Lumen Privacy Policy

1. Controller and contact information

• Controller / Pengendali Data Pribadi PT Ageis Digital Technologies
• Address Menara Palma Lantai 15 Unit 03, Jalan H.R. Rasuna Said Kavling VI Nomor 9 Blok X2, Desa/Kelurahan Kuningan Timur, Kec. Setiabudi, Kota Adm. Jakarta Selatan, Provinsi DKI Jakarta, Kode Pos: 12950
• Privacy contact privacy@hellolumen.org
• Support contact support@hellolumen.org
• Data Protection Officer / PDP contact dpo@hellolumen.org
• Main hosting region Indonesia

When this Policy says Lumen, we, us, or our, it means PT Ageis Digital Technologies. For most consumer use of Lumen, PT Ageis Digital Technologies is the controller or Pengendali Data Pribadi, because it determines the purposes and means of processing. Where Lumen processes personal data on behalf of an organization through console, enterprise, support, or administrative tools, Lumen may act as a processor under a separate agreement.

2. Scope, definitions, and privacy principles

Scope

This Policy applies to personal data processed through:

• Lumen mobile apps;
• Lumen websites and landing pages;
• Lumen APIs and backend services;
• native share extensions and platform integrations;
• Lumen console and admin tools;
• support, privacy, security, legal, and diagnostic channels;
• beta, preview, test, or experimental features; and
• any related service made available under the Lumen name.

This Policy does not apply to third-party services that Lumen does not control, such as app stores, operating systems, device manufacturers, sign-in providers, payment apps, mobile carriers, external websites, or third-party services you choose to use with Lumen.

Definitions

Personal data means information about an identified or identifiable person. Processing means any operation performed on personal data, including collection, recording, storage, use, disclosure, transfer, deletion, and destruction. Controller means the party that determines the purposes and means of processing. Processor means a party that processes personal data on behalf of a controller.

Privacy principles

Lumen is designed with a clear boundary between private communication features and structured workflow features.

Private communication features include normal chats, ordinary attachments, encrypted My Space items, device-trust flows, and private communication controls. Split Bill has two distinct data paths: user-initiated receipt OCR, which requires transient plaintext processing, and confirmed summary content, which is encrypted on the client. Ask Help also separates client-encrypted content from limited server-readable workflow metadata. For records created through the current encrypted Ask Help API, request details, comments, and proof content are encrypted on the client; Lumen retains only the ciphertext and metadata needed for authorization, routing, synchronization, storage, lifecycle state, integrity, abuse prevention, and deletion.

This distinction matters. Some data is encrypted or locally protected so Lumen and its processors cannot read it in plaintext. Other data is readable only where a feature requires it, such as the deliberately initiated Split Bill OCR step, account and participant identifiers, request and client identifiers, timestamps, open or paid state, deletion-approval state, encrypted-file size and digest, storage references, support records that you separately choose to provide, security data, or operational administration data. Lumen support cannot decrypt current client-encrypted Ask Help request details, comments, or proof content from stored ciphertext.

Encrypted Ask Help records. Ask Help launches with one client-encrypted /api/v1 contract. Request details, amounts, comments, proof descriptions, and proof files are encrypted on the client before upload; no plaintext Ask Help endpoint or version-transition alias exists. The pre-launch database is created directly from the encrypted schema, so the launched service does not retain a legacy server-readable Ask Help dataset or recovery quarantine. Statements in this Policy that Lumen cannot decrypt Ask Help content apply to every Ask Help record created by the launched service.

We apply privacy principles including lawfulness, fairness, transparency, purpose limitation, data minimization, accuracy, storage limitation, integrity, confidentiality, accountability, privacy by design, and privacy by default.

3. Lumen feature group and data treatment

The list below groups all Lumen feature areas in one place. It explains the normal data treatment for each feature. More detailed rules are provided in the remaining sections of this Policy.

• Identity, sign-in, and onboarding

  What the feature does

  Lets you create, access, return to, and safely leave your account.

  Main personal data involved

  Name, username, user ID, avatar, sign-in provider, email or phone where supported, authentication state, onboarding state, linked auth methods.

