Privacy Policy

This Privacy Policy (the “Policy”) describes how the personal data of users of the Lumi AI service (the “Service”) is processed and protected. The Policy has been prepared in accordance with Federal Law No. 152-FZ of July 27, 2006, “On Personal Data,” Federal Law No. 149-FZ of July 27, 2006, “On Information, Information Technologies, and the Protection of Information,” and other applicable laws of the Russian Federation governing personal data processing.

This Policy applies to information that the Data Controller may obtain about the user during their use of the Service. The Policy does not apply to third-party sites and services that may be linked to or accessible from the Service.

The data controller is:

• Konstantin Ravilyevich Vakhitov, Sole Proprietor
• TIN: 541500228607
• State Registration Number: 326547600121700
• Address: 630501, Novosibirsk Oblast, Novosibirsky District, urban settlement Krasnoobsk, 3rd microdistrict, bld. 14/1
• Email address: support@lumi.site

All questions related to the processing of personal data should be sent to the email address above.

3.1. Data provided by the user:

• email address;
• name or nickname used to address the user.

3.2. Data collected automatically when using the Service:

• IP address;
• device and browser information (User-Agent);
• session identifier;
• date and time of requests to the Service;
• cookies, as described in Section 8.

The Data Controller does not request special categories of personal data (such as racial or ethnic origin, political, religious, or philosophical beliefs, health status, or intimate life) or biometric personal data.

The Data Controller processes personal data for the following purposes:

• preparing, concluding, and performing the public offer;
• registering the user in the Service, identifying the user, and providing access to the account;
• processing payments, arranging and servicing Plus plan packages, and issuing refunds;
• personalizing communication with AI characters and maintaining long-term conversational memory;
• ensuring the technical functionality and security of the Service and protecting against fraud and abuse;
• sending the user notifications related to the use of the Service, including service and system messages;
• reviewing user requests and responding to them;
• improving the quality of the Service.

The Data Controller processes personal data on the following legal grounds:

• the user's consent to the processing of personal data, given by checking a separate box (checkbox) during registration to confirm that the user has read the Policy and consents to the processing of personal data. The consent is not part of accepting the offer and may be withdrawn separately;
• the necessity of performing an agreement to which the user is a party (Article 6(1)(5) of Federal Law No. 152-FZ);
• the necessity of pursuing the Data Controller's legitimate interests, provided that the rights and freedoms of the user are not violated.

The Data Controller performs the collection, recording, systematization, accumulation, storage, clarification (updating, modification), extraction, use, transfer (provision, access), anonymization, blocking, deletion, and destruction of personal data.

Personal data is processed both with and without the use of automated tools.

Data is transferred to third parties only in the following cases and to the extent necessary to achieve the corresponding purposes:

• to infrastructure service providers (hosting, databases, file storage) engaged for the technical operation of the Service, provided that they maintain confidentiality;
• to artificial intelligence service providers that process user requests to generate AI character responses;
• to payment services engaged to accept and process payments, to the extent necessary to carry out settlements;
• to other persons, where the user has given explicit consent or in cases directly provided for by the laws of the Russian Federation (such as upon requests from authorized bodies).

The Service uses cookies and similar technologies to:

• maintain the user's session and secure authentication;
• save user settings (for example, the selected appearance theme);
• ensure the correct operation of the Service's technical components.

Disabling cookies may limit the functionality of the Service.

The Data Controller processes personal data for as long as the user's account remains active or until the consent to the processing of personal data is withdrawn. After the account is deleted, personal data is deleted or anonymized within no more than 30 calendar days, except where a longer retention period is required by the laws of the Russian Federation (including tax and accounting laws, for information about payments made). Backup copies may contain deleted data for a limited period determined by the backup rotation cycle, after which they are automatically overwritten.

The Data Controller takes the necessary legal, organizational, and technical measures to protect personal data from unlawful or accidental access, destruction, modification, blocking, copying, distribution, and other unlawful actions by third parties, including:

• storing passwords as cryptographic hashes, making it impossible to recover them;
• using a secure data transfer protocol (HTTPS/TLS);
• restricting access to data and storing it on servers with limited physical and logical access;
• regularly updating and monitoring the software used.

To exercise the rights established by law, the user may send a request to the Data Controller's email address with the subject “Personal Data.” The request must include the user's first and last name, the email address used at registration, and the substance of the request. The Data Controller will review the request and provide a response within the time frames established by the laws of the Russian Federation.

The Operator may fulfill a request on its merits without sending a separate reply. The absence of a reply does not mean the request has been refused.

Withdrawing consent to the processing of personal data whose provision is necessary for the performance of the agreement and/or compliance with legal requirements makes further use of the Service impossible and results in the deletion of the account.

The Data Controller has the right to amend this Policy. The current version is always posted on the /privacy page, with the date of the version indicated. Continued use of the Service after the changes are published constitutes the user's acceptance of the new version of the Policy.

All questions, comments, and requests related to the processing of personal data should be sent to the Data Controller at: support@lumi.site

The Operator may fulfill a request without sending a separate reply. The absence of a reply does not mean the request has been refused.