Privacy Policy

Lumad (lumad.ai) is operated by BeSmart.ai ("Lumad", "we"). This policy explains how we collect, use, store, share, and protect personal data when you use the Lumad platform, in accordance with the Saudi Personal Data Protection Law (Royal Decree M/19, as amended) and its Implementing Regulations ("PDPL").

1. Who this policy covers

• Account holders and team members: people who create or use a Lumad account.
• Demo requesters: people who submit the "Book a demo" form.
• Your audience: when our customers connect social accounts or upload contact lists, we process data about their audience (for example, people who message a connected page, comment on a post, or appear in an uploaded recipient list). For that data, our customer is the controller and Lumad acts as a processor on their instructions. If you believe a Lumad customer processes your data, you can contact us and we will route your request to them.

2. What we collect

• Account data: name, email address, phone number, company name, language and timezone preferences, role and plan, credit balance and usage.
• Connected accounts: identifiers and access tokens for the social media pages and profiles you connect (stored encrypted).
• Content: posts, images, videos, designs, brand assets, and documents you upload or generate.
• Inbox and engagement data: messages and comments received on your connected accounts, including automated sentiment classification of their text.
• Campaign recipients: phone numbers and names in recipient lists you upload for WhatsApp campaigns, and delivery/read status per message.
• Usage and security data: activity logs, IP addresses at consent and login events, and technical logs needed to run and secure the service.

3. Why we process it (purposes and legal bases)

• Providing the service you signed up for, including publishing, inbox, analytics, and design tools (performance of a contract).
• Generating content and media with artificial intelligence models when you request it (performance of a contract).
• Automated sentiment analysis of inbox messages, on our customer's instructions (processor role).
• Sending WhatsApp campaign messages to recipient lists our customers upload. Customers must confirm the recipients consented; every message flow supports opting out (processor role, PDPL Article 25).
• Contacting you about a demo request (consent).
• Service emails such as approval and security notices (legitimate interest in operating the service).
• Security, fraud prevention, and legal compliance (legal obligation / legitimate interest).

4. Artificial intelligence processing

Lumad uses third-party AI providers to deliver its features. When you use these features, relevant content is sent to the provider for processing:

• Google Gemini: generates and edits images and videos you request, performs sentiment analysis of inbox messages and comments (the text of those messages is sent for classification), and reads scanned pages of documents you upload to your knowledge base (page images are sent for text recognition).
• OpenAI: generates post text and analyses brand documents and web pages you provide.
• Qdrant Cloud: stores searchable numerical representations (embeddings) of knowledge-base documents you upload.

These providers process data outside the Kingdom of Saudi Arabia. We do not permit them to use your data to train their models where the provider offers that control.

5. Where your data goes (transfers outside the Kingdom)

Lumad is hosted on infrastructure located outside the Kingdom of Saudi Arabia, and the providers listed in the sub-processor table below also process data outside the Kingdom. We apply safeguards required by the PDPL and its transfer regulation, including contractual protections with providers, encryption in transit and at rest, and minimisation of what each provider receives. The current list of providers, their locations, and the categories of data they receive is published at the end of this policy and kept up to date.

6. How long we keep data (retention)

We keep personal data only as long as needed for the purposes above. Retention periods per data category are configured in the platform and enforced by automated deletion jobs. Key defaults: inbox sentiment records, campaign delivery logs, uploaded recipient lists, and demo requests are deleted or anonymised on a schedule; account data is deleted when your account is deleted. You can request deletion earlier (see section 8).

7. How we protect it

• Encryption in transit (TLS) and at rest, with additional field-level encryption for access tokens.
• Role-based access control and tenant isolation; staff access is limited and logged.
• Audit logging of access to and changes of personal data.
• Rate limiting, session timeouts, and monitored security controls.

8. Your rights under the PDPL

You have the right to be informed about processing of your personal data; to access it and obtain a copy in a machine-readable format; to request correction of inaccurate data; to request destruction of data where legally permissible; and to withdraw consent for consent-based processing at any time.

You can exercise these rights from Settings, Privacy & Data inside the platform, or through our privacy request form if you do not have an account. We respond within 30 days as required by the Implementing Regulations; where an extension is necessary we will inform you with the reason before the original period expires. If you are unsatisfied with our response, you may escalate to the Saudi Data & AI Authority (SDAIA).

9. Marketing communications

We only send marketing messages to our own contacts with prior consent, and every message includes a way to opt out. Withdrawing consent stops marketing messages but does not affect service emails.

10. Cookies

The platform uses strictly necessary cookies for sign-in and security. Our public website uses optional analytics cookies and a chat widget only after you accept them through the cookie banner. See the Cookie Policy for details and how to change your choice.

11. Contact

Privacy questions and requests: privacy@lumad.ai (routed to the data protection function). We will verify your identity before acting on a request.

Third-party service providers (sub-processors)

We use the following providers to process data on our behalf. Processing may take place outside the Kingdom of Saudi Arabia as indicated below.

Provider	Service	Country	Data categories
Anthropic	AI visibility: probing Claude about how it describes the customer's brand	United States	brand and competitor names, AI-generated answers about the brand
Apple	Social listening: public App Store reviews of the customer's own app	United States	review text and ratings, reviewer nicknames, app version
BeSmart Auth Service	Login, signup, and identity verification	United States (Railway)	email address, password (hashed), name
Canva	Design integration	Australia	designs, account display name
Composio	OAuth broker for Meta, WhatsApp, and Canva	United States	OAuth tokens, account identifiers
Google (Gemini API)	AI image/video generation, inbox sentiment analysis, and OCR of scanned knowledge-base documents	United States	message and comment text, uploaded images, scanned document pages
Google (Places API)	Social listening: Google Business reviews of the customer's own locations	United States	review text and ratings, reviewer display names
Google (YouTube Data API)	Social listening: public video search	United States	public video titles and descriptions, channel names
Meta Platforms (Graph / WhatsApp Cloud API)	Publishing, inbox, and WhatsApp campaigns	United States	page content, messages, recipient phone numbers
OpenAI	AI text generation and document analysis	United States	post topics and brand content, uploaded brand documents
Qdrant Cloud	Knowledge-base vector search (self-hosted on Railway)	United States (Railway)	document embeddings
Railway	Application hosting, database, and file storage	United States	all platform data
Reddit	Social listening: public post search	United States	public post text, usernames
Resend	Transactional email delivery	United States	email address, name
SocialCrawl	Social listening: public post search across X, TikTok and Instagram	United Kingdom	public post text, usernames and display names, engagement counts
Zernio	Social account connection, publishing, and advertising	United States	OAuth tokens, profile name and picture, ad audience identifiers