lumenx SAS ("lumenx", "we", "our", "us") operates lumenx.ai, an AI-powered research interview platform. We are committed to protecting your privacy and complying with applicable data protection laws including the EU General Data Protection Regulation (GDPR), UK Data Protection Act, and US state privacy laws.
This Privacy Policy explains how we collect, use, protect, and share information when you use our services.
This policy applies to:
- Customers: Organizations that purchase and use our platform
- Website Visitors: Individuals who visit lumenx.ai
- Interview Participants: Individuals who participate in AI-conducted interviews
Key Terms:
- Personal Data: Any information relating to an identified or identifiable person
- Pseudonymization: Processing personal data so it can no longer be attributed to a specific person without additional information
- Processing: Any operation performed on personal data
3.1 Customer Information
Data collected:
- Account information: company name, contact person, email, phone
- Authentication data: email, hashed passwords
- Billing information: processed by our payment provider
- Usage data: feature usage, session information, support interactions
Legal basis: Contract performance and legitimate interests
3.2 Interview Data
We process interview recordings, transcripts, participant information and analytical outputs to deliver the agreed research service.
Data processed:
- Audio recordings: Original recordings may be retained after transcription. Voice-converted clips may be stored separately and retained after original recordings are deleted.
- Transcripts: Original transcripts and participant information may be retained alongside de-identified versions. Transcripts may contain personal information disclosed during an interview.
- Analysis results: Reports and other analytical outputs may contain personal information, including interview quotations.
De-identification and voice conversion may be applied as part of the service, but do not guarantee that all identifying information is removed. Pseudonymized data remains personal data where an individual can still be identified.
AI Processing: We use third-party AI services for voice conversations, transcription, analysis and other configured features. Processing and retention depend on the service, its configuration and the applicable agreement. Relevant inputs and outputs may also be retained in operational tracing systems used to support and troubleshoot the service.
Legal basis: The applicable legal basis depends on the purpose and arrangements for each study. Where we process interview data on behalf of a customer, that customer is responsible for establishing the applicable legal basis and informing participants.
Data retention: Retention depends on the data category, project arrangements and applicable contractual and legal requirements. Recordings, transcripts, reports, operational records (including model traces) and backup copies may have different retention periods. Deleting original audio does not by itself delete transcripts, reports, voice-converted clips or operational records.
You can request information about the retention arrangements applicable to your study, or request deletion, by contacting privacy@lumenx.ai.
3.3 Website and Technical Data
Data collected automatically:
- IP address and approximate location
- Browser type, device information, operating system
- Pages visited, referring sites, interaction data
- Cookies and similar technologies used by website services, including Google Analytics and the embedded Calendly booking tool
The website uses Google Analytics to measure visits and interactions. The booking page embeds Calendly to arrange meetings. These services may use cookies or similar technologies. You can manage cookies through your browser settings; blocking them may affect how these services work.
Legal basis: Legitimate interests in security and service improvement
4.1 Primary Purposes
We process data to:
- Provide our AI interview and analysis services
- Manage customer accounts and billing
- Ensure platform security and prevent fraud
- Improve our services and develop new features
- Comply with legal obligations
4.2 Pseudonymized Data
We process interview data to provide the research and analysis services agreed with the customer.
Any use for a separate purpose, including model improvement or cross-customer benchmarking, requires an appropriate legal basis, contractual permission where applicable, and clear information to affected individuals. Pseudonymization does not make interview data anonymous.
4.3 No Automated Decision-Making
We do not use personal data for automated decision-making or profiling that produces legal or similarly significant effects on individuals.
5.1 Service Providers
We share data with carefully selected service providers:
- AI service providers (for voice conversations, transcription, voice conversion, analysis and other configured features)
- Cloud infrastructure providers
- Payment processors
- Analytics and operational tracing providers
AI Service Data Protection: See Section 3.2 for how we use AI services and operational tracing. Provider retention and use of data for model training depend on the applicable service, configuration and agreement; API access alone does not establish a no-retention or no-training guarantee.
Sub-processor List: Available upon request
5.2 Legal Obligations
We may disclose data when required by:
- Law enforcement requests with proper legal authority
- Court orders or legal proceedings
- Protection of our rights, safety, or property
5.3 Business Transfers
In case of merger, acquisition, or asset sale, data may be transferred with appropriate protections.
We never sell personal data.
6.1 Rights by Jurisdiction
GDPR Rights (EU/UK Residents):
- Access your personal data
- Rectify inaccurate data
- Request erasure ("right to be forgotten")
- Restrict processing
- Data portability
- Object to processing
- Withdraw consent
US Privacy Rights (California, Virginia, Colorado, Connecticut, Utah):
- Know what personal information we collect
- Delete personal information
- Opt-out of sale (we don't sell data)
- Non-discrimination
- Correct inaccurate information
6.2 Exercising Your Rights
Email: privacy@lumenx.ai
- For requests under the GDPR, we respond without undue delay and normally within one month of receipt. Where a permitted extension is necessary, we explain the reason within that first month.
- CCPA response time: Within 45 days
- Verification: We may request information to verify your identity
- No fee unless requests are excessive or unfounded
Where lumenx processes interview data on behalf of a customer, we assist that customer in responding to your request and explain the appropriate route for handling it.
For Privacy Inquiries:
lumenx SAS
Privacy contact: Antoine Ferrere
Email: privacy@lumenx.ai