessibility. In the event of a discrepancy, the German version prevails to the extent permitted by mandatory law. This does not restrict mandatory rights of data subjects.

1. Controller

Ing. Bernhard Flür
Spornbergerstraße 5 / C5.02
6130 Schwaz
AUSTRIA
Email: support@lumi-home.app

2. Scope

This Privacy Policy applies to the Lumi iPhone/iPad app, web application, backend and cloud services, user accounts, households, subscriptions, optional Apple/Microsoft integrations, AI features and support communications.

3. Principles

We process personal data only where necessary to provide, secure, bill and improve Lumi or where another legal basis applies. Household content is generally accessible only to authorised members of that household. We do not sell household personal data and do not use household content for advertising.

4. Account and sign-in

Lumi uses Sign in with Apple in particular. We may process an Apple user identifier, name, email or relay email, login metadata, Lumi user ID, session information and hashed or encrypted authentication/session tokens. Lumi does not store Apple account passwords.

Legal basis: Art. 6(1)(b) GDPR; security-related processing may additionally rely on Art. 6(1)(f) GDPR.

5. Households, members and people

We may process household name and ID, memberships, roles, display names, profile images, invitations, person profiles, settings and enabled modules. Authorised members of the same household may access and edit shared information according to their role.

Legal basis: Art. 6(1)(b) GDPR.

6. Household content

Depending on use, Lumi may process tasks, recurring chores, calendar entries, shopping lists, person and pet profiles, responsibilities, categories, due dates and other household information entered by users.

Legal basis: Art. 6(1)(b) GDPR.

7. Documents, contracts and reminders

We may process uploaded files, titles, filenames, categories, tags, folders, contract data, costs, deadlines, reminders, extracted document text and embedding/search data. Documents may contain personal data relating to users or third parties.

Legal basis: Art. 6(1)(b) GDPR.

Users should store particularly sensitive personal data only where necessary and lawful.

8. Photos, camera and files

Lumi may request device permissions for photos, camera or files. Content is generally transmitted only after the user selects it or performs an upload/share action. Permissions can be changed in the operating-system settings.

9. Outlook and Microsoft Graph

Users may optionally connect a Microsoft/Outlook account. Lumi may process connection identifiers, encrypted OAuth tokens, sender/recipient details, subject, message body, timestamps and message/attachment metadata. Attachment bytes are not stored as Lumi documents unless the user expressly chooses to save them.

Legal basis: Art. 6(1)(b) GDPR.

10. OneDrive

Users may optionally connect OneDrive as document storage. We may process Microsoft connection data, encrypted OAuth tokens, file/folder information and documents. Data stored in the Microsoft account is also subject to Microsoft's privacy terms.

Legal basis: Art. 6(1)(b) GDPR.

11. Push notifications

For push notifications Lumi processes APNs device tokens and technical delivery information. Delivery is handled through Apple Push Notification Service. Push permissions can be disabled on the device.

Legal basis: Art. 6(1)(b) GDPR.

12. Subscriptions and App Store purchases

Payments on Apple devices are processed by Apple. Lumi generally does not receive complete payment-card details. We may process product/plan ID, transaction identifiers, subscription periods, renewal/cancellation status, refund/payment status and the assignment of a purchase to a household.

Legal basis: Art. 6(1)(b) GDPR; legal retention obligations Art. 6(1)(c) GDPR.

13. Lumi AI

When Lumi AI is used, we may process user messages, chat history, assistant responses, relevant household information, document excerpts, mail information where used, tool calls, actions initiated by the assistant, token/usage data and model information.

Lumi does not automatically send the entire household to an AI model; the backend provides information needed for the relevant request or function.

Processing may use Microsoft Azure OpenAI / Microsoft Foundry Models. Under the terms applicable to those services, prompts and responses are not used to train public general-purpose foundation models on Lumi household data.

Legal basis: Art. 6(1)(b) GDPR.

When AI features are enabled, Lumi may use Azure AI Document Intelligence to extract document text and Azure OpenAI to create mathematical representations (embeddings) for semantic search.

Legal basis: Art. 6(1)(b) GDPR.

Where a user expressly enables or uses web search, a search query derived from the user's request may be sent to a Microsoft Azure/Foundry search service.

Legal basis: Art. 6(1)(b) GDPR.

