Privacy Policy

1. Who we are

Lumin (“we”, “us”) is operated by Dineth, an individual based in Sri Lanka, who decides how your personal data is used and is responsible for it. You can reach us at contact@lumin.guru.

This policy covers:

• Landing lumin.guru and docs.lumin.guru, the website and the documentation, including the demo request form
• App app.lumin.guru, the app, where you save charts, ask questions, create API keys and request top-ups
• MCP mcp.lumin.guru, the MCP server, used from Claude and other MCP clients, from your own code with an API key, and from the Lumin plugin for Claude Code

A clause tagged with one of these labels applies to that surface only. Untagged clauses apply to all of them.

2. What we collect

2.1 Your account

You sign in with your email address and a six digit code we email you. There is no password and no sign-in through another company. We store your email address and the name you give us. Signing in to Lumin from Claude or another MCP client creates the same account from the same email address.

2.2 Charts you saveApp

A chart holds a name, a birth date, a birth time and whether it is known, the place name with its coordinates and UTC offset, the ayanamsa, and a gender. A chart can be yours or someone else’s, for example a partner you compare with. If you save another person’s details, you need their permission to do so.

2.3 Your conversationsApp

When you ask a question in the app we store the question, the answer and the calculations used to reach it, so you can come back to the conversation. Its title is the start of your first question. Questions can reveal things about your health, relationships or beliefs. We use them only to answer you and to show them back to you.

2.4 Your model keyApp

Answers in the app are written by a language model on a key you supply from Anthropic. We store that key encrypted (AES-256-GCM), with its last four characters so you can recognise it and the date you saved it. It is decrypted only to answer your own questions. You can remove it in Settings at any time.

2.5 Birth details sent through the MCP serverMCP

Your MCP client sends birth details with each tool call. We use them to compute the result and then discard them.

2.6 API keysMCP

For each key you create we store a one-way hash of it (never the key itself), its first few characters, the name you give it, your email address, and when it was last used. The full key is shown once, when you create it.

2.7 Usage records

Each tool call records the tool name, the time, whether it succeeded, how long it took, and whether it came from the app, an API key (with the key’s id) or a signed-in MCP client. A question in the app also records the model used, the tokens it consumed, an estimate of what that cost on your key, and how many rounds it took. These records never contain birth details, your question or the answer. We use them to count your monthly allowance and credits, and to show you your Activity and Usage.

2.8 Top-ups and paymentsApp

When you request a top-up we store the amount, the calls it buys, its status, your email address, a reply address if you give one, and your WhatsApp number if you give one. We arrange payment by email, and by WhatsApp only when you have given us your number. Payments from outside Sri Lanka are taken through a PayHere payment link. We never see or store your card details.

2.9 How you use the appApp

In the signed-in app we record which pages you open, how long you actively spend on them, how far you scroll, which page you came from and went to, loading speed, when a reading starts and how it ends, actions such as creating a chart or an API key, the error codes you are shown, repeated clicks on one control, and a short error message if the app crashes. Pages are recorded as their pattern (for example “a conversation”), never with your content. These records are tied to your account, kept in our own database, and never include anything you type, your birth details, your questions or your answers. No other company receives them.

2.10 Security and error records

Each sign-in session stores your IP address and browser user agent. To stop abuse we count sign-in code requests per email address and per IP address, and our sign-in service logs the address a code was requested for. When something fails we record the error, the page or request path, and your account id.

2.11 Forms on lumin.guruLanding

The demo request form collects your company, name, email address, phone number and a note. We store it in our database, so we can keep track of who is waiting on a reply, and email it to ourselves. Emails you send to contact@lumin.guru are kept in our inbox.

2.12 Visits to lumin.guru and the docsLanding

We count visits with Umami, which sets no cookie and keeps no identifier. It records the page, the referrer, the country, and the browser and device type. We also use Google Analytics. If you say yes when we ask, it sets cookies with a random identifier and records the pages you view, how you arrived, your approximate location and your device, so it can tell a returning visitor from a new one. If you say no, or have not answered, it records the page view without a cookie or identifier. Google processes this for us and does not use it for advertising. Change your answer on the Cookie Policy page.

