Legal

Privacy notice

What we collect on this website and in Lumina Leads, why we collect it, who helps us run the service, how we handle data from Google, Microsoft and Zoom, and the choices and rights you have.

Effective September 30, 2026

1. Who we are

Lumina Leads is a CRM and sales workspace for businesses. It is made by Lumina ERP, LLC, a Delaware limited liability company based in Houston, Texas. In this notice, “we” and “us” mean Lumina ERP, LLC.

This notice covers this website, lumina-leads.com, and the Lumina Leads service at luminaleads.app, including its other address leads.lumina-erp.com and its sign-in pages at login.lumina-erp.com. Our ERP consulting work and lumina-erp.com are covered by the Lumina ERP privacy policy.

Lumina Leads is sold to businesses and used by their staff. It is not a consumer product.

2. Whose information, and who decides

We handle information in two different roles.

Our own information: We decide how we use information we collect for ourselves. This covers people who visit this website or write to us, the account and sign-in details of people who use Lumina Leads, billing contacts, support conversations, and security and usage records. For this information we are the “controller” under European and UK law, and the “business” or “controller” under U.S. state privacy laws.
Workspace data: Each company that uses Lumina Leads decides how the data in its workspace is used. This covers its contacts, accounts, calls, texts, emails, meetings, documents and notes. For this data the company is the controller, and we are its “processor” or “service provider.” We handle workspace data only to provide, secure and support the service for that company, on its instructions and under our agreement with it.

If a company has your details in its workspace and you want to see, correct or delete them, please contact that company. If you write to us instead, we will pass your request on and help the company respond.

Data that comes from a Google, Microsoft or Zoom account you connect becomes part of your company’s workspace. We also follow the extra rules in Google user data and Calendar and Zoom connections, whoever controls the data.

3. What this website collects

This website sets no cookies and runs no analytics or advertising code.
If you choose a theme or pause the home page animation, your browser stores that choice on your device. It is not sent to us.
The service that hosts this website receives the technical details any website receives, such as your IP address, your browser and the page you asked for, so it can deliver the site and protect it from abuse.
When you send the contact form, we receive what you enter, such as your name, work email, company, team size and message, and which page of this site you sent it from. If the form hands your note to your own email app, we receive the email you send.

4. Business contacts we reach out to

We use Lumina Leads ourselves to email businesses that may want our products and services. These emails come from addresses at getlumina-erp.com. For this outreach, we decide how the information is used.

What we collect: Business contact details: your name, job title, company, business email address and business phone number, plus public information about your company, such as its industry, location and the software it uses.
Where it comes from: Public business sources, such as company websites, public business records and professional profiles, and what you tell us when you reply or meet with us.
Why we use it: To contact you about our products and services, to follow up on replies, and to keep a record of our conversations. We rely on our legitimate interest in telling businesses about our work.
Opting out: Every email has an unsubscribe link, and you can also reply and ask us to stop. We honor requests within 10 business days and add you to our do-not-contact list, which we keep so we do not contact you again.

We do not sell this information. You can ask us what we hold about you, or ask us to delete it, as described in Your choices and rights.

5. What we collect when your company uses Lumina Leads

For each kind of information, this list says what it is, where it comes from and why we use it.

