1. Introduction
Lumenbase is operated by Cosmic Fantasy, LLC, a limited liability company registered in the State of Wyoming, USA, with its registered office at 30 N Gould St, Sheridan, WY 82801, USA. Cosmic Fantasy, LLC ("we," "our," or "us") is the data controller for the personal data described in section 1.1 below. This Privacy Policy explains how we collect, use, share, and protect your information when you use Lumenbase and related services.
We may update this policy. We post each update on this page with a new date and version, and tell you about material changes by email or in the Service before they take effect.
1.1 Our roles under data protection law
We act in two distinct capacities:
- Controller for: your account data (e.g. name, email, password), billing and payment-related data, marketing preferences, security and legal records, and the public business information described in section 2. We decide why and how this data is processed.
- Processor for: CRM data (contacts, companies, deals, activities, and other data you upload or create in the platform). For this data, you are the controller and we process it only on your documented instructions (via our Terms of Service and our Data Processing Agreement).
Where we act as processor, we do not use your CRM data for our own purposes except as necessary to provide, secure, and improve the service.
1.2 Your responsibility for CRM data
You are responsible for having a lawful basis to collect and process any personal data you upload or sync into the platform, and for complying with applicable data protection laws (e.g. GDPR, CCPA) when doing so. We process CRM data on your behalf under our Data Processing Agreement, and will notify you without undue delay if we become aware of a personal data breach affecting it.
2. Information We Collect
We collect information you provide directly (e.g. account, profile, payment, and CRM data) and information we obtain automatically (e.g. logs, device, and usage data). The table below lists the main categories of personal data we process as controller, why, and the legal basis we rely on where the GDPR applies.
| Data category | Purpose | Legal basis (GDPR) |
|---|---|---|
| Account data (name, email, password) | Account creation, authentication, account management | Contract performance |
| Profile / workspace data (company name, job title) | Providing the service, support, billing | Contract performance |
| Payment / billing data | Processing payments, invoicing, fraud prevention | Contract performance; legal obligation |
| Marketing preferences and communications | Newsletters, product updates, marketing (where consented) | Consent; legitimate interest (where applicable) |
| Logs, device and usage data | Security, availability, analytics, product improvement | Legitimate interest |
| Marketing site visitor data (anonymous ID, pages visited, links clicked, approximate location from IP, device, browser, and language) | Understanding how our marketing site is used and improving the product; linked to your account if you sign up | Legitimate interest; consent where required by law (e.g. EU/EEA) |
| Security and legal records (IP address, approximate location, browser, sign-in events, and the versions of our terms you accepted) | Securing accounts, preventing fraud and abuse, and proving what you agreed to | Legitimate interest; legal obligation |
| Voice profile (optional) | Recognising your voice in meeting transcripts, if you turn it on | Explicit consent |
| CRM data (contacts, companies, etc.) | Processed on your behalf as processor; we do not use for our own purposes | N/A (you determine legal basis as controller) |
Providing data. Account and billing data are needed to provide the service; without them we cannot create or maintain your account. Optional data, such as marketing preferences, can be refused or withdrawn at any time without affecting the core service.
Automated decision-making. We do not use your personal data for automated decision-making or profiling that produces legal effects or similarly significantly affects you.
Children. The Service is for business use and is not directed at children. We do not knowingly collect personal data from anyone under 16.
Public business information we collect
We collect business information that is publicly available on company websites and event pages, such as the names, job titles, employers, and LinkedIn profile addresses of people at companies, and the names, titles, organizations, and photos of event speakers. We use it to give customers company and event information they can match against their CRM. Our legal basis is legitimate interest. We keep it while it is relevant to the Service. You can object, or ask us to delete information about you, through privacy requests or at privacy@lumenbase.io.
2.1 Lumenbase Capture browser extension
The Lumenbase Capture browser extension connects the sites you work on to your Lumenbase workspace once you link your account.
What the extension accesses
- LinkedIn: profile and messaging information on pages you view, such as names, headlines, and companies. Once linked, the extension also syncs recent conversations and connections in the background, limited to CRM contacts and your 1st-degree connections. It reads your pending sent invitations (name, profile address, and date) to respect LinkedIn's weekly limit, and it sends the LinkedIn messages and invitations that you or your workspace queue.
- Email and chat: on Gmail, Outlook, and Google Chat, the extension reads the message or conversation you are working on when you use a Lumenbase feature there.
- Meetings: if you turn it on, the extension records audio from meetings you join (see Audio and Meeting Recording in section 3).
- Lumo in the panel: when you send Lumo a message, the extension sends the page address, the page title, and up to 6,000 characters of visible page text, so Lumo can answer about that page. Dictation sends your microphone audio directly to our speech-to-text provider.
- Company websites: if you allow it, the extension reads the address of websites you visit to show whether the company is in your CRM.
- Local storage: the extension keeps its settings, and data waiting to sync, in your browser.
- Lumenbase account link: Connecting the extension issues a token so it can send data to your workspace over an encrypted connection.
- LinkedIn session: The extension checks your LinkedIn session to confirm you are logged in. It does not send LinkedIn cookies to third parties.
