Privacy Policy

01Who we are

This Privacy Policy explains how Lumetry (“Lumetry”, “we”, “us”) collects, uses, stores, shares, and deletes information when you use lumetry.ai, our applications, and related services (the “Services”).

Lumetry is a marketing analytics product. It connects to data sources you authorize, verifies figures against those sources, and produces dashboards, briefs, and recommendations. It is not an advertising network, data broker, or consumer-facing social app, and it is not directed at children.

The public Limited Use disclosure that Google OAuth reviewers look for is at lumetry.ai/google-api. Questions: privacy@lumetry.ai.

02What this policy covers

This policy covers account information, workspace data, connected-source data (including Google user data), cookies, and support communications. It applies to visitors, trial users, paying customers, and people invited into a workspace.

It does not cover third-party sites you reach from Lumetry, or the privacy practices of Google, Meta, Shopify, or other providers you connect. Those providers have their own policies.

03Information we collect

Account and contact details. Name, work email, company, role, phone number if you give one, password hashes (we do not store plaintext passwords), and billing details when you subscribe.

Workspace content. Client names, websites, goals, brand-profile fields, uploaded files, questions you ask, briefs, artifacts, and delivery settings (for example a Slack webhook or a report email).

Connected-source data. Metrics and configuration you authorize us to read from a provider — for example GA4 sessions, Search Console queries, Google Ads campaign performance, Merchant Center products, Business Profile locations, or Shopify orders. We only request a source after you start that connection.

Teammates. When you invite someone, we process their name and email to create the membership.

Technical and usage data. Browser, device, IP address, approximate region, referral URL, pages viewed, feature use, errors, and performance timings. We use these to keep the product up and to investigate abuse.

Demo and support. Information you send when you book a demo or email us.

04Google user data

Connecting a Google account is optional. You do it from Integrations, one Google product at a time, through Google’s consent screen. We do not require Google to create a Lumetry account.

We request only the scopes needed for the board you are connecting. Today those are:

• Google Analytics (GA4) — https://www.googleapis.com/auth/analytics.readonly. We read property reports (sessions, users, conversions, revenue, traffic sources, landing pages) to show the Analytics board and to verify figures in briefs.
• Google Search Console — https://www.googleapis.com/auth/webmasters.readonly. We read search analytics (queries, pages, countries, devices, search appearances) for the Search Console board and for cited answers.
• Google Ads — https://www.googleapis.com/auth/adwords. We read campaign, keyword, and account performance (spend, clicks, impressions, conversions, cost) for the Google Ads board. We do not create, edit, or pause campaigns.
• Google Merchant Center — https://www.googleapis.com/auth/content. We read merchant accounts, product listings, and product statuses so the Merchant Center board can show feed health. We do not insert or update products.
• Google Business Profile — https://www.googleapis.com/auth/business.manage. Google does not offer a read-only Business Profile scope. We use this grant only to list accounts and locations and to read listing details, hours, and review summaries. We do not edit listings, reply to reviews, or post updates.

We also call Google’s public PageSpeed Insights API with our own API key to score a website you have already identified. That call does not use your Google account.

A shorter, reviewer-facing statement of the same facts is on our Google API disclosure.

05Limited Use (Google API Services User Data Policy)

Lumetry's use and transfer to any other app of information received from Google APIs will adhere to the Google API Services User Data Policy, including the Limited Use requirements.

In plain language, that means:

• We use Google user data only to provide or improve user-facing features that are visible in Lumetry (dashboards, verified answers, briefs, artifacts, and scheduled reports you turn on).
• We do not sell Google user data.
• We do not use Google user data for advertising, retargeting, personalized ads, or ad measurement on behalf of anyone else.
• We do not use Google user data to train generalized AI or machine-learning models.
• We do not transfer Google user data to third parties except to the subprocessors named below, and then only to operate the Services under contracts that restrict their use of the data.
• Humans at Lumetry do not read Google user data unless you ask us to for support, we are investigating abuse or a security issue, we must comply with law, or the data is aggregated so it cannot identify you.
• We do not allow independent applications to access data we obtained from Google APIs.

06How we use information

We use information to:

• Create and secure your account and workspaces
• Connect sources you authorize and show the matching boards
• Verify figures against source data and refuse answers we cannot cite
• Draft briefs, recommendations, and artifacts for your workspace
• Send scheduled reports or alerts you configure
• Process billing on paid plans
• Respond to support and security reports
• Keep the product reliable, debug failures, and prevent abuse
• Meet legal obligations

We do not use personal information to sell ads. We do not build marketing audiences from Google user data.

