Skip to main content
← Back to home

Privacy Policy

Last updated: 27 April 2026

Lumi is operated by Livana Group Ltd (company number 16955382), a company registered in England and Wales. We take your privacy seriously and are committed to protecting your personal data in accordance with the UK General Data Protection Regulation (UK GDPR) and the Data Protection Act 2018.

This policy explains what data we collect, why we collect it, how we store it, and your rights regarding that data.

What data we collect

Account information

When you create an account, we collect your name and email address. If you subscribe to a paid plan, payment details are processed directly by Stripe and are never stored on our servers.

Scan data

We store the website URLs you submit for scanning, along with the scan results (accessibility issues, scores, and page metadata). This data is necessary to provide the service and to show your compliance history over time.

Newsletter and marketing

If you subscribe to our newsletter or download a resource, we collect your email address. We use this solely to send accessibility insights and product updates. You can unsubscribe at any time via the link in every email. We do not share your email address with third parties for marketing purposes.

Usage and analytics

With your consent, we collect anonymous usage data via Vercel Analytics to understand how the product is used and to improve it. This includes pages visited, feature usage, and general device information. Analytics are only enabled after you accept cookies. We do not use this data to identify individual users.

Cookies

We use the following types of cookies:

  • Essential cookies are required for authentication, session management, and cookie consent preferences. These cannot be disabled.
  • Analytics cookies (Vercel Analytics) are only loaded after you accept cookies via our consent banner. You can change your preference at any time by clearing your browser's local storage. The site will continue to function fully without them.

Data retention

  • Paid accounts:Scan results and account data are stored for the duration of your active subscription. If you cancel, your data is retained for 30 days after the end of your billing period before being permanently deleted.
  • Free scans:Results from free one-off scans are automatically deleted after 48 hours.
  • Newsletter:Your email is retained until you unsubscribe or request deletion.
  • Account deletion:You can request deletion of your account and all associated data at any time by contacting us. We will process your request within 30 days.

Third-party services

We use the following third-party services to operate Lumi. Each has their own privacy policy and data handling practices:

  • MongoDB Atlas — Database hosting and data storage
  • Railway — Scan worker hosting and execution (processes website URLs and scan data)
  • Stripe — Payment processing. We never store your card details directly.
  • Resend — Transactional email delivery (account verification, scan alerts, etc.)
  • Vercel — Application hosting, deployment, and analytics

International data transfers

Some of our third-party service providers (including MongoDB Atlas, Stripe, Resend, Railway, and Vercel) process data in the United States and other countries outside the United Kingdom. Where your data is transferred internationally, we ensure appropriate safeguards are in place, including Standard Contractual Clauses (SCCs) approved by the UK Information Commissioner's Office, or equivalent mechanisms that provide an adequate level of data protection.

Your rights

Under UK GDPR, you have the right to:

  • Access the personal data we hold about you
  • Request correction of inaccurate data
  • Request deletion of your data
  • Object to or restrict processing of your data
  • Withdraw consent at any time (for analytics and marketing)
  • Request a portable copy of your data
  • Lodge a complaint with the Information Commissioner's Office (ICO) if you believe your rights have been violated

To exercise any of these rights, contact us at hello@livana.io. We will respond within 30 days.

Legal basis for processing

We process your personal data on the following bases:

  • Contractual necessity — to provide the scanning service you signed up for
  • Legitimate interest — to improve the product, prevent abuse, and ensure service security
  • Consent — for analytics cookies and marketing communications, which you can withdraw at any time

Data breach notification

In the event of a personal data breach that is likely to result in a risk to your rights and freedoms, we will notify the ICO within 72 hours of becoming aware of the breach, as required by UK GDPR. Where the breach is likely to result in a high risk to you, we will also notify you directly without undue delay.

Data processing agreements

If your organisation requires a Data Processing Agreement (DPA) or Data Processing Addendum, please contact us at hello@livana.io and we will provide one.

Contact us

If you have any questions about this privacy policy or how we handle your data, please contact us at hello@livana.io.

Livana Group Ltd (company number 16955382), registered in England and Wales.