  Data treatment

  Used to authenticate you, create sessions, prevent unauthorized access, and route you through onboarding and recovery. Provider sign-in proves account identity but does not automatically make a device trusted.

• Sessions and device trust

  What the feature does

  Keeps sessions valid, manages sign-out, verifies trusted devices, and supports new-device recovery.

  Main personal data involved

  Access and refresh token metadata, token hashes, device ID, device label, platform, app version, public device key, trust state, recovery metadata.

  Data treatment

  Security-critical processing. Lumen uses public keys, device metadata, and recovery metadata. Lumen does not need your plaintext private keys, Lumen PIN, or Recovery Key to operate server-side trust checks.

• Contacts and discovery

  What the feature does

  Lets you find people, manage contacts, create chats, and share profiles.

  Main personal data involved

  Contacts you add, profile share tokens, group membership, relationship metadata, search queries, directory results.

  Data treatment

  Used for discovery, contact management, chat creation, profile sharing, and abuse prevention. Other users may see profile information you choose to make visible.

• Chat and messaging

  What the feature does

  Lets you create one-to-one and group chats, send messages, share attachments, manage members, archive, delete, restore, star, reply, forward, and use read or delivery receipts.

  Main personal data involved

  Chat IDs, participant IDs, message envelopes, message content, attachment metadata, file references, contact cards, shared locations, receipt states, archive/delete/star state, timestamps, sync cursors.

  Data treatment

  Normal chat and ordinary attachments are treated as the private communication path. Lumen processes metadata needed to route, sync, secure, and troubleshoot messages. Where end-to-end encryption applies, Lumen cannot read plaintext content. Message recipients can still save, copy, forward, screenshot, or report what they receive.

• Chat privacy preview controls

  What the feature does

  Lets you hide or reveal message previews in chat lists and rooms.

  Main personal data involved

  Local preview setting, per-chat override state, revealed-message state.

  Data treatment

  Mainly local product state. It affects what is displayed on your device and does not make recipients' copies private or delete content from the service.

• Native share extension

  What the feature does

  Lets you share text, images, files, and other supported items from the operating system share sheet into Lumen chats or My Space.

  Main personal data involved

  Selected file or text, target chat or My Space destination, destination list, cached trusted-device context, upload metadata, diagnostics.

  Data treatment

  Used only to complete the share action you choose. Large images may be compressed before encryption or upload where the feature supports it. Non-image files are not transformed except as needed for secure upload.

• My Space

  What the feature does

  Lets you save private notes, images, and files into encrypted personal storage.

  Main personal data involved

  Encrypted notes, encrypted files, item metadata, storage usage, Space key availability, share-extension save context.

  Data treatment

  Designed as encrypted private storage. Lumen may store encrypted payloads and limited metadata needed for sync, storage limits, retrieval, security, and support.

• Calls

  What the feature does

  Lets you start, receive, accept, decline, signal, end, review, and hide realtime calls.

  Main personal data involved

  Caller and recipient IDs, call IDs, call state, signaling metadata, realtime tickets, ICE-server request metadata, call logs, timestamps, hide-history state.

  Data treatment

  Used to set up, operate, troubleshoot, and record call history. Calls are not emergency services. Call logs may appear in related chat timelines.

• Split Bill

  What the feature does

  Lets you create shared expense drafts, upload receipts, edit items and participants, choose split rules, finalize bills, and track paid or unpaid status.

  Main personal data involved

  Receipt images or files and OCR input/output during deliberate OCR processing; client-encrypted bill summaries containing items, totals, participants, split rules, and paid/unpaid status; and limited account, chat, device, and routing metadata.

  Data treatment

  When you deliberately start receipt OCR, the receipt file, related text you submit, and resulting OCR plaintext pass through bounded Lumen backend memory and may be sent to the configured external AI processor. Lumen's current backend does not write that receipt or OCR plaintext to Split Bill workflow tables or object storage. An external processor may handle the data under its processing terms and Lumen's agreement with it. After you confirm or share a Split Bill, protected summary content—including items, totals, participants, split rules, calculations, and paid/unpaid status—is encrypted on your device. Lumen stores the encrypted envelope and limited metadata needed for authorization, routing, sync, integrity, and abuse prevention, but cannot read the protected envelope contents. Normal chat attachments are never treated as Split Bill OCR input unless you intentionally start that feature.

