Privacy Policy

Last updated: July 9, 2026

This policy explains what data LumioHR collects, why we collect it, and the rights you have over it. We keep it in plain language on purpose.

1. Who we are

LumioHR is operated by Mercy Maestro Goodrich, based in San Sebastián (Gipuzkoa), Spain. For anything related to your data, contact us at hello@lumio-hr.com. We are the data controller for the information described in this policy.

2. What we collect

Data	When	Why
Questions you type into Ask LumioHR	When you use the free chat or playground	To generate an answer and apply fair-use limits
Email address	When you join the waitlist or contact us	To contact you about early access and updates
Technical data (IP address, browser type, basic logs)	Automatically, when you visit	Security, abuse prevention, and keeping the site running

Please don't type personal details into Ask LumioHR. Ask your question in general terms (for example, "bereavement leave in Spain") without including names, ID numbers, health details, or other identifying information about yourself or colleagues.

3. Legal bases

Consent — when you join the waitlist or email us.
Legitimate interest — answering the questions you submit, preventing abuse of the free tier, and keeping the service secure.

4. Who processes data on our behalf

We use a small number of service providers to run LumioHR. They process data only on our instructions:

Netlify — website hosting and serverless functions
Supabase — database
Anthropic — AI model that generates answers to your questions
Tally — waitlist form

Some of these providers are based in or process data in the United States. Where that happens, transfers are protected by safeguards such as the EU–US Data Privacy Framework or Standard Contractual Clauses.

5. What we never do

We never sell, rent, or monetize your data.
Your conversations are never used to train AI models.
We don't share information between users or companies.

6. How long we keep data

Waitlist emails are kept until you ask to be removed or we close the waitlist. Chat inputs and technical logs are kept for up to 30 days for service operation and abuse prevention, then deleted.

7. Your rights

Under the GDPR you can ask us to access, correct, delete, or export your data, and you can object to or restrict our processing of it. Email hello@lumio-hr.com and we'll respond within 30 days. You also have the right to lodge a complaint with the Spanish supervisory authority, the Agencia Española de Protección de Datos (AEPD), at aepd.es.

8. Cookies and local storage

LumioHR does not use advertising or third-party tracking cookies. We may use essential browser storage strictly to make the site function (for example, remembering your language choice or applying free-tier limits).

9. Changes

If we change this policy, we'll update the date at the top. Meaningful changes will be highlighted on this page.