Account and sign-in: Your name, work email, role and workspace, how you sign in (such as an email link, an email code, Google sign-in or single sign-on), and records of sign-ins and sessions. It comes from you, your admin, our sign-in provider Stytch and, if you use Google sign-in, Google. We use it to create your account, sign you in and keep your account secure.
Workspace records: The accounts, people, opportunities, tasks, notes, meetings and activity history your team keeps. It comes from your team, from files and HubSpot accounts your team imports or syncs, and from Cal.com bookings if your team connects Cal.com. We use it to provide the CRM to your company.
Email: Messages in a connected Gmail mailbox, email your team writes or sends from Lumina Leads, and unsubscribe requests made through our unsubscribe links. It comes from connected mailboxes, your team and the people who reply. We use it to link email to the right records, to send email your team writes or approves, and to honor requests to stop. See Google user data.
Calendar and meetings: Events from a Google or Microsoft calendar you connect, and Zoom meetings you create from Lumina Leads. It comes from your calendar or Zoom account. We use it to show your schedule next to your CRM meetings and to create meetings you ask for. See Calendar and Zoom connections.
Calls and texts: Phone numbers, call times, durations and outcomes, call notes, voicemails with their transcriptions, and the text messages your workspace’s phone numbers send and receive. It comes from Twilio, from your team and from the people who call or text. We use it to provide calling and texting.
Recordings and live transcripts: Call recordings and live call transcripts, only when your workspace turns them on. They come from the call. We use them to give your team a record of the call and live notes. See Calls, texts and recordings.
Documents and signatures: Documents your team sends for signature, and the names, email addresses and signing status of signers. It comes from your team and from SignWell. We use it to send documents and track signatures.
Do-not-contact list: Phone numbers and email addresses of people who asked not to be contacted. We store them only in a scrambled form (a keyed hash) that cannot be read back. They come from your team and from opt-out requests. We use them to block calls and email to people who asked us to stop.
Setup details: The answers an admin gives while setting up a workspace, and the public pages of your company’s website if the admin enters its address. We use them to suggest settings for your workspace.
Billing: If your company pays us, the billing contact’s name and email, the plan, seats and invoices. Stripe handles card details, and we do not see or store full card numbers. We use this to bill and to keep the records tax law requires.
Support and messages: What you send when you write to us or ask for help, and our replies. We use it to answer you and keep a record of the conversation.
Technical and security records: IP addresses, browser and device details, request logs and audit logs that record who changed what. They come from your browser or device and from our systems. We use them to run, secure and fix the service and to investigate abuse.
Notifications: If you turn on notifications, a token for your browser or device and the text of each notification. We use them to deliver the notifications you asked for.

6. How we use information

To provide Lumina Leads to your company, and to keep it secure and working.
To answer you when you write to us, and to send notices about your account and the service.
To help when you ask for support. If our support team needs to see what you see, they open a read-only session that ends after 30 minutes or sooner, and your workspace’s audit log records it.
To look into abuse, protect our users and the public, and meet our legal obligations.
To bill for the service, if your company pays us.

We do not sell personal information, and we do not share it for cross-context behavioral advertising (also called targeted advertising). We have not done either in the past 12 months. We do not use personal information to make decisions about you that have legal or similarly significant effects.

We do not use workspace data, or data from Google, Microsoft or Zoom, to train AI models.

7. Google user data

Lumina Leads connects to Google only when you choose to, in three ways.

Google sign-in: If you sign in with Google, we receive your name, email address and profile details from Google to identify you.
Google Calendar: If you connect your calendar, we handle it exactly as described in Calendar and Zoom connections.
Gmail: Gmail connection is currently limited to accounts in our own Google Workspace. When a mailbox is connected, Lumina Leads reads its messages to link them to the right records, creates drafts and sends email that the mailbox owner writes or approves, and reads the mailbox’s send-as addresses and signature so email goes out correctly.

We use Google user data only to provide and improve the features described here, which you can see in Lumina Leads. We do not sell Google user data. We do not use or transfer it for advertising, including retargeting and personalized or interest-based ads, to decide credit-worthiness or for lending, or to give it to advertising platforms, data brokers or information resellers.

We do not use Google user data to create, train or improve AI or machine learning models. Google Calendar data is never sent to an AI provider. If your workspace turns on AI drafting, the email being answered may be sent to Anthropic so it can write a draft or suggested reply for the person who asked. Anthropic may not train its models on that data.

We transfer Google user data to others only to provide those features (to the providers named in Service providers, under contracts that protect it), for security purposes such as investigating abuse, to comply with the law, or as part of a merger, acquisition or sale of our assets after we get your explicit consent.

People at Lumina do not read your Google user data unless you first agree that we may view specific data, for example when you ask for help with it; it is necessary for security, such as investigating a bug or abuse; it is necessary to comply with the law; or it has been aggregated and made anonymous for our internal operations.

Lumina Leads’ use of information received from Google APIs will adhere to Google API Services User Data Policy, including the Limited Use requirements. The use of information received from Google Workspace scopes will also adhere to the Google Workspace API User Data and Developer Policy.

You can remove Lumina Leads’ access to your Google Account at any time at myaccount.google.com/permissions.

8. Calendar and Zoom connections

You can connect your own Google Calendar, your Microsoft calendar (Outlook or Microsoft 365) and your Zoom account from Settings in Lumina Leads. Each person connects only their own account.

