Privacy Policy

Lumi Receptionist (“Lumi”, “we”, “us”) provides an AI receptionist service for salons and beauty businesses at lumireceptionist.com. For the personal data we process about our account holders (salon owners) and visitors to our website, we act as the data controller. For personal data that a salon stores in Lumi about its own clients, the salon is the controller and we act as processor on its instructions.

Website reviews, your star rating, written feedback and any optional name or business name you provide. With your consent, these details may be published only after administrator approval. Pending and rejected reviews are not public. We keep review submissions until removed by the administrator; you may contact support to request removal or withdraw publication consent. For spam prevention, we retain a hash of the review text and use a protected hash of your IP address in short-lived submission counters. These security records are not public and are processed for our legitimate interest in preventing abuse.

Account data, name, email address, login credentials, business name, business type and contact details. Used to create and secure your account and provide the service. Legal basis: performance of our contract with you.

Business content, services, prices, durations, opening hours, team members and availability, FAQs, appointment records, client records and conversation messages you or your clients create in Lumi. Used to operate the receptionist, scheduling and messaging features. Legal basis: contract performance.

Client data entered through your booking page , a client’s name, contact details, appointment requests and messages. Used to create and manage their appointment with your business. Clients never upload files and no payment or banking credentials are collected.

Technical and usage data, IP address, device and browser information, log and error data, and feature usage. Used for security, fraud prevention, troubleshooting and improving the product. Legal basis: legitimate interests.

Support communications, the content of messages you send us. Used to answer you. Legal basis: contract performance and legitimate interests.

We do not collect or store your card details. Payment data is collected directly by our reseller and Merchant of Record, Paddle.

Service providers and subprocessors who host our infrastructure, database, storage, authentication and AI processing, strictly to deliver the service. Our Merchant of Record, Paddle, for the sale of subscriptions, subscription management, payments, tax compliance and invoicing. Professional advisers such as legal and accounting professionals. Competent authorities where we are legally required to disclose.

We do not sell personal data and we do not share it for third-party advertising.

When a client chats with Lumi, the message and the relevant business context (services, hours, availability, FAQs) are sent to our AI provider to generate the reply and to carry out booking, rescheduling or cancellation actions in your account. We instruct our provider not to use this content to train general-purpose models. AI replies can be imperfect; appointments remain subject to your approval.

Our providers may process data outside your country, including outside the UK and EEA. Where that happens we rely on appropriate safeguards such as standard contractual clauses or an adequacy decision.

We keep account and business data for as long as your account is active. Deactivating your account preserves your data so you can reactivate it. Deleting your account permanently removes your account and business data from our live systems, other than records we must keep for legal, tax or accounting purposes. Backups and logs are cleared on a rolling schedule.

Subject to applicable law you may request access to your personal data, correction, erasure, restriction, portability, and object to processing based on legitimate interests. Where processing relies on consent you may withdraw it at any time. You may also complain to your local data protection authority. To exercise a right, email support@lumireceptionist.com. We respond within one month.

We use appropriate technical and organisational measures, including encryption in transit, row-level access controls that isolate each business’s data, private storage for uploaded files, and least-privilege access for our team. No system is perfectly secure, so please protect your login credentials.

We only use strictly necessary cookies and browser storage. We do not use analytics, advertising or marketing trackers, and no optional tracking loads before or after consent, because there is none.

Hosting and security cookies. Our hosting and security providers set short-lived cookies (for example Cloudflare’s __cf_bm and our hosting provider’s __dpl) to protect the site from bots and abuse and to deliver pages reliably. These are strictly necessary and cannot be switched off.

Sign-in and preferences. If you have a business account, your browser stores your sign-in session and basic interface preferences (such as sidebar layout) so you stay signed in and the app remembers your setup.

Client appointment access. When a client books through a business’s Lumi page, their browser stores a private access key for each of their appointments. This key is what lets them view, reschedule or cancel their own booking later without an account. It stays on their device; anyone using the same browser can see the same saved appointments.

Payments. Our checkout provider, Paddle, sets its own cookies only when you open checkout to complete a payment.

You can clear or block cookies and site data in your browser, but sign-in and returning to a saved appointment will not work without the necessary ones.

Lumi is a business tool and is not intended for children.

We may update this policy; we will change the date above and, for material changes, notify you in the app. Questions: support@lumireceptionist.com.