1. Introduction and Scope

This Privacy Policy (hereinafter "Policy") describes how Lumia Group International LLC (hereinafter "we," "us," "our," or the "Company") collects, uses, stores, shares, and protects personal data in connection with the Lumia API Gateway platform accessible at https://lumiarouter.com (hereinafter the "Platform" or "Service").

This Policy applies to all users of the Platform, including registered account holders, API consumers, administrators, and any natural person whose personal data is processed in connection with the Service. By accessing or using the Platform, you acknowledge that you have read, understood, and agree to the processing of your personal data as described herein.

This Policy is drafted in compliance with Regulation (EU) 2016/679 of the European Parliament and of the Council (General Data Protection Regulation, "GDPR"), the California Consumer Privacy Act (CCPA), and other applicable data protection legislation.

2. Data Controller

The data controller responsible for the processing of your personal data is:

Lumia Group International LLC

Email: contact@lumia-automation.com

For any inquiries regarding this Policy or the exercise of your rights, please contact us at the email address above.

3. Categories of Personal Data Collected

3.1 Account Data

1. Email address (required for registration and authentication)
2. Username / display name
3. Hashed password (stored using industry-standard bcrypt algorithm)
4. Account creation date and last login timestamp
5. User role and group membership
6. OAuth provider identifiers (GitHub user ID, if applicable)

3.2 Usage and Technical Data

1. API request logs: model identifier, input/output token counts, request timestamp, response latency, HTTP status code
2. IP address from which API calls and platform access originate
3. User-Agent string and browser/client information
4. Session identifiers and authentication tokens
5. Quota consumption and billing records

3.3 Financial and Transaction Data

1. Credit balance and top-up history
2. Transaction amounts, dates, and reference identifiers
3. Payment method type (no full payment card numbers are stored by us; payment processing is handled exclusively by third-party payment processors)

3.4 Communication Data

1. Support correspondence and inquiries
2. Notification preferences

3.5 Data Not Collected

We do not collect or store:

1. The content of your API prompts or model responses (these are proxied in real-time and not logged beyond metadata)
2. Biometric data
3. Data revealing racial or ethnic origin, political opinions, religious beliefs, trade union membership, genetic data, or sexual orientation

4. Legal Bases for Processing

We process your personal data on the following legal bases pursuant to Article 6(1) GDPR:

PurposeLegal Basis

Account creation and authentication

Performance of a contract (Art. 6(1)(b))

Service delivery (API proxying, routing)

Performance of a contract (Art. 6(1)(b))

Billing, quota management, invoicing

Performance of a contract (Art. 6(1)(b))

Security, fraud prevention, abuse detection

Legitimate interest (Art. 6(1)(f))

Compliance with legal obligations

Legal obligation (Art. 6(1)(c))

Service improvement and analytics

Legitimate interest (Art. 6(1)(f))

Marketing communications (if opted in)

Consent (Art. 6(1)(a))

5. Purposes of Processing

Your personal data is processed for the following purposes:

1. Service Provision: Creating and managing your account, authenticating your identity, processing API requests, routing to appropriate upstream models, and delivering responses.
2. Billing and Financial Management: Tracking token consumption, managing credit balances, processing top-ups, generating usage reports, and enforcing quota limits.
3. Security and Integrity: Detecting and preventing unauthorized access, abuse, fraud, denial-of-service attacks, and violations of our Terms of Service; maintaining audit trails.
4. Legal Compliance: Fulfilling obligations under applicable laws, responding to lawful requests from public authorities, and establishing, exercising, or defending legal claims.
5. Service Improvement: Analyzing aggregate usage patterns to improve platform performance, reliability, and feature offerings (performed on anonymized or aggregated data where possible).
6. Communication: Sending service-related notifications (quota alerts, maintenance windows, security advisories) and, with your consent, promotional communications.

6. Data Retention

We retain your personal data only for as long as necessary to fulfill the purposes described in this Policy, unless a longer retention period is required or permitted by law.

Data CategoryRetention Period

Account data

Duration of active account + 30 days after deletion request

API request logs (metadata)

90 days from the date of the request

Billing and transaction records

10 years (applicable US tax and commercial law)

Security logs (IP, failed auth attempts)

12 months

Support correspondence

3 years from closure of the inquiry

Upon expiration of the applicable retention period, personal data is irreversibly deleted or anonymized.