Google: We ask for your basic profile and email address, to know which account you connected; the list of your calendars; your free and busy times; and permission to view and edit events, so we can show your events and create, change or cancel events when you do that in Lumina Leads. We do not ask for Gmail access in this connection.
Microsoft: We ask for your basic profile and email address, permission to read and write your calendars, and permission to keep access while you are signed out (offline access) so the sync can run. If you use a work or school account, your organization’s administrator may need to approve Lumina Leads once.
Zoom: We ask for your Zoom user profile and permission to create, view, update and delete Zoom meetings. We do not ask for or receive recordings, chat messages or participant data.

What we store for each synced event:

the provider’s event id and calendar id
the title, start and end, time zone, and whether it is all-day
the location and the online meeting join link
the organizer’s and attendees’ names, email addresses and responses
its status (confirmed, tentative or cancelled), whether it shows as busy or free, a link back to the event, and when it was last updated

We do not store event descriptions or attachments.

We encrypt the access and refresh tokens that connect your account with AES-256-GCM before we store them. We use them only to sync your calendar and to do what you ask in Lumina Leads.

We sync events from 30 days in the past to 180 days ahead. The sync runs about every 15 minutes, and we remove events that fall outside that window.

Who can see your events:

You always see the full details of your own synced events in the Lumina Calendar, next to your CRM meetings.
Other people in your workspace see your events only as busy time, unless you switch sharing to “details.” Then they can see titles, times, places and join links.
Events you mark private or confidential in Google or Microsoft always show to others as busy time only.

Lumina Leads creates, changes or cancels an event or Zoom meeting only when you do that in Lumina Leads.

We do not send calendar or Zoom data to AI providers. We do not sell it, use it for advertising or use it to train AI models.

Disconnecting and deleting:

If you disconnect in Settings, or remove Lumina Leads from your Zoom account, we delete the stored tokens and that connection’s synced events right away.
If you revoke access at Google or Microsoft (work or school accounts, personal accounts) instead, we detect it at the next sync, about every 15 minutes, and then delete the tokens and synced events.
To remove Lumina Leads from Zoom, sign in to the Zoom App Marketplace, choose Manage, then Added Apps, and select Remove next to Lumina Leads.
Zoom meetings you already created stay in your Zoom account.

9. AI features

Admins decide whether their workspace uses AI features. When someone uses them to write a draft, a suggested reply or a batch of drafts, or turns on live call assist, we send the details needed, such as names, recent activity, notes, the message being answered or the live call transcript, to Anthropic, whose Claude models write the result.

Every AI-drafted email waits for a person to review and approve it before it is sent.

Lumina Leads learns your team’s preferred style from the edits people make to drafts. That learning is kept in your workspace and used only for your workspace.

Under its terms with us, Anthropic may not train its models on what we send it. We do not send calendar or Zoom data to any AI provider.

10. Calls, texts and recordings

Your company decides whether its calls are recorded or transcribed, and is responsible for giving callers any notice and getting any consent the law requires. Some states require every person on a call to agree before it is recorded.

Recording is off unless your workspace turns it on. An admin can record outgoing calls by default, or incoming calls on a phone line, and callers hear a recording notice first. A rep can also start recording on a connected call once the other person agrees.
Voicemails left for your team are stored with a written transcription.
Live call transcription is off unless an admin turns it on and approves a notice policy for each state and calling line. It runs only on calls within the United States. Depending on the law of the state involved, the policy can require a spoken notice, the other person’s consent, or neither where the law allows it. When the policy requires a notice or consent, Lumina Leads does not start recording or transcribing until it has been given.
When live transcription runs, call audio goes to ElevenLabs to be turned into text, and the text may go to Anthropic to prepare notes and suggestions for the rep.

We do not share mobile phone numbers, text-message opt-in data or consent with third parties or affiliates for their marketing or promotional purposes. Twilio and mobile carriers receive text messages only to deliver them.

11. Service providers

These providers help us run Lumina Leads. Each one handles personal information only to provide its service to us, under a contract that limits what it may do with it.

Cloudflare: Hosts this website and the service, stores its data, including call recordings, attachments, backups and exports, and sends email.
Stytch: Signs people in and keeps their sessions.
Twilio: Carries calls and text messages, provides phone numbers, and records voicemails and any calls your workspace records.
ElevenLabs: Turns call audio into text when live call transcription is on.
Anthropic: Provides the Claude AI models that write drafts, suggestions and call notes, when your workspace uses AI features.
TypeSafe: Suggests setup choices from an admin’s answers and your company’s public website, and helps match columns when someone imports records.
SignWell: Sends documents for e-signature and records signatures.
Google: Delivers push notifications to Android devices and browsers through Firebase Cloud Messaging.
Stripe: Processes payments and keeps billing records, if your company pays us.
Push services: The push service of your browser or device, such as Apple’s, Google’s or Mozilla’s, delivers notifications you turn on.