• Ask Help

  What the feature does

  Lets you create help requests, submit proof, update request state, and track paid, received, or lifecycle status.

  Main personal data involved

  Client-encrypted request details, amounts and comments; client-encrypted proof files and proof descriptions; participant, chat, request and client identifiers; timestamps; open or paid state; deletion-approval state; encrypted-file size, digest and storage references.

  Data treatment

  For Ask Help records, request details, amounts, comments, proof descriptions, and proof bytes are encrypted on your device. Lumen stores and routes their ciphertext but cannot decrypt that protected content. Lumen and authorized processors can read only limited metadata needed to authorize participants, synchronize records, enforce quotas and integrity, store or delete encrypted proof objects, track open or paid state and deletion approval, prevent abuse, and meet legal obligations. Support can act on that metadata or on information you voluntarily provide in a separate support request, but cannot inspect encrypted Ask Help content.

• Account, profile, and settings

  What the feature does

  Lets you manage profile, avatar, username, read receipts, notification preview settings, sessions, push tokens, auth methods, and account deletion.

  Main personal data involved

  Profile fields, avatar, settings, push token, active sessions, linked auth methods, share tokens, account deletion request metadata.

  Data treatment

  Used to display your profile, apply preferences, deliver notifications, manage security, and execute account controls. Some settings affect what other users can see, such as read receipts.

• Security, recovery, and E2EE key management

  What the feature does

  Lets you create or restore trusted encryption state, use Lumen PIN, rotate or revoke Recovery Key, and update E2EE key metadata.

  Main personal data involved

  Public key metadata, encrypted local key envelope, encrypted backup metadata, Recovery Key verifier, device challenge state, approval state.

  Data treatment

  Security-critical processing. Lumen is designed so the server does not receive plaintext private keys, your Lumen PIN, or your Recovery Key. If recovery paths are unavailable, Lumen may not be able to restore encrypted data.

• Sync, app config, feature flags, files, and storage

  What the feature does

  Keeps app state fresh, applies feature gates, retrieves files, shows quota and storage usage, and syncs changes.

  Main personal data involved

  Bootstrap snapshots, incremental changes, sync cursors, file/blob IDs, app config, feature flags, quota tier, storage usage, error state.

  Data treatment

  Used to keep your app accurate, enforce limits, deliver files, and safely roll out or disable features.

• Console, support, and admin operations

  What the feature does

  Lets authorized operators manage console access, roles, feature flags, app settings, quota tiers, Lumen user support, experiments, dashboard, and audit logs.

  Main personal data involved

  Console user identity, role and permission data, audit logs, admin actions, user support records, quota overrides, suspension and force-logout records.

  Data treatment

  Access is role-based and should be logged or auditable. Console actions may affect mobile user state, such as feature availability, quota, suspension, or forced logout.

• Websites, support, feedback, and diagnostics

  What the feature does

  Lets you access Lumen pages, contact support, submit feedback, report issues, and help us diagnose errors.

  Main personal data involved

  Contact details, support messages, diagnostic logs, crash reports, device/app version, request metadata, feedback content.

  Data treatment

  Used to respond to you, fix bugs, improve reliability, maintain records, and protect the Service.

4. Personal data we collect and sources

Personal data categories

We collect personal data that is reasonably necessary for the purposes described in this Policy. The exact data depends on the features you use.

• Account and identity data

  Details

  Name, username, avatar, user ID, sign-in provider, linked authentication methods, email or phone where supported, account status, onboarding status.

  Main use

  Account creation, authentication, profile display, onboarding, recovery, support, safety, and legal compliance.

• Session and device data

  Details

  Access token metadata, refresh token metadata, token hashes, device ID, device label, platform, app version, trusted-device state, public device key, push token.

  Main use

  Authentication, session refresh, sign-out, device trust, security, notification delivery, abuse prevention.