7. Data Sharing and Recipients

We do not sell your personal data. We may share your data with the following categories of recipients:

7.1 Service Providers (Data Processors)

1. Hosting provider: Zeabur / Tencent Cloud (infrastructure hosting, Silicon Valley, United States)
2. Upstream AI model providers: Anthropic, OpenAI, and other model providers (API requests are proxied; only the prompt content and technical headers are transmitted, subject to each provider's own privacy policy)
3. Payment processors: As applicable for credit top-ups
4. Email service: Resend (transactional email delivery)

7.2 Legal and Regulatory Disclosures

We may disclose your personal data if required to do so by law, court order, or regulatory request, or if we believe in good faith that such disclosure is necessary to:

1. Comply with a legal obligation
2. Protect and defend our rights or property
3. Prevent fraud or enforce our Terms of Service
4. Protect the personal safety of users or the public

7.3 Business Transfers

In the event of a merger, acquisition, reorganization, or sale of assets, your personal data may be transferred to the successor entity, subject to the same privacy protections described herein.

8. International Data Transfers

Your personal data may be transferred to and processed in countries outside the European Economic Area (EEA), specifically the United States (hosting infrastructure). Such transfers are carried out in compliance with Chapter V of the GDPR and are subject to:

1. Standard Contractual Clauses (SCCs) adopted by the European Commission (Commission Implementing Decision (EU) 2021/914)
2. Supplementary technical and organizational measures as necessary

You may request a copy of the applicable transfer safeguards by contacting us.

9. Data Security

We implement appropriate technical and organizational measures to protect your personal data against unauthorized access, alteration, disclosure, or destruction, including but not limited to:

1. Encryption of data in transit (TLS 1.2+)
2. Hashed passwords (bcrypt with appropriate work factor)
3. Access controls and principle of least privilege
4. Regular security assessments
5. Session management with secure, HttpOnly, SameSite cookies
6. Rate limiting and abuse detection mechanisms

No system can guarantee absolute security. In the event of a personal data breach likely to result in a high risk to your rights and freedoms, we will notify you and the competent supervisory authority in accordance with Articles 33 and 34 GDPR.

10. Your Rights

Under the GDPR, you have the following rights regarding your personal data:

RightDescription

Access (Art. 15)

Obtain confirmation of processing and a copy of your data

Rectification (Art. 16)

Correct inaccurate or incomplete data

Erasure (Art. 17)

Request deletion ("right to be forgotten")

Restriction (Art. 18)

Restrict processing in certain circumstances

Portability (Art. 20)

Receive your data in a structured, machine-readable format

Objection (Art. 21)

Object to processing based on legitimate interest

Withdrawal of Consent (Art. 7(3))

Withdraw consent at any time (without affecting prior processing)

Lodge a Complaint

File a complaint with your local data protection supervisory authority

To exercise any of these rights, please contact us at contact@lumia-automation.com. We will respond within one (1) month of receipt of your request, extendable by two (2) additional months for complex requests.

11. Cookies and Tracking Technologies

The Platform uses only strictly necessary session cookies for authentication purposes. We do not use:

1. Analytics cookies
2. Advertising or tracking cookies
3. Third-party social media cookies

For detailed information, please refer to our Cookie Policy.

12. Automated Decision-Making

The Platform does not engage in automated decision-making or profiling that produces legal effects or similarly significant effects on users within the meaning of Article 22 GDPR. Routing decisions (selecting upstream AI models) are purely technical and do not constitute profiling of individuals.

13. Children's Privacy

The Platform is not directed at individuals under the age of 16. We do not knowingly collect personal data from children. If we become aware that we have inadvertently collected data from a child, we will take steps to delete it promptly.

14. Changes to This Policy

We reserve the right to update this Policy at any time. Material changes will be communicated via email or a prominent notice on the Platform at least thirty (30) days before they take effect. Your continued use of the Platform after the effective date constitutes acceptance of the revised Policy.

15. Contact and Complaints

For any questions, concerns, or requests related to this Policy:

Lumia Group International LLC

Email: contact@lumia-automation.com

You also have the right to lodge a complaint with:

the relevant supervisory authority in your jurisdiction