Privacy Policy

Your privacy is important to us. This policy explains how we collect, use, and protect your data.

1. Introduction and Responsible Body (Data Controller)

Welcome to LuminaOS by Bright Minds. We take the protection of your personal data very seriously. This Privacy Policy informs you about the nature, scope, and purpose of the collection and use of personal data on our website and in connection with our services, including our online programs and the LuminaOS application.

The data controller responsible for data processing is:

Bright Minds
Tilman Resch
Knoebelstr. 30
80538 Munich
Germany

Email: legal@luminaos.app
Website: https://luminaos.app

We treat your personal data confidentially and in accordance with the statutory data protection regulations, in particular the EU General Data Protection Regulation (GDPR), the German Federal Data Protection Act (BDSG), and the Telecommunications Telemedia Data Protection Act (TTDSG), as well as this privacy policy.

2. Data Collection and Processing

a) When Visiting Our Website (Server Log Files)

When you access our website, our hosting provider automatically collects and stores information in server log files, which your browser transmits to us. This includes:

  • Browser type and version
  • Operating system used
  • Referrer URL (the previously visited page)
  • Hostname of the accessing computer
  • Time of the server request
  • IP address (anonymized or shortened)

This data is not merged with other data sources. The basis for this data processing is our legitimate interest (Art. 6(1)(f) GDPR) in ensuring the security, stability, and error-free operation of our website.

b) Cookies

Our website uses cookies. Cookies are small text files that are stored on your device.

  • Essential Cookies: We use technically necessary cookies to make our website user-friendly and functional (e.g., for login sessions). The legal basis is our legitimate interest (Art. 6(1)(f) GDPR) and, where applicable, § 25(2) TTDSG.
  • Non-Essential Cookies: Other cookies (e.g., for analytics, marketing) are only used with your explicit consent, which we obtain via a cookie consent banner. The legal basis for this is your consent (Art. 6(1)(a) GDPR and § 25(1) TTDSG). You can withdraw your consent at any time through the cookie settings on our website.

c) Contacting Us (Email or Contact Form)

If you contact us via email or a contact form, the information you provide (e.g., name, email address, your message) will be stored by us to process your request and for any follow-up questions. We process this data based on Art. 6(1)(b) GDPR if your request is related to the fulfillment of a contract or for pre-contractual measures. In all other cases, the processing is based on our legitimate interest (Art. 6(1)(f) GDPR) in effectively handling the inquiries addressed to us.

d) Account Registration and Use of Services

To use our online programs or the LuminaOS app, you must register an account. We collect data such as your name, email address, and a password. This data is necessary to provide and manage your account and deliver the services you have purchased. The legal basis is the performance of a contract (Art. 6(1)(b) GDPR).

e) Data Processing within the LuminaOS Application

The LuminaOS web and mobile applications are designed for personal growth and involve the processing of highly personal data you provide. This includes:

  • Profile Information: Your name and email address.
  • User-Generated Content: Goals, journal entries, daily notes, habit tracking data, reflections, OBS categories, Prime Time scheduling data, and other text, images, audio, or files you input into the app.
  • People, Team, and Community Data: People/contact records, relationship notes, accountability-group participation, team or community content, and other collaboration data you choose to create or share.
  • AI Coach and AI-Assisted Features: The prompts you enter, the responses generated by AI Coach, and text or audio you choose to submit for AI-assisted journaling, reflection, or transcription features.
  • Google Integrations: Data synchronized with Google services that you choose to connect, such as Google Tasks, Google Calendar, Google Contacts / Google People, and Google Docs backup.
  • Export and Backup Data: Data included when you use export, backup, or connected-document features made available in the Services.

This data is processed solely to provide you with the functionality of the app. The legal basis is the performance of our contract with you (Art. 6(1)(b) GDPR). We treat this data with the highest level of confidentiality.

f) AI-Powered Features

Our AI Coach currently uses OpenAI-powered services to provide responses and related AI-assisted functionality. When you use these features, the data you submit, including prompts and any supported text or audio content, may be sent to those AI service providers for processing.

  • We have data processing agreements (DPAs) in place with our AI service providers.
  • According to these agreements, your data is not used to train their public models.
  • We urge you not to enter any sensitive personal data (e.g., health information, financial details, government IDs) that you would not want a third party to process.

The legal basis for this processing is the performance of the contract (Art. 6(1)(b) GDPR), as it is an integral part of the service.

g) Newsletter

If you subscribe to our newsletter, we require your email address. We use a "double opt-in" procedure to verify that you are the owner of the email address and consent to receiving the newsletter. You can revoke your consent and unsubscribe from the newsletter at any time, for example, via the "unsubscribe" link in the newsletter. The data processing is based on your consent (Art. 6(1)(a) GDPR).