• Contact and relationship data

  Details

  Contacts you add, profile share tokens, group membership, favorites, chat membership, invitations.

  Main use

  Contact discovery, chat creation, group management, profile sharing, and user controls.

• Communication metadata

  Details

  Chat IDs, participant IDs, timestamps, delivery and read receipt state, attachment references, archive/delete/star state, sync cursors.

  Main use

  Routing, delivery, sync, reliability, abuse prevention, troubleshooting, and user controls.

• Communication content

  Details

  Text, images, files, contact cards, shared locations, ordinary attachments, and related message content.

  Main use

  Delivering messages and attachments to recipients you choose. Where encryption applies, Lumen's ability to read content is technically limited.

• My Space data

  Details

  Encrypted notes, encrypted files, encrypted payload references, item metadata, storage usage.

  Main use

  Encrypted storage, sync, retrieval, storage limits, and support.

• Call data

  Details

  Caller/callee identifiers, call status, signaling metadata, realtime tickets, ICE-server request metadata, call logs, timestamps.

  Main use

  Starting, receiving, signaling, ending, logging, troubleshooting, and hiding call history.

• Split Bill data

  Details

  Receipt files and plaintext OCR input/output during a deliberate OCR request; client-encrypted bill summaries containing items, totals, participants, split rules, calculations, and paid/unpaid status; limited authorization, routing, sync, and integrity metadata.

  Main use

  Transiently processing receipt OCR through Lumen backend memory and an external AI processor; routing and syncing client-encrypted Split Bill summaries; enforcing access, version, and integrity controls; and responding to support, abuse, or legal issues using the limited data available to Lumen.

• Ask Help data

  Details

  Client-encrypted request, amount, comment and proof content; encrypted proof bytes; ciphertext envelopes; participant/chat/request/client identifiers; timestamps; open or paid state; deletion state; encrypted byte size, digest and storage references.

  Main use

  Routing and synchronizing client-encrypted content; authorizing participants; storing and deleting encrypted proof objects; tracking limited server-readable open/paid and deletion-approval state; enforcing integrity, quota and abuse controls; and supporting users with available metadata or information they separately provide.

• Console and admin data

  Details

  Console user identity, roles, permissions, audit logs, feature flag changes, config changes, quota changes, user support actions.

  Main use

  Console security, role-based access, release controls, support, compliance, and auditability.

• Technical, analytics, and diagnostics data

  Details

  IP address or approximate network data, app version, device type, crash logs, performance logs, request metadata, diagnostics.

  Main use

  Security, fraud prevention, debugging, reliability, service performance, and product improvement.

• Support, feedback, and legal data

  Details

  Messages you send to support, privacy requests, bug reports, evidence you provide, legal correspondence.

  Main use

  Responding to requests, resolving issues, maintaining records, and complying with law.

Sources

We collect personal data from you, your device and app, other users, identity providers, app stores, operating systems, push-notification providers, console users, authorized operators, and service providers that help us operate Lumen.

5. Purposes, legal bases, consent, and choices

Purposes and legal bases

We process personal data only where we have a valid legal basis. Depending on the law that applies, the legal basis may include consent, contract performance, legal obligation, legitimate interest, vital interest, public interest, or another basis recognized by applicable law.

• Provide and administer Lumen

  Details

  Account creation, sign-in, onboarding, chat delivery, My Space, calls, Split Bill, Ask Help, sync, settings, storage.

  GDPR legal basis where applicable

  Contract performance; legitimate interests for necessary operations.

  UU PDP basis where applicable

  Fulfilment of agreement obligations; legitimate interest; consent where required.

• Authenticate and secure accounts

  Details

  Session refresh, sign-out, token rotation, device trust, Recovery Key verifier, abuse prevention, suspicious activity checks.

  GDPR legal basis where applicable

  Contract performance; legitimate interests; legal obligation where applicable.

  UU PDP basis where applicable

  Fulfilment of agreement obligations; legitimate interest; legal obligation.

• Operate private communication features

  Details

  Route messages, deliver attachments, maintain receipts, manage groups, support native share to chat.

