Privacy Policy
Last updated:
This Privacy Policy explains how Lumen Sieve ("we", "us", or "our") collects, uses, stores, and shares information when you use the Lumen Sieve platform and API (the "Service"). We are committed to handling your data with transparency, care, and respect.
1. Information We Collect
Account information
When you create an account, we collect your name, email address, and a hashed password. If you pay for a plan, our payment processor collects billing information on our behalf — we do not store raw card numbers.
API usage data
We log metadata about every API request you make: the endpoint called, the timestamp, your IP address, the HTTP status code returned, and the approximate response size. We do not log request bodies or the content of profile responses.
Correction submissions
If you submit a data correction via the API or dashboard, we collect the field path, the submitted value, and your account identifier so we can credit contributions and audit changes.
Communications
If you contact us by email or support ticket, we retain that correspondence to resolve your issue and improve the Service.
2. How We Use Your Information
We use the information we collect to:
- Provide, operate, and improve the Service.
- Authenticate your requests and enforce plan quotas and rate limits.
- Send transactional communications — account notifications, billing receipts, key expiry alerts, and security notices.
- Respond to support requests and resolve incidents.
- Monitor for abuse, fraud, and violations of our Terms of Service.
- Comply with legal obligations and respond to lawful requests from authorities.
- Analyse aggregate, anonymised usage patterns to guide product decisions.
We do not sell your personal data. We do not use your data to train or fine-tune machine-learning models without your explicit consent.
3. Data Retention
We retain data for the following periods:
| Data type | Retention period | Notes |
|---|---|---|
| Account data | Until account deletion | Export available on request |
| Generated profiles | 12 months from last access | Extended on Enterprise plans |
| API request logs | 90 days | Metadata only — no request or response bodies |
| Support communications | 3 years | Retained to resolve future escalations |
When a retention period expires or you request deletion, data is permanently removed from our systems and backups within 30 days.
4. Security
We protect your data with multiple layers of technical and organisational controls:
- All data in transit is encrypted over TLS 1.2+. Plain HTTP is rejected.
- All data at rest is encrypted with AES-256, with keys managed by a dedicated key management service with HSM backing.
- API keys are stored only as one-way hashes — not even Lumen Sieve engineers can read them.
- Database backups are encrypted with a separate, rotated key.
- Access to production systems is restricted by role, requires multi-factor authentication, and is logged.
For a full description of our security practices, see the Security documentation.
5. Sharing Your Information
We do not sell, rent, or trade your personal data. We share information only in the following circumstances:
- Service providers. We use a limited set of trusted third-party processors (for example, our payment processor, cloud infrastructure provider, and transactional email provider) under strict data processing agreements.
- Legal requirements. We may disclose information if required by law, subpoena, or a valid government order — and we will notify you where legally permitted to do so.
- Business transfers. In the event of a merger, acquisition, or sale of assets, user data may transfer to the acquiring entity, subject to the same privacy commitments.
- With your consent. We will share data for any other purpose only with your explicit consent.
6. Your Rights
Depending on your location, you may have the following rights regarding your personal data:
All users
- Access. Request a copy of the personal data we hold about you.
- Correction. Ask us to correct inaccurate or incomplete data.
- Deletion. Request deletion of your account and associated data. We process deletion within 30 days.
- Portability. Request your data in a machine-readable format.
EU/EEA users (GDPR)
You additionally have the right to object to processing, restrict processing, and lodge a complaint with your local data protection authority. Our legal basis for processing is primarily contract performance (to provide the Service) and legitimate interests (security, fraud prevention, and service improvement). A Data Processing Agreement (DPA) is available on request for organisations that require one.
California users (CCPA)
California residents have the right to know what personal information is collected, the right to delete it, and the right to opt out of its "sale" (we do not sell personal information). We do not discriminate against users who exercise their privacy rights.
To exercise any of these rights, email privacy@lumen.com from the address associated with your account. We respond within 30 days and may ask you to verify your identity before processing the request.
7. Cookies and Tracking
The Lumen Sieve dashboard uses a minimal set of strictly necessary cookies to maintain your authenticated session. We do not use third-party advertising or tracking cookies.
We do not currently use any analytics, tracking, or advertising tools on the marketing site. If that changes, this Policy will be updated first.
8. International Data Transfers
If you are located outside the region where your data is processed, your data may be transferred internationally. Where that happens, we rely on Standard Contractual Clauses (SCCs) or an equivalent legal mechanism to ensure adequate protection for the transfer.
9. Children
The Service is not directed to individuals under the age of 16. We do not knowingly collect personal data from children. If you believe a child has provided us with their data, please contact us at privacy@lumen.com and we will delete it promptly.
10. Changes to This Policy
We may update this Privacy Policy from time to time. Material changes will be communicated by email to the address on your account at least 14 days before they take effect. The "Last updated" date at the top of this page reflects the most recent revision.
11. Contact
For privacy-related questions, requests, or complaints, contact our privacy team:
Lumen Sieve Privacy Team
Email: privacy@lumen.com
For security vulnerability disclosures, use security@lumen.com instead.