16. Azure hosting

Lumi's central production services are operated on Microsoft Azure. The primary location of Lumi's production core is Sweden Central, Sweden. Depending on the final production setup, this may include the backend/API, PostgreSQL, account and household data, Blob Storage, Lumi documents, operational data and Log Analytics.

Microsoft processes this data under the applicable data-protection and data-processing terms agreed with us.

17. Azure AI data location

Sweden Central describes the location of resources deployed there. Individual Azure services may process data in other regions depending on the deployment model. Data Zone deployments may process within the applicable Microsoft data zone; Global deployments may process prompts and outputs outside Sweden and, depending on the service, potentially outside the EU.

18. Technical logs and security

We may process IP address, timestamp, requested API function, technical errors, status codes, version details, technical user/household identifiers and abuse indicators for operation, troubleshooting and security.

Legal basis: Art. 6(1)(f) GDPR. Under the current configuration, technical Azure logs are generally retained for 30 days.

19. Support

When a user contacts us, we process the information provided, such as name, email, request content, error descriptions, screenshots and device/version information.

Legal basis: Art. 6(1)(b) or (f) GDPR.

20. Administrative and support access

Administrative systems are separated from normal household access. Any access to personal data for support, security, troubleshooting or legal obligations is restricted to what is necessary.

21. Recipients and processors

Potential recipients/service providers include Microsoft (Azure, Graph, OneDrive, AI/OCR), Apple (Sign in with Apple, App Store, in-app subscriptions and APNs) and authorities or other bodies legally entitled to receive data.

22. International transfers

Lumi's central core is operated within the EU. Processing in other countries may occur in connection with Apple services, Microsoft account services, Microsoft Graph, certain Azure AI deployment models or global support/security services. Where Chapter V GDPR applies, we rely on an appropriate transfer mechanism, such as an adequacy decision or Standard Contractual Clauses with supplementary safeguards where required.

23. Retention

Account data is generally stored until account deletion; household data until deleted or the household is removed; documents until deleted; and chat history until deleted. Technical logs are generally retained for 30 days. Depending on the storage system, backup, recovery or soft-delete copies may remain for up to 30 days. Mandatory legal retention obligations remain unaffected.

24. Account deletion

Account deletion revokes Lumi sessions, ends memberships and deletes data directly associated with the account unless retention is legally required. If the user is the last member of a household, that household and Lumi-controlled content are scheduled for deletion. Shared data of a household that continues to exist generally remains. Data stored in an external OneDrive account may need to be deleted separately with Microsoft.

25. Data concerning other people

Users may enter personal information about other people only where this is lawful in the relevant private context. Any independent legal information or privacy obligations applicable to the user remain their responsibility.

26. Children and teenagers

Lumi is a family and household app and may contain child profiles. A child profile is not automatically a separate user account.

Children under 14 may use Lumi with their own account only with the consent of a parent or legal guardian. Where consent is legally required for specific processing involving a child under 14, that consent must be given by the parent or legal guardian. For users aged 14 and over, applicable rules on consent and legal capacity also apply.

Children's data is not used for personalised advertising.

27. Security

Depending on the system, safeguards include HTTPS, household/role-based access control, short-lived access tokens, rotating sessions, hashing, encryption of sensitive OAuth credentials, private cloud storage, Azure Managed Identities, network restrictions and security logging.

28. No solely automated decisions under Art. 22 GDPR

Lumi does not use solely automated decision-making that produces legal effects or similarly significant effects for users within the meaning of Art. 22 GDPR.

29. Data-subject rights

Subject to legal requirements, data subjects may have rights to access, rectification, erasure, restriction, portability, objection and withdrawal of consent.

Contact: support@lumi-home.app

30. Right to complain

For Austria in particular:

Austrian Data Protection Authority
Barichgasse 40–42
1030 Vienna
Austria

31. Required and optional data

Without data required for registration, authentication, household assignment and the relevant feature, Lumi cannot provide that feature. Optional integrations such as Outlook, OneDrive, push notifications or certain AI features are used only where the user activates them.

32. Changes to this policy

We may amend this policy if Lumi's features, technical services, data processing, legal requirements or infrastructure change. We will provide appropriate notice of material changes.

33. Contact

Ing. Bernhard Flür
Spornbergerstraße 5 / C5.02
6130 Schwaz
AUSTRIA
Email: support@lumi-home.app