  GDPR legal basis where applicable

  Contract performance; legitimate interests.

  UU PDP basis where applicable

  Fulfilment of agreement obligations; legitimate interest.

• Operate structured workflows

  Details

  Process deliberately submitted receipts and OCR plaintext transiently through Lumen backend memory and an external AI processor; route and store client-encrypted Split Bill summaries; route and store client-encrypted Ask Help requests, comments and proof; and process the limited server-readable Ask Help participant, routing, storage, open/paid and deletion metadata described in this Policy.

  GDPR legal basis where applicable

  Contract performance; consent where required; legitimate interests.

  UU PDP basis where applicable

  Fulfilment of agreement obligations; explicit consent where required; legitimate interest.

• Provide support and respond to requests

  Details

  Support tickets, privacy requests, account issues, bug reports, legal correspondence.

  GDPR legal basis where applicable

  Contract performance; legitimate interests; legal obligation.

  UU PDP basis where applicable

  Fulfilment of agreement obligations; legitimate interest; legal obligation.

• Improve reliability and safety

  Details

  Debugging, diagnostics, crash analysis, fraud prevention, abuse investigation, security monitoring.

  GDPR legal basis where applicable

  Legitimate interests; legal obligation where applicable.

  UU PDP basis where applicable

  Legitimate interest; legal obligation.

• Manage console and operations

  Details

  Console authentication, RBAC, feature flags, quotas, user support actions, experiments, audit logs.

  GDPR legal basis where applicable

  Contract performance; legitimate interests; legal obligation.

  UU PDP basis where applicable

  Fulfilment of agreement obligations; legitimate interest; legal obligation.

• Send service communications

  Details

  Security notices, account notices, support replies, policy updates, operational messages.

  GDPR legal basis where applicable

  Contract performance; legitimate interests; legal obligation.

  UU PDP basis where applicable

  Fulfilment of agreement obligations; legitimate interest; legal obligation.

• Send optional marketing or research communications

  Details

  Product news, surveys, promotional messages where enabled.

  GDPR legal basis where applicable

  Consent, or legitimate interests where allowed by law.

  UU PDP basis where applicable

  Explicit consent where required.

• Comply with law and enforce rights

  Details

  Legal requests, regulator requests, dispute handling, terms enforcement, protection of users and the Service.

  GDPR legal basis where applicable

  Legal obligation; legitimate interests; establishment, exercise, or defense of legal claims.

  UU PDP basis where applicable

  Legal obligation; legitimate interest.

Where we rely on legitimate interests, we consider whether the processing is necessary, proportionate, and balanced against your rights and expectations. You may object to certain legitimate-interest processing where applicable law gives you that right.

Consent and choices

Where processing is based on consent, we will request consent in a manner required by applicable law. You may withdraw consent at any time through available in-product controls or by contacting us. Withdrawal does not affect processing that occurred before withdrawal.

Some features may stop working if you withdraw consent or disable access. For instance, disabling notifications may affect push delivery, refusing device permissions may affect file or media sharing, and withdrawing consent for optional marketing will stop marketing messages but not service communications.

We aim to use layered, just-in-time notices for important product moments, especially when a feature collects data that users may not expect, such as receipt OCR in Split Bill, proof handling in Ask Help, location sharing, contact sharing, native share extension behavior, or account recovery actions.

6. Specific and special-category data

UU PDP recognizes specific personal data, including health data, biometric data, genetic data, criminal records, child data, personal financial data, and other data specified by law. GDPR recognizes special categories of personal data, including health, biometric data used for identification, racial or ethnic origin, political opinions, religious or philosophical beliefs, trade union membership, genetic data, and data concerning sex life or sexual orientation.

Lumen does not intentionally require you to submit these categories for ordinary chat. However, some Lumen features may involve sensitive information if you choose to provide it. This may include:

• personal financial information in Split Bill records;
• receipt details that reveal purchases, locations, or habits;
• proof documents in Ask Help;
• shared locations;
• images, files, messages, or notes that you or another user upload;
• data relating to children where a user includes child-related information.