How extension data is used
Extension data is used only to run the features above and to sync data to your workspace. We do not sell it or use it for advertising. Its use complies with the Chrome Web Store User Data Policy, including the Limited Use requirements. Synced data is CRM data we process on your behalf (see Section 1.1). Lumenbase support staff can read the extension's diagnostic reports only when your workspace grants support access.
Your choices
You are responsible for having a lawful basis for the LinkedIn data you sync, and for your use of LinkedIn under its terms. Automated activity on LinkedIn can lead LinkedIn to restrict your account.
You can disconnect the extension in Lumenbase Integrations or uninstall it from your browser, which removes its locally stored data. Data already synced stays in your workspace until deleted; you may request deletion via privacy requests or privacy@lumenbase.io.
3. How We Use and Share Your Information
We use the information we collect to provide, maintain, secure, and improve the service, process payments, send service and support messages, and respond to requests. We do not sell your personal data. We share data with subprocessors that help us run the service, under appropriate contracts (see Section 10), and where required by law or to protect our rights and safety. If we are involved in a merger, acquisition, or sale of assets, personal data may transfer to the new owner under this policy.
AI Processing
Features such as the Lumo assistant, contact enrichment, email drafting, and meeting summaries use third-party AI, speech-to-text, and web search providers. When you use them, the relevant data (for example contact details, deal information, or meeting transcripts) is sent to those providers, which process it as our subprocessors under data processing agreements. They are named in our subprocessor list.
Audio and Meeting Recording
When enabled, the Lumenbase Capture extension can record audio from video meetings you join on supported platforms (Google Meet, Microsoft Teams, Zoom), when you start it or automatically during calendar events if you turn that on, and send it to our transcription provider. You are responsible for informing participants and obtaining any consent the law requires.
4. Google User Data (Gmail and Google Calendar)
When you connect a Google account in Integrations, Lumenbase accesses data from Google APIs to run the Gmail and Google Calendar features you enable. This section applies in addition to the rest of this policy.
Limited Use. Lumenbase's use and transfer to any other app of information received from Google APIs will adhere to the Google API Services User Data Policy, including the Limited Use requirements. We do not use Google user data for advertising, we do not sell it, and we do not use it to train generalized or third-party AI or machine-learning models. Humans do not read your Google user data except with your explicit consent for a specific message, where required for security or to comply with applicable law, or where the data has been aggregated and anonymized.
What we access and why
- Email address (userinfo.email): to identify which Google account is connected.
- Gmail read (gmail.readonly): to sync messages exchanged with your CRM contacts onto their timeline. We read message headers and content to match them to contacts, companies, and deals.
- Gmail send (gmail.send): to send emails to contacts on your behalf when you compose them inside Lumenbase. Sent messages appear in your Gmail Sent folder.
- Google Calendar (calendar.readonly, calendar.events, calendar.freebusy): to sync calendar events into your CRM as meetings, create or update events you make in Lumenbase, and check free/busy availability.
- Google Ads, Search Console, and BigQuery (adwords, webmasters.readonly, bigquery): when you connect them, to exchange data with the ad accounts, Search Console properties, and BigQuery datasets you choose.
How we store and protect it
OAuth tokens are stored encrypted and used only for your own connection. Synced email and calendar content is stored as CRM data in your workspace and processed on your behalf (see Section 1.1). We use Google user data only to provide and improve the features you enabled, and where strictly necessary for security, abuse prevention, or legal compliance.
How you stay in control
You start the connection and approve each permission on Google's consent screen. You can disconnect at any time in Integrations, which stops syncing and deletes stored tokens, or revoke access from your Google Account. Records already synced stay in your workspace until deleted; you may request deletion via privacy requests or privacy@lumenbase.io.
4.1 Slack data
When a workspace admin connects Slack in Integrations, Lumenbase accesses data from the Slack API to run the features you turn on. This section applies in addition to the rest of this policy.
We do not use Slack data for advertising, we do not sell it, and we do not use it to train generalized or third-party AI or machine-learning models.
What we access and why
- Messages in synced channels: message text, sender name and Slack user ID, and timestamp, only for channels an admin has mapped and Lumo has been invited to. They appear on the timeline of the mapped company or deal.
- Channel names: to show which channel a mapping refers to.
- Member names and email addresses: to match Slack accounts to Lumenbase users.
- Messages that mention @Lumo: to answer the question. Lumo replies in a thread in that channel.
- Messages Lumenbase sends: notifications, reminders, and automation messages to the channels you configure.
What we do not access
We do not read unmapped channels, direct messages between colleagues, files, or reactions.
How we store it and for how long
Synced messages are stored as activities in your workspace, under the same access controls as your other CRM data, until an admin purges them or the workspace is deleted. Slack tokens are stored encrypted and deleted when you disconnect, uninstall the app, or Slack revokes them.
How you stay in control
Only workspace admins can connect Slack, map channels, or stop a mapping, and they approve each permission on Slack's consent screen. Disconnecting in Integrations revokes and deletes our tokens. Messages already captured stay until purged or the workspace is deleted; you may request deletion via privacy requests or privacy@lumenbase.io.
