Privacy Policy

Information collected depends on how you interact with the Platform (e.g., browsing, account creation, onboarding, AI feature usage, and subscriptions).

Information You Provide Directly

We may collect the following categories of personal and educational information when you create an account, onboard, or use the Platform:

Account Information

• Email address
• Password (stored in encrypted/hashed form)
• Name
• Account login credentials
• Student status, high school, and grade level

Academic & Application Data

• Essays, essay drafts, and essay revisions
• Activities, awards, and demographic information
• Test scores, GPA, course history, and AP classes
• College lists and application strategy information
• Practice answers, study data, uploaded documents and files

Communications

• Messages you send to us, support requests, and feedback submissions

Information Collected Automatically

We may automatically collect certain information when you use the Platform, including:

• Device information and browser type
• IP address and log data
• Usage activity, pages viewed, and feature interactions
• Event tracking data
• Local storage data, cookies, and similar tracking technologies

We use services such as Google Analytics and Firebase Analytics to collect and analyze usage information.

We use your information for the following purposes:

Service Delivery & Operations

• Provide, operate, and maintain the Platform
• Create and manage user accounts
• Deliver AI-powered features
• Analyze essays and academic content
• Generate feedback, suggestions, recommendations, and learning content

Platform Improvement

• Improve product functionality
• Monitor platform performance
• Conduct analytics and diagnostics

Communications & Support

• Send transactional communications and product updates
• Send marketing communications
• Provide personalized communications related to your submissions and reviews
• Provide customer support

Security & Compliance

• Ensure security and fraud prevention
• Comply with legal obligations

The Platform uses artificial intelligence technologies, including third-party AI models and services, to analyze user content and generate feedback, suggestions, recommendations, and educational outputs.

Model Training Policy

• User content is not used to train foundation AI models
• User data is not sold
• We do not allow third-party AI providers to train their models on your identifiable personal data
• We do not commercialize user content, academic data, or application data
• We may use aggregated, anonymized data strictly for internal analytics, platform improvement, system performance optimization, and service reliability

AI Output Disclaimer

AI-generated outputs are provided for educational and informational purposes only and do not constitute guarantees of admissions outcomes, institutional decisions, accuracy, completeness, or success in any academic or admissions process.

When you submit writing to LumiSource, we use it to provide your requested review, display feedback, support your use of the service, respond to questions, evaluate the quality of our feedback, and provide personalized communications related to your submission.

Submitted writing may be accessed by authorized LumiSource personnel when reasonably necessary for these purposes. Access is limited to personnel with a legitimate business need, and submitted writing must be handled confidentially.

We do not sell submitted writing, share it with schools or admissions offices, use it for third-party advertising, or use it to train or fine-tune AI models.

We may use service providers, including hosting, email, analytics, and AI-processing providers, solely as necessary to operate LumiSource and provide the service.

Payments are processed through third-party payment processors, including Stripe. LumiSource does not store your full payment card information. All billing and payment data is handled directly by Stripe and is subject to their privacy and security practices.

We may send transactional emails, account notifications, product updates, marketing emails, push notifications, and in-app notifications.

You may opt out of marketing communications at any time.

We do not sell your personal data.

We do not share user data with schools, colleges, universities, advertisers, data brokers, or third parties for commercial purposes.

We do not monetize user data, academic content, or application data in any form.

We may share data only with:

• Infrastructure providers (e.g., cloud hosting, databases, authentication services)
• Analytics providers
• AI service providers (strictly for feature functionality)
• Payment processors
• Email and notification services

All service providers are contractually obligated to protect user data and use it only for authorized purposes.

The Platform currently does not display third-party advertisements.

If advertising is introduced in the future, it will be contextual and non-behavioral by default, will not involve the sale of personal data, and will require clear user notice and legally required consent mechanisms.

We use cookies, local storage, pixels, and similar technologies to maintain sessions, authenticate users, store preferences, analyze usage, improve performance, and measure engagement.

You can manage cookies through your browser settings.

We retain user data only for as long as necessary to provide the Platform and fulfill the purposes described in this Privacy Policy.

Retention Principles

• Account data is retained while the account is active
• Data is deleted upon user-requested account deletion
• Backup systems may retain residual data for a limited period for recovery and security purposes
• Certain data may be retained where required by law, regulation, security, fraud prevention, dispute resolution, or legitimate business operations

Deletion requests are processed within a reasonable timeframe, subject to legal and technical limitations.

In the event of a data breach that compromises the security of your personal information, LumiSource will notify affected users in accordance with applicable laws and regulations. Notifications will include information about the nature of the breach, the data involved, and steps being taken to mitigate risks and prevent future incidents.

We implement industry-standard security measures, including:

• Encryption in transit and at rest
• Secure authentication systems
• Access controls and role-based permissions
• Secure infrastructure providers
• Monitoring, logging, and incident detection and response procedures

However, no system is 100% secure, and we cannot guarantee absolute security.

Depending on your jurisdiction, you may have the following rights regarding your data:

• Right to access your personal data
• Right to correct inaccurate data
• Right to delete your data
• Right to restrict processing
• Right to data portability
• Right to object to certain processing
• Right to withdraw consent
• Right to opt out of marketing communications

Requests can be made through account settings or by contacting privacy@lumisource.io. Requests will be verified and processed within a reasonable timeframe in accordance with applicable law.

LumiSource operates from the United States and processes data in jurisdictions where its infrastructure and service providers operate. By using the Platform, you consent to the transfer, storage, and processing of your information in the United States and other countries. We implement appropriate safeguards for international data transfers.

We may disclose information when required to do so by law, regulation, court order, subpoena, or other legal process, or when necessary to protect the rights, safety, and security of LumiSource, its users, or the public.

This Privacy Policy is designed to align with applicable data protection laws, including:

• General Data Protection Regulation (GDPR)
• California Consumer Privacy Act (CCPA)
• Children's Online Privacy Protection Act (COPPA)

Legal Basis for Processing (GDPR Users)

We process personal data based on one or more of the following legal bases: performance of a contract, user consent, legal obligations, and legitimate business interests.

The Platform is not intended for children under the age of 13.

We do not knowingly collect personal information from children under 13. If such data is discovered, it will be deleted in compliance with applicable laws, including COPPA.

This Privacy Policy applies solely to the LumiSource consumer platform (lumisource.io and related consumer services).

Separate privacy policies, data processing agreements, and FERPA governance apply to institutional and school-operated platforms, including schools.lumisource.io.

For the consumer platform, LumiSource is not a school, educational institution, or school service provider under FERPA. Users are responsible for ensuring their use of the Platform complies with any school or institutional policies.

We may update this Privacy Policy from time to time. Changes will be posted on this page and reflected in the "Last Updated" date.

For questions about this Privacy Policy or data practices, contact:

LumiSource
Email: privacy@lumisource.io