Only submit specific or special-category data if it is necessary for the feature and you have the right to share it. Where applicable law requires a special legal condition, explicit consent, guardian consent, or another safeguard, we will apply the required condition or safeguard.

7. Encryption, device trust, security, and breaches

Encryption, device trust, and recovery

Lumen uses technical controls to separate account identity from trusted-device status.

• Sign-in with a provider proves account identity but does not automatically make a device trusted for encrypted data.
• Lumen PIN is designed to protect local key material on your device. Lumen does not need to receive your Lumen PIN in plaintext.
• Private keys are designed to stay outside Lumen servers in plaintext.
• Recovery Key flows are designed so Lumen verifies recovery eligibility without needing the plaintext Recovery Key.
• New-device recovery may require old-device approval, device-to-device transfer, or Recovery Key.
• If you lose all trusted recovery paths, Lumen may not be able to restore encrypted data.

Encryption has practical limits. Metadata, account data, delivery state, call logs, storage usage, workflow records, support records, abuse reports, and data visible to recipients may still be processed. Recipients can copy, export, screenshot, forward, or disclose content they receive.

Security safeguards

We use administrative, technical, and organizational safeguards designed to protect personal data, including encryption in transit, encryption at rest where appropriate, end-to-end encryption or local key protection for supported features, access controls, token hashing, session controls, device-trust safeguards, logging, monitoring, vulnerability management, retention controls, and vendor controls.

No system is perfectly secure. You are responsible for protecting your device, Lumen PIN, Recovery Key, account credentials, operating-system security, and access to your email, phone, or sign-in provider.

Personal data breaches

If we become aware of a personal data breach, we will investigate and take steps to contain, assess, and remediate it. Where required by law, we will notify affected users and competent authorities within the required timeframe.

Under UU PDP, this may include written notification to affected Personal Data Subjects and the competent authority no later than 3 x 24 hours after the relevant breach is known as required by law. Under GDPR, this may include notification to the relevant supervisory authority without undue delay and, where required, within 72 hours after becoming aware of the breach, and communication to affected individuals where the breach is likely to result in a high risk to their rights and freedoms.

8. Sharing, processors, and international transfers

Sharing and disclosure

We disclose personal data only where reasonably necessary for the Service, where you direct us, or where law permits or requires disclosure.

• Other Lumen users

  Details

  People you message, call, add to groups, share profiles with, include in Split Bill records, or include in Ask Help requests.

• Service providers and processors

  Details

  Hosting, storage, security, analytics, diagnostics, notification delivery, identity verification, OCR or file processing where used, support tooling, and operational vendors.

• Platform and integration providers

  Details

  App stores, operating systems, sign-in providers, push-notification providers, device services, and native share mechanisms.

• Authorized console users and operators

  Details

  Personnel or authorized users who need access for support, security, admin, audit, configuration, quota, or compliance purposes.

• Legal, safety, and compliance recipients

  Details

  Regulators, courts, law enforcement, government authorities, legal advisers, auditors, and parties involved in dispute resolution where required or permitted by law.

• Corporate transaction parties

  Details

  Parties involved in a merger, acquisition, financing, restructuring, or sale of assets, subject to appropriate safeguards.

We do not sell your personal data. We do not use normal private chat attachments as a hidden OCR workflow. Receipt OCR starts only when you intentionally use Split Bill or another feature that clearly requires it. In that OCR request, the selected file and related plaintext may pass through Lumen backend memory and be sent to the configured external AI processor; the confirmed protected Split Bill summary is encrypted on your device.

Processors, vendors, and authorized access

We use processors and service providers to operate, secure, maintain, and improve Lumen. We require them to process personal data only under our instructions or another valid legal basis, protect data with appropriate safeguards, and support our compliance obligations.

Access to production data is restricted to authorized personnel or authorized console users who need access for legitimate operational, security, support, compliance, or administrative purposes. Where appropriate, access is role-based, logged, reviewed, or otherwise auditable.