4.2 Email open tracking
Open tracking for one-to-one mail is off by default. A Lumenbase user can turn it on for mail they send from Lumenbase, and for mail they write in Gmail or Outlook with the Lumenbase Capture extension. A workspace admin can turn it off for the whole workspace. Email Campaigns always record opens and link clicks for each recipient, and a click through to the sender's tracked website can connect that visit to the recipient.
When it is on, each tracked message carries a small image. When the recipient's mail app loads it, we record that the message was opened, when, and an approximate type of request. We use the IP address only to prevent abuse and do not store it.
Opens are shown to the sender and to workspace members who can see the sent message. Turning tracking off stops recording opens on one-to-one mail.
The sender decides whether to track and is responsible for having a lawful basis, including any consent the law requires, to track opens and clicks on mail to their recipients. Recipients can prevent tracking by blocking remote images in their mail app, and can contact privacy@lumenbase.io about open data we hold.
5. Data Retention
We retain personal data only as long as necessary for the purposes set out in this policy or as required by law.
- Account data: Deleted when you delete your account, unless a longer period is required for legal, regulatory, or dispute-resolution purposes. When a workspace is deleted, we keep a record of its members' names, email addresses, and job titles for up to 1 year to handle disputes and prevent abuse, or longer if we have blocked the workspace for abuse.
- Billing / financial records: As required by applicable accounting and tax laws (often 7 years or more).
- Logs and security-related data: Typically up to 12 months, unless a shorter or longer period is needed for security, legal, or compliance reasons.
- Privacy requests: Up to 2 years after we close them.
- Marketing site visitor data: Typically up to 24 months, for analytics and product improvement. If you sign up, it is linked to your account and kept like account data. You can ask us to delete it at privacy@lumenbase.io.
- Records of terms you accepted: Which version of our Terms, this Privacy Policy, the DPA or the beta notice you accepted, and when, for as long as we may need to prove it, including after your account is closed. The IP address and browser details saved with each record are removed after 3 years.
- Marketing data: Until you withdraw consent or opt out; then we cease using it for marketing and retain only as needed for record-keeping or legal obligations.
- CRM data (as processor): For the duration of your subscription and as per your instructions; after termination, in line with our data deletion terms and any legal retention requirements.
You may request deletion of your account and associated personal data (subject to legal retention obligations). For CRM data, deletion is handled in accordance with your instructions and our DPA.
6. Your Rights
Depending on your location, you may have rights regarding your personal data, including: access; rectification (correction); erasure ("right to be forgotten"); restriction of processing; data portability; objection to processing; and, where processing is based on consent, the right to withdraw consent at any time. Withdrawal of consent does not affect the lawfulness of processing based on consent before its withdrawal.
To exercise these rights, contact us at privacy@lumenbase.io. You also have the right to lodge a complaint with a supervisory authority in your country.
If your data is held in a customer's workspace (for example, you are a contact in a customer's CRM), that customer controls it. Please contact them; if you contact us, we will direct you to them.
Our representative in the EEA under Article 27 GDPR is Sebastian Streiffert, Lisboa, PT. You can contact our representative, and send any GDPR-related request, at privacy@lumenbase.io.
7. International Transfers
Your data may be processed outside your country of residence, including in the United States and the regions listed in our subprocessor list. Where the law requires it, we use safeguards such as the European Commission's Standard Contractual Clauses (SCCs), with the UK Addendum or IDTA where relevant. Copies are available on request at privacy@lumenbase.io.
9. California Privacy Rights (CCPA / CPRA)
If you are a California resident, the following applies in addition to the rest of this policy.
Categories of personal information we collect (in the preceding 12 months): Identifiers (e.g. name, email, IP address, anonymous visitor ID); account and profile information; commercial information (e.g. subscription, usage); internet or network activity (e.g. pages visited, links clicked on our marketing site); approximate geolocation derived from IP; and, where relevant, payment and billing information.
Sources: Directly from you; automatically from your use of the service; and from third parties (e.g. payment processors) where relevant.
Categories of third parties we disclose to: Service providers (hosting and database, email delivery, payment, analytics, error monitoring, AI, speech-to-text, web search, and spam screening); and, where required, legal or regulatory authorities.
We do not sell or share personal information as those terms are defined under the CCPA.
You may request to know, correct, or delete your personal information by contacting privacy@lumenbase.io. We will verify your identity and respond within the time the law requires.
10. Subprocessors
We use subprocessors (for example hosting, payment, analytics, and AI providers) to run the service. Our subprocessor list names each one, its purpose, and its processing region. Each is bound by a contract that protects your data. We give reasonable advance notice before adding or replacing one, and you may object where your contract or the DPA allows.
11. Data Security
We use appropriate technical and organizational measures to protect your personal information, including encryption in transit and at rest, access controls, and regular review of our security practices.
12. Contact Us
For questions about this Privacy Policy or our privacy practices, or to exercise your rights, contact Cosmic Fantasy, LLC at privacy@lumenbase.io, or by post at 30 N Gould St, Sheridan, WY 82801, USA.