3. How we use it

• To run the service: compute charts, answer your questions, keep your charts and conversations, and serve MCP and API requests
• To sign you in and keep your account safe: send codes, keep sessions, limit repeated attempts
• To count allowances and credits, and to arrange and record top-ups
• To answer you: reply to demo requests and support email
• To fix and improve Lumin: find errors, measure speed, and see which parts of the app are used
• To support you and stop misuse: the operator can open an account’s charts, conversations, visits and usage in our admin panel when handling a request you made, investigating an error, or looking into misuse. Every admin action is logged
• To tell you about the service: changes to these policies, your account, or your top-ups

We do not sell your data, show ads, or build marketing profiles. We do not train models on your charts, questions or answers.

4. Our legal bases

Where laws such as the GDPR, the UK GDPR or Sri Lanka’s Personal Data Protection Act, No. 9 of 2022 ask us to name a reason for each use:

• Providing what you asked for (contract): your account, charts, conversations, model key, API keys, MCP requests, allowances, top-ups and replies to your requests
• Legitimate interests: security records, rate limits, error records, usage records, app analytics and admin access, balanced against your interests and kept to what is described here
• Your consent: Google Analytics cookies on lumin.guru and the docs. You can withdraw it at any time on the Cookie Policy page
• Your explicit consent: for details that reveal your health, beliefs or relationships, which you choose to type into a question or a chart. You can withdraw it by deleting that conversation or chart
• Legal obligation: keeping payment records where the law requires it

5. How readings are produced

App In the app, Lumin’s agent computes every figure on our engine, then sends your question, the conversation so far and the chart details it needs to Anthropic on your key, and Anthropic’s model writes the answer. Anthropic handles that data under your own agreement with them.

MCP Through the MCP server, Lumin only computes and returns structured results. The model in your client (for example Claude) writes the reading, and your conversation is held by that client under its own privacy policy.

A reading is interpretation, not professional advice. We make no automated decision about you that has legal or similarly significant effects.

6. Who else receives data

We share personal data only with the services below, only for the purpose listed, and under their own data processing terms. We do not allow any of them to use it for their own purposes.

Your MCP client is not on this list because you choose it and it works for you: what you send it is covered by its own terms. We may also disclose data if the law requires it, or to protect Lumin or its users from fraud or abuse.

7. How long we keep it

8. Deleting your data and your rights

Delete your account in the app under Settings. That immediately deletes your charts, conversations, model key, sessions, app usage analytics, top-up requests and sign-in identity. It does not delete your API keys, so delete those first. What stays is listed in section 7. You can also delete a single chart (with its conversations), a single conversation, or your model key at any time.

Depending on where you live, you can ask us to:

• Access: send you a copy of the data we hold about you, in a machine-readable format (JSON). You can also download your tool call history from Activity
• Correct: fix inaccurate data. Charts and your name can be edited in the app
• Erase: delete data, including what section 7 says we keep
• Restrict or object: limit or stop a use based on legitimate interests
• Port: receive your data to take elsewhere
• Withdraw consent at any time, without affecting what was done before

Email contact@lumin.guru from your account’s address. We reply within 30 days, or sooner if your law requires, and charge nothing.

You can complain to the Data Protection Authority of Sri Lanka, or to the data protection authority where you live, for example in the EU, the EEA or the UK. California residents have the right to know, to delete, to correct and to non-discrimination. We do not sell or share personal information for cross-context behavioural advertising.

9. Children

Lumin is not for anyone under 16, and we do not knowingly collect their data. If we learn that an account belongs to someone under 16, we delete it. If you save a child’s chart as a parent or guardian, you are responsible for doing so.

10. Where your data is processed

Our database and services run in the United States. We operate from Sri Lanka, and the services in section 6 process data where listed. When data leaves the EU, the EEA or the UK, we rely on those providers’ data processing terms, which include the European Commission’s Standard Contractual Clauses (and the UK addendum) where the provider offers them.

11. Security

• TLS on every connection
• API keys stored as one-way hashes; model keys encrypted
• Every query for your data is limited to your account in the query itself
• Sign-in codes that expire, are single use and are limited per address and per IP
• A separate secret for the admin panel, and a log of every admin action
• Usage limits and request size limits on the MCP server

No system is completely secure. If a breach puts your data at risk, we tell you without undue delay.

12. Changes to this policy

We will update this page when our practices change and tell you about material changes in the app or by email. The date at the top shows the latest version.

13. Contact

Questions, or a request about your data:

contact@lumin.guru