Use with ClaudeData Protection
Data Protection
Last updated: 4 October 2026
1. At a glance
- MCP Birth details sent through the MCP server are used for the calculation and not stored
- App Charts and conversations you keep in the app are stored in our database until you delete them
- App Answers in the app are written on your own model key, which we store encrypted
- We do not sell data, show ads, or train models on your content
- You can delete a chart, a conversation, your key or your whole account yourself, and ask us for a copy of everything
This page covers the practical side. The Privacy Policy has the full list of what we collect, why, how long we keep it and your rights.
2. Where your data lives
| Data | Stored | Also sent to |
|---|---|---|
| Email address and name | Our database | Resend, to email your sign-in codes |
| Charts App | Our database | OpenCage receives the place name you type. Anthropic, on your key, receives the chart details a question needs |
| Questions and answers App | Our database | Anthropic, on your key, to write the answer |
| Model key App | Our database, encrypted | Anthropic, when it is used |
| Birth details in an MCP call MCP | Not stored | Nobody. Your MCP client already holds them |
| API keys MCP | Our database, as a one-way hash | Nobody |
| Usage, analytics, security and error records | Our database | Nobody |
| Top-up requests App | Our database | Resend and our inboxes (including Gmail). PayHere, if you pay through its link |
| Demo requests Landing | Our database | Resend and our inboxes (including Gmail) |
| Site visits Landing | Umami, without an identifier. Google Analytics, with an identifier only if you say yes | Google, as our processor, not for advertising |
Our database runs on Railway in the United States. The operator can read it through an admin panel protected by its own secret. Every admin action is logged.
3. Safeguards
- In transit: every connection uses TLS (HTTPS)
- Keys: API keys are stored as SHA-256 hashes and shown once. Model keys are encrypted with AES-256-GCM and decrypted only to answer the owner’s questions
- Separation between accounts: every database query for personal data is limited to the signed-in account inside the query itself, not only in the page
- Sign-in: codes expire after 10 minutes, work once, allow five attempts, and are limited per email address and per IP address. The response is the same whether or not an address has an account
- Secrets: credentials are compared in constant time. The admin panel and service-to-service calls use separate secrets
- The MCP server: every request needs credentials. Each call runs in a fresh server that is discarded afterwards. Request size and monthly allowances are limited
- The sites: security headers stop framing and content sniffing and limit referrer data
- Errors: you see a plain message, never internal details
4. Outside services
These services process personal data for us, each only for the purpose shown and under its own data processing terms.
| Service | Where | Why |
|---|---|---|
| Railway | United States | Runs the database, the calculation engine, the agent, the MCP server and the sign-in service |
| Vercel | United States | Hosts lumin.guru, the docs and the app |
| Resend | United States | Sends sign-in codes, and forwards form submissions and top-up requests to us |
| Google (Gmail) | United States | A second inbox that receives copies of form submissions and top-up requests |
| Anthropic | United States | Writes the answers in the app's Ask, using the key you save. Called only when you save a key and ask a question |
| OpenCage | Germany | Turns the place you type into coordinates when you add a chart |
| PayHere | Sri Lanka | Takes payment for a top-up paid from outside Sri Lanka, through a payment link |
| Umami | Umami Cloud | Cookieless visit counts on lumin.guru and the docs |
| Google Analytics | United States | Visit counts on lumin.guru and the docs. Cookies only if you say yes; advertising features off |
5. International transfers
Lumin is operated from Sri Lanka and stores data in the United States. When data leaves the EU, the EEA or the UK, we rely on our providers’ data processing terms, which include the European Commission’s Standard Contractual Clauses (and the UK addendum) where the provider offers them. Ask us for details of the safeguard for a particular transfer.
6. If something goes wrong
- We contain and investigate the breach straight away
- We tell the supervisory authority where the law requires it, within 72 hours of learning of it under the GDPR
- We tell you without undue delay if it is likely to put your rights at high risk, and what you can do
- We record what happened and what we changed
7. Laws we follow
We work to meet Sri Lanka’s Personal Data Protection Act, No. 9 of 2022, the EU GDPR, the UK GDPR, the California Consumer Privacy Act as amended by the CPRA, and the ePrivacy rules on cookies. We do not sell or share personal information for cross-context behavioural advertising, and we use sensitive information you choose to give us only to provide the Service.
8. Requests and contact
To get a copy of your data, correct or delete it, or raise a concern, email us from your account’s address. We reply within 30 days and charge nothing.
contact@lumin.guru