1. Data controller
Lumio is a personal clarity mapping service operated by:
Mesut Tufan Güner
Offenbacher Landstraße 477
60599 Frankfurt am Main
Germany
Email: hello@lumio.company
2. What personal data we collect
Identity and contact information
- Full name
- Email address
- Age
- City and country
- Phone number (optional)
Your intake form responses
The intake form asks 29 open questions about your life, work and self-perception. Your answers may include life experiences and personal milestones; strengths, frustrations and goals; information about your relationships; and internal contradictions, fears and private aspirations.
You decide what to write. Nothing in the form is compulsory, and you are free to leave any question short or blank.
Please do not enter information about your health, your political or religious beliefs, your sexual life, or any other special category of data under Article 9 GDPR. Lumio does not need it and does not process it.
Payment information
Payments are processed by Stripe. Lumio never receives or stores your card details. We receive only the confirmation, the amount, and your email address.
3. How we use your data
We use your data only to:
- prepare your personal clarity report
- deliver the report to you
- arrange the optional follow-up call, if you booked one
- improve the service, using anonymised feedback only
We do not use your data for marketing or advertising, we do not sell it, we do not profile you, and no decision with legal or similarly significant effect is made about you automatically.
Legal basis. We process your data to perform the contract you entered into when you bought a report (Article 6(1)(b) GDPR). Where you gave a separate consent in the intake form, that consent is the basis and you may withdraw it at any time.
4. Who processes your data, and where
To run the service we use the following providers. Each acts as a processor on our instructions.
| Provider | What it holds | Where |
|---|---|---|
| Railway Corporation (San Francisco, USA) | The Lumio server itself: this website, the intake form, and your answers as you submit them | Amsterdam, Netherlands |
| Notion Labs, Inc. (San Francisco, USA) | Your client record, your answers, your report and its PDF | United States |
| Anthropic Ireland, Limited (Dublin, Ireland) | Your answers, while the report is being drafted | United States |
| Plus Five Five, Inc. trading as Resend | The emails we send you, including the report attachment | EU |
| Stripe Payments Europe, Ltd. (Dublin, Ireland) | Your payment and billing record | EU and United States |
| Squarespace Ireland Ltd. (Dublin, Ireland) | The lumio.company domain name and our business email address | EU and United States |
Transfers outside the EU. Notion and Anthropic process data in the United States, and Stripe and Squarespace may. Each of these providers has committed to the European Commission's Standard Contractual Clauses for those transfers, under a data processing agreement that forms part of our contract with them. Ask us at hello@lumio.company and we will point you to each one.
5. How long we keep your data
Your intake answers and your report are deleted 90 days after the report is delivered. After that, we keep only what we need for accounting and tax purposes under German law, which is the payment record held by Stripe. We no longer hold your answers or your report.
Ask earlier and we will delete sooner: write to hello@lumio.company and we will act within 30 days. Once deleted, we cannot send you the report again, so keep your own copy of the PDF.
6. How artificial intelligence is used
Lumio's reports are drafted with Anthropic's Claude, then read, edited and approved by a human before anything is sent to you. No report reaches you without a person having read it.
To be precise about what that means: every section of the report is drafted by the model from your answers, and every section is reviewed by Tufan, who edits what needs editing and decides whether the report goes out at all.
Anthropic's commercial terms state that it does not train its models on customer content submitted through its API.
7. Your rights
Under the GDPR and the Turkish KVKK you have the right to:
- access: ask what data we hold about you
- rectification: ask us to correct anything inaccurate
- erasure: ask us to delete your data
- restriction and objection: ask us to stop or limit processing
- portability: receive your data in a machine-readable form
- withdraw consent at any time, without affecting what was lawful before
Write to hello@lumio.company. We answer within 30 days.
9. Complaints
If you are unhappy with how we handle your data you may complain to a supervisory authority:
- Germany: Der Hessische Beauftragte für Datenschutz und Informationsfreiheit, datenschutz.hessen.de
- Turkey: Kişisel Verileri Koruma Kurumu, kvkk.gov.tr
10. Security
Data is transmitted over encrypted connections and stored with the providers listed in section 4, each of which encrypts data at rest. Access to your answers and your report is limited to Tufan.
If a data breach occurs that is likely to put your rights at risk, we will tell you and the supervisory authority as the GDPR requires.
11. Changes
We update this policy when the service changes. Significant changes affecting existing customers are communicated by email. The date at the top shows the current version.