Data Protection

Last updated: 16 May 2026

1. Our Commitment

Lumin is built on the principle that your data is yours. We collect only what is necessary to deliver precise KP astrology computations, we retain it for the shortest practical period, and we delete it completely when it is no longer needed.

Lumin operates two surfaces with different data shapes:

MCP the MCP server (mcp.lumin.guru), which is stateless and processes birth data per request without persisting it
Dashboard the developer dashboard (app.lumin.guru), which stores account data and the MCP API keys you create, tied to your sign-in

Clauses below are tagged with the relevant scope when they apply to only one product.

This page provides a detailed overview of how your data is protected, who processes it, and what measures are in place to keep it secure. It complements our Privacy Policy, which covers the legal basis for processing and your rights.

2. Data We Process

We categorise your data into the following groups, each with distinct handling requirements:

Account Data

Dashboard

Email, display name, profile picture

Received from Google during sign-in to the developer dashboard. Used to identify your account. Not shared with any third party beyond our authentication provider.

Birth Data

MCP

Date/time of birth, geographic coordinates, UTC offset, ayanamsa preference

Supplied with each MCP tool call by your client and processed in memory by the computation engine to produce the requested chart. It is not persisted to our database, and request bodies are not retained in logs. Lumin does not store birth data or build profiles from it.

MCP Tool Calls

MCP

Tool name, timestamp, authentication mode, key or user identifier

For each request to the MCP server we record a usage event for rate limiting, billing, and aggregate analytics. We do not log tool input parameters (which may contain birth data) or response bodies.

MCP API Keys

MCP

Hashed key, prefix, label, tier, owner email, optional expiry, daily counter

Created via the developer dashboard at app.lumin.guru. We store a one-way hash of the key, never the plaintext. The plaintext is shown to you exactly once at creation and is not recoverable afterwards.

Diagnostic Data

Error logs, usage events (anonymised), performance metrics

Collected to maintain platform stability and improve reliability. Error logs may include request paths and stack traces but never include your birth data or message content. Usage events are anonymised and aggregated.

3. Data Retention Schedule

We follow a strict retention schedule. Data is automatically purged when it reaches the end of its retention period.

Data	Scope	Retention	Trigger for Deletion
Account data	Dashboard	Active + 30 days	Account deletion
MCP request bodies & responses	MCP	Not stored	N/A
MCP usage events	MCP	90 days	Automatic expiry
MCP API keys (hashed)	MCP	Until revoked	Revocation, expiry, or account deletion
Error logs	Both	90 days	Automatic expiry
Usage statistics (anonymised)	Both	12 months	Automatic expiry

Key principle: Birth data sent to the MCP server is never stored. For the developer dashboard, we do not retain account data or API keys for longer than 30 days after you delete your account.

4. Your Rights

Under the GDPR, CCPA/CPRA, UK GDPR, and other applicable data protection laws, you have the right to:

AccessRequest a full export of all personal data we hold about you, delivered in a structured, machine-readable format (JSON).

RectificationCorrect any inaccurate account data we hold about you. Contact us to request a correction.

ErasureRequest complete deletion of your data. You can delete your account from the developer dashboard, which triggers removal of all associated data within 30 days.

PortabilityReceive your data (account details and API key metadata) in a portable format so you can transfer it to another service.

RestrictionRequest that we pause processing of your data while a dispute or concern is resolved.

ObjectionObject to processing based on legitimate interest. We will cease processing unless we have compelling grounds that override your interests.

Withdraw consentWhere processing is based on consent, withdraw it at any time without affecting the lawfulness of prior processing.

To exercise any right, email contact@lumin.guru. We will respond within 30 days. No fee is charged for standard requests.

If you are in the EU/EEA/UK and believe your rights have been violated, you may lodge a complaint with your local data protection supervisory authority.

5. Security Measures

We implement layered technical and organisational safeguards to protect your data:

Encryption

All data in transit is encrypted using TLS 1.2+ (HTTPS)
Database storage is encrypted at rest by our hosting provider
Authentication tokens are signed with secure algorithms (JWT with Supabase)

Access Control

Row-Level Security (RLS) on all user data tables, ensuring you can only access your own data
Admin operations require separate authentication and are audit-logged
Timing-safe comparison for sensitive credentials to prevent timing attacks

Platform Hardening

Security headers: X-Frame-Options (DENY), X-Content-Type-Options (nosniff), strict Referrer-Policy
Rate limiting on all API endpoints to prevent abuse
Request body size limits on the MCP server and computation engine to prevent resource exhaustion
CORS restrictions, ensuring only authorised origins can communicate with our APIs
Input validation with Zod schemas on all mutations

MCP-Specific Safeguards

MCP

Three authentication modes (anonymous, API key, OAuth 2.1) routed to separate endpoints with different rate limits
API keys stored as one-way hashes, never plaintext; verified with a short-lived in-memory cache
Stateless per-request execution: a fresh server and transport are created for each call and torn down on completion
Tool input parameters and response bodies are never written to logs or persistent storage

Operational Security

Graceful shutdown procedures on all services (no in-flight data loss)
Structured JSON logging with no sensitive data in production logs
Startup validation, so services fail fast if security-critical configuration is missing
Error sanitisation, so clients receive generic error messages, never raw stack traces

6. Data Processors

We work with a limited number of trusted service providers to operate Lumin. Each processor is bound by a Data Processing Agreement (DPA) and processes data only as instructed.

Processor	Scope	Purpose	Data Accessed
Supabase	Both	Authentication & database hosting	Developer dashboard account data; MCP hashed keys and usage events
Sentry	Both	Error tracking	Error context & stack traces (no birth data)
Hosting Provider	Both	Application hosting & delivery	Access logs, IP addresses

None of our processors use your data for their own purposes, model training, or any activity beyond what is specified in their DPA. We regularly review processor compliance and update agreements as regulations evolve.

7. Data Breach Response

In the event of a personal data breach, we will:

Investigate and contain the breach as quickly as possible
Notify the relevant supervisory authority within 72 hours of becoming aware of the breach (as required by GDPR)
Notify affected users without undue delay if the breach is likely to result in a high risk to your rights and freedoms
Document the breach, its effects, and the remedial actions taken
Review and improve our security measures to prevent recurrence

8. International Data Transfers

Some of our data processors operate in countries outside of your jurisdiction. When your data is transferred internationally, we ensure appropriate safeguards are in place:

Standard Contractual Clauses (SCCs) approved by the European Commission for transfers outside the EU/EEA
UK International Data Transfer Agreement or UK Addendum to the SCCs for transfers outside the UK
Adequacy decisions where the destination country has been recognised as providing adequate data protection

You may request details about the specific safeguards applied to your data transfers by contacting us.

9. Future: Local-Run Packages

We are developing local-run packages that will allow you to perform KP calculations entirely on your own device, without sending any birth data to our servers. When available, these packages will offer the highest level of data protection by design, so your data never leaves your machine.

We will update this page with details on local-run data handling when these packages are released.

10. Regulatory Compliance

Lumin is designed to comply with the following data protection frameworks:

GDPR (EU General Data Protection Regulation)
UK GDPR (United Kingdom General Data Protection Regulation)
CCPA/CPRA (California Consumer Privacy Act / California Privacy Rights Act)
ePrivacy Directive (regarding cookies and electronic communications)

We do not sell personal information as defined under CCPA/CPRA. We do not engage in cross-context behavioural advertising. We do not process sensitive personal information for purposes beyond what is necessary to provide the Service.

11. Contact Us

For data protection enquiries, requests to exercise your rights, or to report a concern:

contact@lumin.guru

We aim to respond to all data protection requests within 30 days.