1. Introduction
Lumenbase is operated by Cosmic Fantasy, LLC, a limited liability company registered in the State of Wyoming, USA, with its registered office at 30 N Gould St, Sheridan, WY 82801, USA. Cosmic Fantasy, LLC ("we," "our," or "us") is the data controller for the personal data described in section 1.1 below. This Privacy Policy explains how we collect, use, share, and protect your information when you use Lumenbase and related services.
1.1 Our roles under data protection law
We act in two distinct capacities:
- Controller for: your account data (e.g. name, email, password), billing and payment-related data, and marketing preferences. We decide why and how this data is processed.
- Processor for: CRM data (contacts, companies, deals, activities, and other data you upload or create in the platform). For this data, you are the controller and we process it only on your documented instructions (via our Terms of Service and our Data Processing Agreement).
Where we act as processor, we do not use your CRM data for our own purposes except as necessary to provide, secure, and improve the service.
1.2 Your responsibility for CRM data
You are responsible for having a lawful basis to collect and process any personal data you upload or sync into the platform, and for complying with applicable data protection laws (e.g. GDPR, CCPA) when doing so. We process CRM data on your behalf under our Data Processing Agreement, and will notify you without undue delay if we become aware of a personal data breach affecting it.
2. Information We Collect
We collect information you provide directly (e.g. account, profile, payment, and CRM data) and information we obtain automatically (e.g. logs, device, and usage data). The table below lists the main categories of personal data we process as controller, why, and the legal basis we rely on where the GDPR applies.
| Data category | Purpose | Legal basis (GDPR) |
|---|---|---|
| Account data (name, email, password) | Account creation, authentication, account management | Contract performance |
| Profile / workspace data (company name, job title) | Providing the service, support, billing | Contract performance |
| Payment / billing data | Processing payments, invoicing, fraud prevention | Contract performance; legal obligation |
| Marketing preferences and communications | Newsletters, product updates, marketing (where consented) | Consent; legitimate interest (where applicable) |
| Logs, device and usage data | Security, availability, analytics, product improvement | Legitimate interest |
| Marketing site visitor data (anonymous ID, pages visited, links clicked, approximate location from IP, device, browser, and language) | Understanding how our marketing site is used and improving the product; linked to your account if you sign up | Legitimate interest; consent where required by law (e.g. EU/EEA) |
| CRM data (contacts, companies, etc.) | Processed on your behalf as processor; we do not use for our own purposes | N/A (you determine legal basis as controller) |
Providing data. Account and billing data are needed to provide the service; without them we cannot create or maintain your account. Optional data, such as marketing preferences, can be refused or withdrawn at any time without affecting the core service.
Automated decision-making. We do not use your personal data for automated decision-making or profiling that produces legal effects or similarly significantly affects you.
2.1 Lumenbase Capture browser extension
The Lumenbase Capture Chrome extension connects LinkedIn pages you visit to your Lumenbase workspace once you link your account.
What the extension accesses
- LinkedIn pages: When you browse linkedin.com while logged in, the extension can read profile and messaging information on pages you view, such as names, headlines, companies, and conversations you choose to capture.
- Local storage: Captured data is stored locally in your browser until you sync or remove it.
- Lumenbase account link: Connecting the extension issues a token so it can send data to your workspace over an encrypted connection.
- LinkedIn session: The extension checks your LinkedIn session to confirm you are logged in. It does not send LinkedIn cookies to third parties.
How extension data is used
Extension data is used only to show CRM status on LinkedIn and to sync contacts and conversations to your workspace at your direction. We do not sell it or use it for advertising. Synced LinkedIn data is CRM data we process on your behalf (see Section 1.1).
Your choices
You can disconnect the extension in Lumenbase Integrations or uninstall it from your browser, which removes its locally stored data. Data already synced stays in your workspace until deleted; you may request deletion via privacy requests or privacy@lumenbase.io.
3. How We Use and Share Your Information
We use the information we collect to provide, maintain, secure, and improve the service, process payments, send service and support messages, and respond to requests. We do not sell your personal data. We share data with subprocessors that help us run the service, under appropriate contracts (see Section 10), and where required by law or to protect our rights and safety.
