Security posture
- Independent security review completed; all findings closed (v3).
- OAuth tokens, webhook URLs and other secrets are encrypted at rest.
- Sessions expire after inactivity; two-factor authentication (TOTP) is available for every account and enforceable for administrators.
- Strict security headers including Content-Security-Policy; outbound webhooks are HMAC-signed and SSRF-pinned.
- Every privileged action is written to an append-only audit log.
Why we process data
| Purpose | Legal basis |
|---|---|
| Account management and authentication | contract |
| Ad audience matching and lead retrieval for customers | consent |
| AI generation of post text, images, and video | contract |
| AI visibility: monitoring how AI assistants describe the customer's brand and competitors | legitimate_interest |
| Publishing content to connected social accounts | contract |
| Responding to demo requests | consent |
| Group account administration: cross-company oversight, audited workspace access, and company-owner invitations | contract |
| Sentiment analysis of inbox messages and comments | contract |
| Knowledge-base document search | contract |
| Luma assistant: answering questions about the customer's own data, retained chat history, and per-account personalization | contract |
| Lumad product marketing to account holders | consent |
| Security, audit logging, and legal compliance | legal_obligation |
| Service and security notifications | legitimate_interest |
| Public website analytics (after cookie consent) | consent |
| Social listening: monitoring public mentions of the customer's brand, competitors, and topics | legitimate_interest |
| WhatsApp marketing campaigns for customers | consent |
Sub-processor register
Third parties that receive personal data on our behalf. This table is generated from our live register.
| Provider | Service | Location | Data categories |
|---|---|---|---|
| Anthropic | AI visibility: probing Claude about how it describes the customer's brand | United States | brand and competitor names, AI-generated answers about the brand |
| Apple | Social listening: public App Store reviews of the customer's own app | United States | review text and ratings, reviewer nicknames, app version |
| BeSmart Auth Service | Login, signup, and identity verification | United States (Railway) | email address, password (hashed), name |
| Canva | Design integration | Australia | designs, account display name |
| Composio | OAuth broker for Meta, WhatsApp, and Canva | United States | OAuth tokens, account identifiers |
| Google (Gemini API) | AI image/video generation, inbox sentiment analysis, and OCR of scanned knowledge-base documents | United States | message and comment text, uploaded images, scanned document pages |
| Google (Places API) | Social listening: Google Business reviews of the customer's own locations | United States | review text and ratings, reviewer display names |
| Google (YouTube Data API) | Social listening: public video search | United States | public video titles and descriptions, channel names |
| Meta Platforms (Graph / WhatsApp Cloud API) | Publishing, inbox, and WhatsApp campaigns | United States | page content, messages, recipient phone numbers |
| OpenAI | AI text generation and document analysis | United States | post topics and brand content, uploaded brand documents |
| Qdrant Cloud | Knowledge-base vector search (self-hosted on Railway) | United States (Railway) | document embeddings |
| Railway | Application hosting, database, and file storage | United States | all platform data |
| Social listening: public post search | United States | public post text, usernames | |
| Resend | Transactional email delivery | United States | email address, name |
| SocialCrawl | Social listening: public post search across X, TikTok and Instagram | United Kingdom | public post text, usernames and display names, engagement counts |
| Zernio | Social account connection, publishing, and advertising | United States | OAuth tokens, profile name and picture, ad audience identifiers |
Data retention
| Data category | Retention period | Automated purge |
|---|---|---|
| activity_logs | 730 days | Configured |
| ai_probe_runs | 180 days | Configured |
| consent_ip_anonymize | 365 days | Configured |
| demo_requests | 365 days | Configured |
| group_invitations | 180 days | Configured |
| inbox_thread_state | 365 days | Configured |
| listening_alert_events | 365 days | Configured |
| listening_mentions | 180 days | Configured |
| luma_conversations | 365 days | Configured |
| media_uploads_orphaned | 365 days | Configured |
| notifications | 180 days | Configured |
| recipient_lists | 730 days | Configured |
| recipients | 730 days | Configured |
| sentiment_logs | 365 days | Configured |
| whatsapp_message_logs | 365 days | Configured |
Your data rights
Under the PDPL you can request access to, correction of, or deletion of your personal data. We answer every request within the statutory deadline.
Submit a privacy request