3. Data Recipients and Third-Party Transfers

We may share your data with trusted third parties to provide our services, including:

  • Hosting and Infrastructure Providers: To host and operate our Services, including Vercel and AWS services such as Aurora PostgreSQL, S3, and Cognito.
  • Payment and Subscription Providers: (e.g., Stripe and mobile subscription providers such as app-store billing and RevenueCat-backed entitlement handling) to process payments, subscriptions, renewals, and restores. These providers may process your billing data independently.
  • AI Service Providers: As described in section 2(f).
  • Google Services: For Google Tasks, Google Calendar, Google Contacts / Google People, Google Docs backup, and authentication (if you choose to connect them).
  • Analytics Providers: (e.g., Google Analytics) if you have given your consent.

If we transfer data to service providers in countries outside the European Union (e.g., the USA), we ensure a legally permissible level of data protection. This is typically done through the EU-U.S. Data Privacy Framework for certified US companies or by concluding EU Standard Contractual Clauses (SCCs).

4. Your Rights as a Data Subject

You have the following rights regarding your personal data under the GDPR:

  • Right of Access (Art. 15 GDPR): The right to obtain information about your personal data processed by us.
  • Right to Rectification (Art. 16 GDPR): The right to have inaccurate personal data corrected.
  • Right to Erasure / "Right to be Forgotten" (Art. 17 GDPR): The right to have your data deleted, provided there are no legal retention obligations. For practical instructions on in-app deletion and how to submit a deletion request, see section 4a below.
  • Right to Restriction of Processing (Art. 18 GDPR): The right to request a restriction on the processing of your data.
  • Right to Data Portability (Art. 20 GDPR): The right to receive your data in a structured, common, and machine-readable format.
  • Right to Withdraw Consent (Art. 7(3) GDPR): The right to withdraw your consent at any time with future effect.
  • Right to Lodge a Complaint (Art. 77 GDPR): The right to complain to a supervisory authority. The competent authority for us is the Bayerisches Landesamt für Datenschutzaufsicht (BayLDA), Promenade 18, 91522 Ansbach, Germany.

Information about your Right to Object under Art. 21 GDPR

You have the right to object, on grounds relating to your particular situation, at any time to the processing of personal data concerning you which is based on Art. 6(1)(e) (public interest) or Art. 6(1)(f) GDPR (legitimate interest).

If you object, we will no longer process your personal data unless we can demonstrate compelling legitimate grounds for the processing which override your interests, rights, and freedoms, or for the establishment, exercise, or defense of legal claims.

The objection can be made form-free and should be directed to legal@luminaos.app.

4a. Account and Data Deletion Requests (Art. 17 GDPR)

You can request deletion of your LuminaOS account and associated personal data at any time, subject to legal retention obligations (e.g., tax and accounting requirements for invoices).

In-App Account Deletion

You can delete your account directly in the app settings:

https://luminaos.app/settings/app

To do so, open the settings page and click the account deletion button. Once confirmed, your account and associated personal data will be scheduled for deletion, subject to any legal retention obligations.

Deletion Request via Email

If you prefer, you can also request deletion by email.

How to submit a deletion request:

  • Send an email to: legal@luminaos.app
  • Subject line: "Request for user data deletion"
  • In the message body, include:
    1. The email address of the LuminaOS account you want to delete
    2. A short statement that you request deletion of your account and associated personal data
    3. Optional: specify whether you want (a) full account deletion or (b) deletion of specific data categories

Verification and Processing

  • We may ask for additional information to verify that the request is made by the account holder.
  • We will process deletion requests within a reasonable timeframe and confirm completion via email.
  • If certain data must be retained due to legal obligations, we will restrict processing of that data and retain it only for the required period.

Mobile App Local Storage and Offline Use

On supported mobile devices, the LuminaOS app may store certain data locally on your device to support secure sign-in, offline use, draft recovery, queued synchronization, and backup safety mechanisms.

  • Authentication or session-related credentials may be stored in secure device storage such as the iOS Keychain or Android secure storage facilities.
  • Drafts, pending operations, offline metadata, and local backup files may be stored temporarily on device and synchronized or cleared later depending on your actions and app state.
  • Where you use connected contact, journaling, or backup features, local caching may occur to support performance, recovery, and offline continuity.

5. Data Retention

We process and store your personal data only for the period necessary to achieve the purpose of storage, or as far as this is granted by European legislators or other legislators in laws or regulations to which the controller is subject.

  • Account data is stored as long as your account is active.
  • Data from contact requests is deleted once the request is fully resolved.
  • Contractual data and invoices are retained for the statutory periods required by German commercial and tax law (typically 10 years).

6. Data Security

We use appropriate technical and organizational security measures to protect your data against accidental or intentional manipulation, partial or complete loss, destruction, or unauthorized access by third parties. Our website uses SSL/TLS encryption for security and to protect the transmission of confidential content.

7. Changes to this Privacy Policy

We reserve the right to adapt this privacy policy so that it always complies with the current legal requirements or to implement changes to our services in the privacy policy. The new privacy policy will apply to your next visit.

Important Disclaimer

This is a comprehensive template based on the information provided. Data protection law is complex. It is strongly recommended that you have this document reviewed by a legal professional specializing in German and EU data protection law (DSGVO/GDPR) to ensure full compliance with your specific data processing activities.

Last updated: March 23, 2026

For questions about this privacy policy, please contact us at legal@luminaos.app