AI Processing
Features such as the Lumo assistant, contact enrichment, email drafting, and meeting summaries use third-party AI providers. When you use them, the relevant data (for example contact details, deal information, or meeting transcripts) is sent to those providers, which process it as our subprocessors under data processing agreements. They are named in our subprocessor list.
Audio and Meeting Recording
When enabled, the Lumenbase Capture extension can record audio from video meetings you join on supported platforms (Google Meet, Microsoft Teams, Zoom) and send it to our transcription provider. You are responsible for informing participants and obtaining any consent the law requires.
4. Google User Data (Gmail and Google Calendar)
When you connect a Google account in Integrations, Lumenbase accesses data from Google APIs to run the Gmail and Google Calendar features you enable. This section applies in addition to the rest of this policy.
Limited Use. Lumenbase's use and transfer to any other app of information received from Google APIs will adhere to the Google API Services User Data Policy, including the Limited Use requirements. We do not use Google user data for advertising, we do not sell it, and we do not use it to train generalized or third-party AI or machine-learning models. Humans do not read your Google user data except with your explicit consent for a specific message, where required for security or to comply with applicable law, or where the data has been aggregated and anonymized.
What we access and why
- Email address (userinfo.email): to identify which Google account is connected.
- Gmail read (gmail.readonly): to sync messages exchanged with your CRM contacts onto their timeline. We read message headers and content to match them to contacts, companies, and deals.
- Gmail send (gmail.send): to send emails to contacts on your behalf when you compose them inside Lumenbase. Sent messages appear in your Gmail Sent folder.
- Google Calendar (calendar.readonly, calendar.events, calendar.freebusy): to sync calendar events into your CRM as meetings, create or update events you make in Lumenbase, and check free/busy availability.
How we store and protect it
OAuth tokens are stored encrypted and used only for your own connection. Synced email and calendar content is stored as CRM data in your workspace and processed on your behalf (see Section 1.1). We use Google user data only to provide and improve the features you enabled, and where strictly necessary for security, abuse prevention, or legal compliance.
How you stay in control
You start the connection and approve each permission on Google's consent screen. You can disconnect at any time in Integrations, which stops syncing and deletes stored tokens, or revoke access from your Google Account. Records already synced stay in your workspace until deleted; you may request deletion via privacy requests or privacy@lumenbase.io.
4.1 Slack data
When a workspace admin connects Slack in Integrations, Lumenbase accesses data from the Slack API to run the features you turn on. This section applies in addition to the rest of this policy.
We do not use Slack data for advertising, we do not sell it, and we do not use it to train generalized or third-party AI or machine-learning models.
What we access and why
- Messages in synced channels: message text, sender name and Slack user ID, and timestamp, only for channels an admin has mapped and Lumo has been invited to. They appear on the timeline of the mapped company or deal.
- Channel names: to show which channel a mapping refers to.
- Member names and email addresses: to match Slack accounts to Lumenbase users.
- Messages that mention @Lumo: to answer the question. Lumo replies in a thread in that channel.
- Messages Lumenbase sends: notifications, reminders, and automation messages to the channels you configure.
What we do not access
We do not read unmapped channels, direct messages between colleagues, files, or reactions.
How we store it and for how long
Synced messages are stored as activities in your workspace, under the same access controls as your other CRM data, until an admin purges them or the workspace is deleted. Slack tokens are stored encrypted and deleted when you disconnect, uninstall the app, or Slack revokes them.
How you stay in control
Only workspace admins can connect Slack, map channels, or stop a mapping, and they approve each permission on Slack's consent screen. Disconnecting in Integrations revokes and deletes our tokens. Messages already captured stay until purged or the workspace is deleted; you may request deletion via privacy requests or privacy@lumenbase.io.
4.2 Email open tracking
Open tracking is off by default. A Lumenbase user can turn it on for mail they send from Lumenbase, and for mail they write in Gmail or Outlook with the Lumenbase Capture extension. A workspace admin can turn it off for the whole workspace.
