1. Overview

This Privacy Policy explains how Lumasto Learning LLC ("Lumasto", "we", "us", or "our") collects, uses, discloses, and safeguards information when you use our website, web application, browser extension, and related services (together, the "Service").

By creating an account or otherwise using the Service, you agree to the collection and use of information in accordance with this policy. If you do not agree with our policies, please do not use the Service.

2. Information we collect

We collect information in three ways: information you give us directly, information collected automatically as you use the Service, and information we receive from third parties.

  • Account information: name, email address, password (hashed), spoken and target languages, proficiency level, and billing details processed by our payment provider.
  • Content you provide: documents, links, saved words, notes, chat messages, and audio you submit for lessons, translation, or practice.
  • Usage data: pages visited, features used, session length, device type, browser, operating system, and approximate location derived from IP address.
  • Browser extension data: words and phrases you save while browsing, and the URL of the page where you saved them, so we can show you the original context.
  • Support and communications: messages you send to our support or sales team, survey responses, and any information you choose to include in them.

3. How we use information

We use the information we collect to operate, maintain, and improve the Service, including to:

  • Create and maintain your account and authenticate you when you sign in.
  • Generate personalised lessons, vocabulary, quizzes, and practice scenarios from your saved content.
  • Process payments, send receipts, and manage subscriptions.
  • Provide customer support and respond to requests.
  • Monitor, detect, and prevent fraud, abuse, and security incidents.
  • Analyse aggregated usage trends to improve product features and performance.
  • Send service updates, security notices, and, where you have opted in, product and marketing communications.

5. Uploaded and saved content

Documents, links, and words you upload or save are treated as your content. They are private by default and are only used to generate learning material for your account, unless you explicitly choose to share a lesson or word list with another user.

We do not sell uploaded content, and we do not use it to train models for other customers. You can delete uploaded content or your saved-word history at any time from account settings; deletion removes the content from active systems within 30 days, subject to the backup retention described in Section 8.

6. AI-assisted features

Some features, such as the AI chat tutor, translation, and generated practice questions, are powered by third-party or self-hosted language models. When a third-party model provider is used, the minimum content necessary to generate a response is sent to that provider under a data processing agreement that prohibits use of your content for their own model training.

We log AI feature usage (timestamps, feature used, and response quality signals) to monitor reliability and improve prompt design. Message content is retained only as long as needed to provide the feature and for the retention periods described in Section 8, unless you delete a conversation sooner.

7. How we share information

We do not sell your personal data. We share information only in the following circumstances:

  • With service providers who help us run the Service, such as cloud hosting, email delivery, payment processing, analytics, and customer support tooling, under contracts that limit their use of your data.
  • With AI model providers, as described in Section 6, limited to the content needed to generate a response.
  • To comply with a legal obligation, court order, or valid governmental request.
  • To protect the rights, property, or safety of Lumasto, our users, or the public.
  • In connection with a merger, acquisition, financing, or sale of assets, subject to standard confidentiality protections.
  • With your consent, such as when you choose to share a word list, lesson, or public profile with another user.

8. Data retention

We retain account data for as long as your account is active. If you close your account, we delete or anonymise personal data within 90 days, except where we are required to retain it for legal, tax, security, or dispute-resolution purposes. Encrypted backups are retained for up to 35 days before rotating out of storage.

9. Your rights and choices

Depending on where you live, you may have the right to access, correct, export, or delete your personal data, to object to or restrict certain processing, and to withdraw consent at any time. California residents have additional rights under the CCPA/CPRA, including the right to know what personal information is collected and to opt out of the sale or sharing of personal information; Lumasto does not sell personal information.

You can exercise most of these rights directly from your account settings. For anything else, contact privacy@lumasto.app and we will respond within 30 days. You also have the right to lodge a complaint with your local data protection authority.

10. Security

We use industry-standard safeguards, including encryption in transit (TLS) and at rest, access controls, and regular security reviews, to protect your data. No method of transmission or storage is completely secure, and we cannot guarantee absolute security. If we become aware of a data breach affecting your personal information, we will notify you and relevant authorities as required by applicable law.

11. International data transfers

Lumasto is based in Ireland, and our infrastructure providers operate data centres in the European Union and the United States. Where personal data is transferred outside the EEA or UK, we rely on appropriate safeguards such as the European Commission's Standard Contractual Clauses.

12. Children's privacy

The Service is not directed to children under 16, and we do not knowingly collect personal data from children under that age. If you believe a child has provided us with personal data, contact privacy@lumasto.app and we will take steps to delete it.

13. Cookies and tracking

We use cookies and similar technologies to operate the Service, remember your preferences, and understand product usage. See our Cookie Policy for the full list of cookies we use and how to manage them.

14. Changes to this policy

We may update this Privacy Policy from time to time. If we make material changes, we will notify you by email or through an in-product notice before the changes take effect. The "Effective date" above reflects the date of the latest revision.

15. Contact us

Questions about this policy or our data practices can be sent to privacy@lumasto.app or by post to Lumasto Learning LLC, 76 Baggot Street Lower, Dublin 2, D02 XY45, Ireland.