For encrypted Ask Help records, authorized personnel and processors can access ciphertext and the limited readable metadata described above, but they do not receive the client keys needed to decrypt request details, amounts, comments, proof descriptions, or proof files. Support may delete or troubleshoot records using identifiers and lifecycle metadata, or review information that you separately choose to send through a support channel; it cannot recover protected Ask Help plaintext from stored ciphertext.

International transfers

Lumen's main hosting region is Indonesia. Some processing may still involve transfers or access outside your jurisdiction, for instance where service providers, support tools, security services, identity providers, app stores, or operational personnel are located elsewhere.

Where we transfer personal data internationally, we apply safeguards required by applicable law. These may include adequacy assessments, binding contractual protections, standard contractual clauses, explicit consent where legally permitted and required, security controls, data minimization, and transfer risk assessments.

9. Retention and deletion

Retention

We retain personal data only for as long as reasonably necessary for the purposes described in this Policy, unless a longer retention period is required or permitted by law.

• Account and profile data

  Retention approach

  Kept while your account is active and for a reasonable period afterward for security, legal, dispute, or operational needs.

• Session and device data

  Retention approach

  Kept for the life of the session or device-trust relationship and for a reasonable security/audit period afterward.

• Chat, My Space, attachments, and files

  Retention approach

  Kept while needed to provide the feature, sync across devices, apply user controls, and maintain integrity, unless deleted or retention is otherwise required. Encrypted content may remain technically unrecoverable without keys even if stored.

• Split Bill and Ask Help records

  Retention approach

  Lumen does not retain Split Bill receipt files or OCR plaintext in its workflow database or object storage after the synchronous request. External AI processors may retain or delete submitted data according to applicable law, their processing terms, and Lumen's agreement with them. Client-encrypted Split Bill envelopes and limited metadata may be kept while needed for sync, user controls, integrity, abuse prevention, disputes, or legal obligations. Ask Help request, comment and proof ciphertext may be kept while needed to provide synchronization and participant access. Limited readable participant, routing, storage, open/paid, deletion, timestamp, size and digest metadata may be kept for those purposes and for integrity, abuse prevention, disputes, security, or legal obligations. Deleting an encrypted proof removes its active object-storage reference and triggers deletion of that stored encrypted object; related deletion, audit, backup or security records may remain for their applicable retention period. Lumen cannot decrypt retained Ask Help ciphertext for support or dispute review.

• Call logs

  Retention approach

  Kept while needed to show call history, related chat records, troubleshooting, and user controls.

• Console and audit logs

  Retention approach

  Kept for security, compliance, accountability, abuse prevention, and operational audit purposes.

• Diagnostics and logs

  Retention approach

  Usually kept for shorter operational periods unless needed for security, fraud prevention, legal, or reliability purposes.

• Support and privacy requests

  Retention approach

  Kept as needed to respond, verify completion, maintain records, and comply with legal obligations.

• Deleted sign-in identity tombstones

  Data retained

  After account deletion is completed, Lumen permanently retains keyed cryptographic digests (HMAC tombstones) derived from linked identity-provider subjects and, where available, normalized email addresses and phone numbers. The raw sign-in identifiers are removed from the authentication records.

  Purpose and retention

  These derived identifiers are retained indefinitely to prevent a sign-in identity from being recycled into or linked to another Lumen account after deletion, reducing account-confusion and encryption-identity risks. They are used only to compare future registration or linking attempts, not to contact you, rebuild a profile, or for advertising.

Deletion limits

Deletion may not immediately remove all copies from backups, logs, audit records, recipient devices, or records we must keep for legal, security, fraud-prevention, or dispute purposes.

Once deletion is completed, the same linked Google, Apple, email, or phone sign-in identity cannot be used to create or link another Lumen account. Lumen enforces this restriction using the identity tombstones described above.

10. Cookies, SDKs, analytics, and diagnostics

Lumen websites, apps, and services may use cookies, local storage, mobile SDKs, analytics tools, crash reporting, and similar technologies. These technologies help us keep you signed in, remember settings, secure the Service, detect fraud or abuse, understand feature reliability, diagnose crashes and performance issues, and improve product quality.

