Privacy Policy
Last updated: 17 September 2026
This policy explains what personal data Lumineus ("we", "us") collects, why, and your rights under the EU General Data Protection Regulation (GDPR).
1. Who is responsible
The data controller is Aeonloom, Copenhagen, Denmark. For any privacy question or to exercise your rights, use the contact form.
2. What we collect
- Account data — your email address and a hashed password.
- Search activity — the questions you ask and, for members, a saved history and any sources or answers you choose to save. This lets us provide the history/favourites feature and improve the service.
- Technical data — standard server logs (IP address, timestamp, request) kept for security and troubleshooting.
- Payment data — when billing is live, handled by our payment provider (see §5); we do not see or store your card details.
- Messages you send us — through the contact form: your name, your email address, the reason you chose, your message, the page you sent it from and, if you were signed in, your account.
- Downloads — when you download Tabulia or its model files, our download provider (§5) handles the request, and its request logs, which include your IP address, are kept by the provider for a short time. From those logs we count downloads per file, per day and per country; we do not keep your IP address.
We do not use advertising trackers, and we do not sell your data.
3. Why we use it, and the legal basis
- To provide your account and the search service — performance of a contract.
- To keep the service secure and prevent abuse — legitimate interest.
- To understand usage in aggregate and improve the product — legitimate interest.
- To take payment for a subscription — performance of a contract.
- To answer a message you send us, and to act on a report of illegal content — legitimate interest and, for reports, our legal obligation as a host.
Searches made with the free try-it search (on this site or in the Tabulia app) are counted without storing your IP address or your question; to count distinct visitors we keep only a keyed hash of the address that changes every day, so it cannot follow you from one day to the next.
4. AI processing of your questions
To produce a cited answer, your question and the matching public-domain passages are processed by an AI language model operated by Mistral AI, whose processing takes place in the EU (France). We send only your question and the retrieved passages — never your email address, account details or search history. This processing therefore involves no transfer of your data outside the EU/EEA. Should we ever use a provider outside the EU/EEA, transfers would be covered by Standard Contractual Clauses and this policy updated first.
4a. Pages you share
If you share an answer, we publish it as a page at an unguessable link that anyone holding the link can open, with no account. We store the question, the answer and the passages it quoted, together with your account, so that the page can be shown and so that we can act on a complaint about it.
A shared page does not stay online indefinitely. A page shared from a free account is removed 30 days after it was created. A page shared from a paid account is removed 60 days after it was created — and, for an answer from our own corpus, 60 days after a reader last opened it, so a page in active use stays up while one nobody reads does not. You can end any of your shared pages at once under Your shared pages; when a page ends, whether by your choice or by reaching its date, its question, answer and passages are deleted from the live service at once and the link stops working for everyone. We keep a minimal record — which account made it, when, and a one-way fingerprint of what it held — so that a later complaint can be answered.
One honest qualification: deleting a page removes it from the live service immediately, but our routine database backups may still contain a copy for a while. Those copies are not reachable through the site and are used only to restore the service after a failure. Backups are kept for up to 14 days on the server and up to 90 days in offsite storage, and one snapshot per month is retained for up to 12 months as a disaster-recovery archive. After that no copy of the page remains.
If you use Tabulia and share an answer built from your own documents, that answer and the excerpts it quotes are uploaded to this server and published in the same way, on your instruction and after the app shows you the page exactly as it will appear. Those pages last 60 days and do not extend when read. Tabulia does not upload your documents themselves at any other time.
Anyone can report a shared page using the link on the page itself. If a page is reported or removed by us, we may keep a copy of what it held for up to 90 days in order to handle the report, and then erase it.
5. Who we share it with (sub-processors)
| Provider | Purpose | Region |
|---|---|---|
| netcup | Hosting | EU (Germany) |
| Scaleway | Backups & transactional email (including the notice that a contact message has arrived) | EU (France) |
| Bunny (BunnyWay d.o.o.) | Download delivery for Tabulia and its model files | EU (Slovenia; files served from Germany) |
| Mistral AI | AI answer generation | EU (France) |
| Paddle | Payments (when live), as merchant of record | United Kingdom (covered by an EU adequacy decision) |
6. How long we keep it
Account data is kept until you delete your account. Your search history keeps your most recent 500 searches — older entries are removed automatically as new ones are added. Your search history and saved items are otherwise kept until you delete them or close your account. Shared pages are kept for 30 or 60 days as described in section 4a, and a reported page's content for up to 90 days after it is removed. Anything deleted may persist briefly in routine backups — see the end of section 4a for how long those are kept.
| What | How long |
|---|---|
| Account data | Until you delete your account |
| Search history | Your newest 500 searches, each until you delete it or close your account |
| Saved items | Until you delete them or close your account |
| Shared pages | 30 days (free) or 60 days (paid) — see section 4a |
| A reported page's content | Up to 90 days after it is removed |
| Contact messages | Up to 12 months, unless the nature of a message requires us to keep it longer — for example for legal purposes |
| Web server logs (these contain IP addresses) | 14 days, then deleted |
| Try-it search counts | A keyed hash that changes daily — never the IP address or the question |
| Download counts | Per file, day and country only — no IP address is kept |
| Database backups | Up to 14 days on the server, 90 days offsite, and one monthly snapshot for up to 12 months |
7. Your rights
You have the right to access, correct, erase, restrict or object to the processing of your data, and to data portability. You can delete saved items and your account at any time. You may also lodge a complaint with your local data-protection supervisory authority.
8. Changes
We may update this policy; material changes will be notified in-app or by email. Questions? Use the contact form.