07AI processing

Lumetry may send workspace context and authorized provider data to large language models (today via Perplexity, which may route to Anthropic or OpenAI models) to explain verified results, draft briefs, and help you interpret metrics.

Prompts are built for that request. We do not use Google user data to train generalized models, and we do not allow model providers to train on that data for their own products. When the connected data cannot support an answer, the product is designed to refuse rather than invent a number.

08When we share information

We share information only as needed to run the Services:

• With you and the teammates you invite into a workspace
• With subprocessors that host or process data for us (listed below)
• With a provider when you connect or disconnect that provider (for example, to complete OAuth or revoke a token)
• If required by law, legal process, or to protect the Services, users, or the public
• In a merger, acquisition, or asset sale, and then only with notice and, for Google user data, with the consent Google’s Limited Use rules require

We do not sell personal information. We do not share personal information for cross-context behavioral advertising.

09Subprocessors

These companies process data on our behalf to deliver the Services. They are not free to use it for their own advertising.

• Vercel — application hosting and edge delivery
• Supabase — authentication, database, and file storage
• Composio — OAuth connection broker and token refresh for Google and other connectors; tokens are stored by Composio and referenced from your workspace
• Upstash — short-lived caches of board payloads so dashboards stay fast
• Resend — transactional email (invites, magic links, scheduled reports)
• Perplexity (and the model providers it routes to, currently Anthropic and OpenAI) — drafting explanations and briefs from data you have already authorized
• Peec, Tavily, DataForSEO, and similar tools — only if you enable that integration

OAuth access tokens for Google are stored encrypted by the connection broker, isolated per workspace, and used only to call the APIs you authorized. Lumetry stores the connection identifier, the account or property you picked, and cached report results — not your Google password.

10Retention and deletion

We keep account and workspace data for as long as the account is active. Cached Google and other provider payloads are kept only long enough to render boards and briefs (typically minutes to a few days) and are replaced on the next refresh.

If you disconnect a Google source in Integrations, or revoke Lumetry in your Google Account permissions (https://myaccount.google.com/permissions), we stop calling that API and delete associated Google user data from our systems within 30 days, except for minimal records we must keep for law, billing disputes, or security (for example, that a connection existed).

If you close your Lumetry account, we delete or anonymize workspace data on the same 30-day schedule, subject to legally required retention such as invoices.

To request deletion, email privacy@lumetry.ai from the address on your account with the subject “Request Data Deletion.” You can also disconnect sources yourself in Integrations. We respond to verified requests within 30 days. See how to revoke Google access.

11Cookies

We use first-party cookies and similar storage to keep you signed in, protect the session, remember appearance preferences, and understand which features are used. You can block cookies in your browser; some features will then stop working.

We do not run third-party advertising cookies on lumetry.ai. We do not use Google user data to drop advertising cookies.

12Security

We use HTTPS in transit, encryption at rest on our hosts, workspace isolation (including database row-level security), admin-only connection management, and operational monitoring. Access tokens are not exposed to the browser.

No method is perfectly secure. If we become aware of a breach that affects your personal data, we will notify you without undue delay where the law requires it. Report suspected issues to security@lumetry.ai.

13International transfers

We and several subprocessors operate in the United States. If you access the Services from elsewhere, your information is processed in the U.S. Where required, we rely on appropriate transfer mechanisms (for example Standard Contractual Clauses) with those processors.

14Your rights

Depending on where you live (including the EEA, UK, and California), you may have the right to access, correct, delete, or export your personal information; to restrict or object to certain processing; to withdraw consent; and to lodge a complaint with a supervisory authority.

California residents may request the categories and specific pieces of personal information we have collected, and we do not sell or share that information as those terms are defined by the CCPA/CPRA.

To exercise a right, email privacy@lumetry.ai from the address on your account. We will verify the request and respond within 30 days (or the shorter period the law requires).

15Children

The Services are for people 18 or older and for business use. We do not knowingly collect personal information from children. If you believe a child has provided information, email privacy@lumetry.ai and we will delete it.

16Changes

We may update this policy. The current version will always be at lumetry.ai/privacy. If we change how we use Google user data, we will update this policy and the Google API disclosure, and we will ask you to consent again before we use that data in the new way.

17Contact

Privacy requests: privacy@lumetry.ai. Legal notices: legal@lumetry.ai. Security: security@lumetry.ai.

Operator of lumetry.ai, Hamilton County, Ohio, United States.