Where required by law, we will request consent for non-essential cookies or similar technologies. You can also use browser, device, or in-app settings to limit certain technologies, although some Service functions may be affected.

11. Your privacy rights and how to exercise them

Your rights

Depending on where you live and which law applies, you may have rights to:

• receive information about how we process personal data;
• access personal data about you;
• correct, complete, or update inaccurate data;
• delete or erase personal data;
• withdraw consent;
• restrict or suspend processing;
• object to processing;
• receive data portability;
• object to decisions based solely on automated processing where such decisions produce legal or similarly significant effects;
• lodge a complaint with a competent data protection authority; and
• claim compensation where applicable law provides that right.

These rights may be limited by law, security, the rights of other people, technical feasibility, confidential information, or our need to retain certain records.

How to exercise rights

You may exercise available rights through in-product controls or by contacting:

• Privacy: privacy@hellolumen.org
• Data Protection Officer / PDP contact: dpo@hellolumen.org
• Support: support@hellolumen.org

We may need to verify your identity before acting on a request. We will respond within the period required by applicable law. For UU PDP requests, we aim to comply within 72 hours where that timeframe is required by law. For GDPR requests, we aim to respond within one month, unless an extension is permitted by law.

If a request affects other users, encrypted data, recipient-held content, security logs, legal records, or data we process as a processor for another organization, we may limit, refuse, or redirect the request as allowed by law.

12. Children and data about other people

Children

Lumen is not intended for use by children in a way that violates applicable age, parental consent, or guardian consent rules. If you are under the age required by applicable law, you may use Lumen only with valid parental or guardian consent.

If we learn that personal data was collected in a manner that violates applicable children's privacy law, we may delete, restrict, or deactivate the relevant account or data.

Data about other people

You may upload or share personal data about other people, such as contacts, shared locations, receipts, Split Bill participants, Ask Help proof, images, or files. You must have a lawful basis, permission, or other right to share that data. Do not upload identity documents, financial records, health data, child data, or other sensitive information unless it is necessary and lawful for the feature you are using.

13. Automated decision-making, privacy by design, and impact assessments

Lumen may use automated checks to support security, abuse prevention, spam prevention, reliability, feature eligibility, quota enforcement, and routing. These checks do not currently make solely automated decisions that produce legal or similarly significant effects on users without meaningful safeguards.

If we introduce solely automated decision-making that has legal or similarly significant effects, we will provide required notices and rights under applicable law.

We apply privacy by design and privacy by default principles to Lumen features. Where processing is likely to create high risk to users, we assess the privacy impact and apply safeguards such as minimization, encryption, access control, logging, purpose limitation, user notices, and additional review.

High-risk scenarios may include recovery and device trust, encrypted data handling, structured workflows involving financial or proof data, children-related data, large-scale processing, or automated processing that may significantly affect users.

14. Third-party services, changes, language, and contact

Third-party services

Lumen may link to or integrate with services we do not control. These services may include sign-in providers, app stores, operating systems, device services, payment apps, map services, file viewers, browser tools, or third-party websites. Their processing is governed by their own terms and privacy notices.

Changes to this Policy

We may update this Policy to reflect product changes, legal requirements, operational needs, or clarifications. If changes materially affect your rights or how we process personal data, we will provide notice through the app, website, email, or another appropriate channel when required by law. The updated Policy becomes effective on the date shown at the top unless a different effective date is stated.

Language

This Policy may be available in English and Bahasa Indonesia. For users in Indonesia, the Bahasa Indonesia version will prevail to the extent required by Indonesian law. For other users, the English version will prevail unless applicable law requires otherwise.

Contact

For privacy questions, requests, or complaints, contact:

PT Ageis Digital Technologies
Menara Palma Lantai 15 Unit 03, Jalan H.R. Rasuna Said Kavling VI Nomor 9 Blok X2, Desa/Kelurahan Kuningan Timur, Kec. Setiabudi, Kota Adm. Jakarta Selatan, Provinsi DKI Jakarta, Kode Pos: 12950
Privacy: privacy@hellolumen.org
Data Protection Officer / PDP contact: dpo@hellolumen.org
Support: support@hellolumen.org