When it is on, each tracked message carries a small image. When the recipient's mail app loads it, we record that the message was opened, when, and an approximate type of request. We use the IP address only to prevent abuse and do not store it.
Opens are shown to the sender and to workspace members who can see the sent message. Turning tracking off stops recording opens.
The sender decides whether to track and is responsible for having a lawful basis, including any consent the law requires, to track opens on mail to their recipients. Recipients can prevent tracking by blocking remote images in their mail app, and can contact privacy@lumenbase.io about open data we hold.
5. Data Retention
We retain personal data only as long as necessary for the purposes set out in this policy or as required by law.
- Account data: For the duration of your account plus a reasonable period after closure (e.g. 30-90 days) unless a longer period is required for legal, regulatory, or dispute-resolution purposes.
- Billing / financial records: As required by applicable accounting and tax laws (often 7 years or more).
- Logs and security-related data: Typically up to 12 months, unless a shorter or longer period is needed for security, legal, or compliance reasons.
- Marketing site visitor data: Typically up to 24 months, for analytics and product improvement. If you sign up, it is linked to your account and kept like account data. You can ask us to delete it at privacy@lumenbase.io.
- Marketing data: Until you withdraw consent or opt out; then we cease using it for marketing and retain only as needed for record-keeping or legal obligations.
- CRM data (as processor): For the duration of your subscription and as per your instructions; after termination, in line with our data deletion terms and any legal retention requirements.
You may request deletion of your account and associated personal data (subject to legal retention obligations). For CRM data, deletion is handled in accordance with your instructions and our DPA.
6. Your Rights
Depending on your location, you may have rights regarding your personal data, including: access; rectification (correction); erasure ("right to be forgotten"); restriction of processing; data portability; objection to processing; and, where processing is based on consent, the right to withdraw consent at any time. Withdrawal of consent does not affect the lawfulness of processing based on consent before its withdrawal.
To exercise these rights, contact us at privacy@lumenbase.io. You also have the right to lodge a complaint with a supervisory authority in your country.
Our representative in the EEA under Article 27 GDPR is Sebastian Streiffert, Lisboa, PT. You can contact our representative, and send any GDPR-related request, at privacy@lumenbase.io.
7. International Transfers
Your data may be processed outside your country of residence, including in the United States and the regions listed in our subprocessor list. Where the law requires it, we use safeguards such as the European Commission's Standard Contractual Clauses (SCCs), with the UK Addendum or IDTA where relevant. Copies are available on request at privacy@lumenbase.io.
9. California Privacy Rights (CCPA / CPRA)
If you are a California resident, the following applies in addition to the rest of this policy.
Categories of personal information we collect (in the preceding 12 months): Identifiers (e.g. name, email, IP address, anonymous visitor ID); account and profile information; commercial information (e.g. subscription, usage); internet or network activity (e.g. pages visited, links clicked on our marketing site); approximate geolocation derived from IP; and, where relevant, payment and billing information.
Sources: Directly from you; automatically from your use of the service; and from third parties (e.g. payment processors) where relevant.
Categories of third parties we disclose to: Service providers (hosting, analytics, payment, support); and, where required, legal or regulatory authorities.
We do not sell or share personal information as those terms are defined under the CCPA.
You may request to know, correct, or delete your personal information by contacting privacy@lumenbase.io. We will verify your identity and respond within the time the law requires.
10. Subprocessors
We use subprocessors (for example hosting, payment, analytics, and AI providers) to run the service. Our subprocessor list names each one, its purpose, and its processing region. Each is bound by a contract that protects your data. We give reasonable advance notice before adding or replacing one, and you may object where your contract or the DPA allows.
11. Data Security
We use appropriate technical and organizational measures to protect your personal information, including encryption in transit and at rest, access controls, and regular review of our security practices.
12. Contact Us
For questions about this Privacy Policy or our privacy practices, or to exercise your rights, contact Cosmic Fantasy, LLC at privacy@lumenbase.io, or by post at 30 N Gould St, Sheridan, WY 82801, USA.