We keep inquiries and our replies in our own Lumina Leads workspace, so these providers handle messages you send us too.

We will update this list when we add or change a provider that handles personal information.

12. Services you connect

Some features exchange data with services your company or you already use. We exchange data with them only when someone in your workspace connects them, and only to run the feature. Their own privacy policies cover what they do with data.

Google: Google sign-in, Gmail and Google Calendar. See Google user data.
Microsoft: Microsoft calendars through Microsoft Graph. See Calendar and Zoom connections.
Zoom: Creating and managing Zoom meetings. See Calendar and Zoom connections.
HubSpot: Importing and syncing records from your company’s HubSpot account.
Cal.com: Receiving bookings made through your team’s Cal.com pages.

With your company. Admins of your workspace can see its records, its audit log and who is on the team.
When the law requires it, such as to answer a valid court order, and to protect the rights, safety and security of our users, the public and us.
If we are involved in a merger, acquisition or sale of assets, as part of that deal. The new owner must keep protecting the information as this notice says. For Google user data we will first ask for your explicit consent.
With your consent or at your direction.

14. Cookies and local storage

This website sets no cookies. It stores only your theme and animation choices in your browser, as described above.
The Lumina Leads app at luminaleads.app sets only the cookies that keep you signed in. The service needs them to work, and they are not used for advertising or to follow you across other sites. The app also keeps some preferences, such as your theme, in your browser.
Neither the website nor the app uses analytics or advertising cookies or tracking pixels.

Because we do not track people across other websites, we treat all visitors the same whether or not their browser sends a Do Not Track or Global Privacy Control signal. We do not sell or share personal information, so there is nothing to opt out of.

15. Security

Data is encrypted in transit and at rest. Tokens for connected Google, Microsoft and Zoom accounts are encrypted again, with AES-256-GCM, before we store them.
Each workspace is walled off from every other one, admins decide who can do what and how people sign in, and changes to records and settings are logged with who made them.
Support sessions are read-only, time-limited and recorded in the workspace’s audit log.
Only the people at Lumina who need access to run and support the service have it.

Our security page explains more. No system is perfectly secure. If a breach affects your information, we will tell you and your company as the law requires.

16. How long we keep information

Workspace data: We keep it while your company’s account is open. Your team can delete records at any time. When a workspace is closed, it stays in a 30-day closing period during which admins can export it or reopen it. After that, we permanently delete it.
Exports: Workspace export files are available to download for 7 days after they are created, and then expire.
Activity and audit logs: We keep activity history and audit logs while the workspace is open, and delete them with the workspace.
Calendar and Zoom: We keep synced events only within the sync window, and delete tokens and synced events when you disconnect or revoke access, as described in Calendar and Zoom connections.
Do-not-contact list: We keep it while the workspace is open, so requests not to be contacted keep being honored.
Messages to us: We keep messages you send us for as long as we need them to reply and to keep a record of our conversation.
Billing records: We keep them for as long as tax and accounting law requires.
Backups: Deleted data can remain in our encrypted backups until those backups are deleted. We use backups only to recover from a failure, and deleted data stays deleted if we do.

17. Your choices and rights

Whatever law applies to you, you can:

ask us for a copy of the personal information we hold about you, including in a portable format
ask us to correct or delete it
disconnect a Google, Microsoft or Zoom account at any time, which deletes its tokens and synced data as described above
turn notifications off in your browser or device settings
ask us not to contact you, and we will stop

Admins can also export the whole workspace, and correct or delete the records in it.

To make a request, email support@lumina-erp.com or write to us at the address below. We will check that the request comes from you, usually by writing to the email address on your account, before we act on it. Someone you authorize can make a request for you if they show us your signed permission and we can confirm your identity. We will not treat you differently for making a request.

We reply within the time the law allows, usually 45 days, or one month in Europe and the UK. If we need more time, we will tell you why.

If a request is about a company’s workspace data, we will send it to that company, because it decides what happens to that data.

If we turn down your request, you can appeal by replying to our answer or emailing support@lumina-erp.com with “Appeal” in the subject. We will answer the appeal within 60 days. If you are not satisfied with the result, you can contact your state attorney general or your data protection authority.

18. U.S. state privacy rights

California residents have rights under the California Consumer Privacy Act, including when they act for a business. You can ask to know what personal information we collect, use and disclose about you, and to get a copy of it; to delete it; to correct it; to opt out of its sale or sharing; and to limit the use of sensitive personal information. We do not sell or share personal information, and we use sensitive personal information only for the purposes the law allows, so there is nothing to opt out of or limit. You will not be treated differently for using these rights.

In the past 12 months, we collected these categories of personal information, from the sources and for the purposes described in What we collect:

Identifiers: Names, email addresses, phone numbers, IP addresses and account names.
Customer records: Contact details, and billing details if your company pays us.
Commercial information: Plans and billing history.
Internet activity: Sign-in records, request logs and how the service is used.
Audio and electronic information: Call recordings, voicemails and live call transcripts, when a workspace turns them on.
Professional information: Job titles, companies and business contact details.
Sensitive information: Account sign-in details, and the contents of email and text messages that connected mailboxes and phone numbers handle. We use these only to provide the service.

We disclosed each of these categories for a business purpose to the service providers in Service providers, and to connected services at the direction of your company. We did not sell or share any of them, and we have no actual knowledge of selling or sharing personal information of anyone under 16.

Texas, Virginia, Colorado, Connecticut, Utah, Oregon, Montana, Iowa, Delaware, New Hampshire, New Jersey, Nebraska, Tennessee, Minnesota, Maryland, Indiana, Kentucky and Rhode Island also have privacy laws. Most of them cover people acting in a personal or household capacity and do not cover people acting for a business, and some do not apply to small businesses. Even where a law does not require it, we will honor requests to access, correct, delete or get a copy of your personal information, with the appeal described above. We do not sell sensitive personal data, and we do not process personal data for targeted advertising or profiling.

If you are in the European Economic Area, the United Kingdom or Switzerland, Lumina ERP, LLC is the controller of the information described in Whose information as our own. For workspace data, your company is the controller.

We rely on these legal bases:

Contract: To provide the service under our agreement with your company or with you, including your account and the connections you set up, and to bill.
Legitimate interests: To answer inquiries, support users, keep the service secure, prevent abuse and improve how the service works. Our interest is running a secure, useful business service, and we weigh it against your rights.
Consent: Where we ask for it, such as when you connect a Google, Microsoft or Zoom account. You can withdraw consent at any time by disconnecting, without affecting what we did before.
Legal obligation: To keep records the law requires and to answer lawful requests.

You have the right to access your personal information, correct it, delete it, restrict or object to how we use it, including use based on our legitimate interests, and receive it in a portable format. You also have the right to complain to the data protection authority where you live or work, such as the UK Information Commissioner’s Office or the Swiss Federal Data Protection and Information Commissioner. We would like the chance to help first.

You need to give us your name and work email to have an account. Everything else is up to you and your company. We do not make decisions about you based solely on automated processing that have legal or similarly significant effects.

20. Where information is processed

We are based in the United States, and we process information in the United States. Our providers may process it in other countries where they operate. Cloudflare runs a global network, so requests may be handled near where you are.

We are not certified under the EU-U.S. Data Privacy Framework. When personal information from the European Economic Area, the United Kingdom or Switzerland goes to our providers, we rely on the transfer terms in our agreements with them, such as the European Commission’s Standard Contractual Clauses and the UK Addendum, or the provider’s own Data Privacy Framework certification.

If your company needs Standard Contractual Clauses for the data it puts in Lumina Leads, email documents@lumina-erp.com and we will put them in place with your company.

21. Children

Lumina Leads is made for businesses and is not directed to children. Everyone who uses it must be at least 18. We do not knowingly collect personal information from anyone under 16. If we learn we have, we will delete it.

22. Changes to this notice

We will update this page, and the date at the top, when our practices change. If we change this notice in a way that matters, we will email workspace admins before the change takes effect.

We will not use data we already have from Google, Microsoft or Zoom in a new way that this notice does not describe without first telling you and, where required, asking for your consent.

23. Contact us

For questions or requests about privacy, email support@lumina-erp.com. For formal legal notices, email documents@lumina-erp.com. You can also write to us at our mailing address. It is a mail service, not an office, so please do not visit.

Lumina ERP, LLC
8080 Westpark Drive, Ste 80341
Houston, TX 77063