Lumen Privacy Notice

Version 2026-10-30.2

Who is responsible

DailyMind LTD (Cyprus, HE 439959) operates Lumen at https://lumen.observer. Contact support@lumen.observer for privacy questions or requests.

What we collect and why

You must be 18 or older. Do not upload photos, government ID numbers, health information, religious beliefs or other sensitive personal information. We do not request employer-site passwords. Input screening cannot reliably identify sensitive information embedded in free text; check your materials before saving.

Your account

Your Lumen account is separate from our other sites. Lumen login sessions are registered separately and Lumen data requires that session as well as ownership. Your job-search data is not used for other purposes without separate consent.

Providers and international processing

• Supabase provides authentication, database and private file storage. The chosen database region is Ireland according to the project’s recorded configuration; this does not mean every support or subprocess operation stays in the EU. Its DPA provides international-transfer safeguards including standard contractual clauses.
• Cloudflare runs the application and bot protection. Requests may be processed on its global network under its DPA.
• Resend delivers login emails, receiving your email and the login-link message, forwards feedback you send to our support mailbox, and sends Book a Call confirmations, reminders and cancellations, under its DPA.
• Google: for Book a Call, Lumen reads busy times from the Google calendars you choose and creates, and on cancelling deletes, the booked call’s event (with your guest’s name and email) in your calendar, through the Google Calendar API with the access you grant. Google handles your calendar under your own Google terms. How Lumen shares and protects Google user data: Google user data (Book a Call).
• Hetzner Online GmbH hosts our server in Helsinki, Finland, which runs our self-hosted Umami analytics (Cookies and logs) and keeps encrypted copies of our database (daily, the newest 3). They are encrypted before they reach the server, with a key the server doesn’t hold.
• Stripe (Stripe Payments Europe, Limited) processes payments. It collects your card details and billing address on its checkout page, acting for us for the payment and as a controller for its own purposes such as fraud prevention and legal duties, under its privacy notice. We give Stripe your email address and receive your subscription status, Stripe customer and subscription IDs, and refund records; we never see your card details.
• Anthropic scores matches using relevant resume summaries and experience, country, work authorization, preferences and employer job descriptions under its DPA. We omit account email, name, phone and answer-bank entries from the matching request. Free-text resume facts may still contain personal information you enter. CV import sends the PDF you choose to Anthropic to extract a resume for you to review (name, contact email and phone, summary, experience and other CV sections). We instruct the model to leave out photos, addresses, birth dates, ID numbers and sensitive information, but check the result before saving. We don’t store the PDF or an unsaved result. Company descriptions: up to three of a company’s job postings (contact details already removed) go to Anthropic to write a short description and sectors in our own words.

Each of these DPAs is part of the provider’s standard customer terms that our accounts are on, and covers transfers outside the EEA with the EU standard contractual clauses (Commission Decision 2021/914).

Google user data (Book a Call)

• What Lumen accesses: with the Google Calendar access you grant, Lumen receives the email address and ID of each Google account you connect, reads its calendar list and the busy times of the calendars you choose, and creates, and on cancelling deletes, the event of each call booked with you, including its Google Meet link. Lumen stores each booking’s event ID and meeting link with the booking.
• Who it is shared with: Lumen does not sell Google user data and does not share, transfer or disclose it to anyone except these service providers, which act for us only to run Book a Call: Supabase stores the account email and ID, the calendar list, your choices, the encrypted refresh token and each booking’s event ID and meeting link; Cloudflare runs the application that sends the Calendar requests; Resend sends the booking emails to you and your guest, which contain the call’s time and meeting link; Hetzner Online GmbH (Helsinki, Finland) keeps our encrypted daily database backups, which include these records, for 3 days. We may also disclose it where the law requires.
• No AI training: Google user data is never sent to Anthropic or any other AI or machine learning service, and is never used to develop, improve or train AI or machine learning models, ours or anyone else’s.
• How it is protected: the Google refresh token is encrypted with AES-256-GCM before it is stored, with a key kept outside the database; all requests to Google and to our providers use encrypted connections (TLS); busy times are used at once to show free times and are not stored; no one at Lumen reads Google user data except for security, legal duties or with your agreement. When you disconnect a Google account or delete your Lumen account, Lumen asks Google to revoke its access, then deletes the token (Retention and deletion).
• Limited Use: The use of raw or derived user data received from Workspace APIs will adhere to the Google User Data Policy, including the Limited Use requirements. Lumen’s use of information received from Google APIs also adheres to the Google API Services User Data Policy, including the Limited Use requirements. Lumen uses it only for Book a Call, never for advertising.

Book a Call guests

This section is for people who book a call on a Lumen user’s booking page (GDPR Art. 13).

• Who decides: the person whose page you book (the host) decides about your booking and the call. DailyMind LTD runs the page for the host and processes your data on the host’s behalf, under the Book a Call data processing terms in our Terms of Service. You don’t need a Lumen account.
• What we process: your name, email, the time you chose, your time zone and the call’s meeting link; to stop abuse, short-lived hashes of your IP address and email (never the values) and a bot check by Cloudflare Turnstile, which runs under Cloudflare’s Turnstile privacy addendum (it reads signals such as your IP address and browser, acting for us and, to improve bot detection, for itself). For this abuse protection DailyMind LTD decides itself, on the basis of legitimate interests in a secure service (GDPR Art. 6(1)(f)): the hashes count requests for at most a day and are deleted within two days, and stopping spam bookings also protects you and the host.
• Where it goes: to the host (email), into the host’s Google Calendar as an event with you as a guest (Google sends you the invitation), and through Resend for your confirmation, reminder and cancellation emails. These come from noreply@lumen.observer with the host’s email as the reply address, so you see the host’s email and a reply goes to the host.
• How long: until the host deletes your booking or their Lumen data, and in any case 90 days after the booked call’s end, cancelled or not. Cancelling through your link frees the time at once.
• Basis and need: the host sets the legal basis for using your data for the call; ask them. Your name and email are needed to book: without them no booking is made.
• Your rights: access, correction, deletion, restriction, objection and a copy of your data. Send requests to the host; if you write to support@lumen.observer instead, we pass your request to the host and help them answer it. You can also complain to a data protection supervisory authority, in particular where you live or work (for DailyMind LTD: the Cyprus Office of the Commissioner for Personal Data Protection, below).
• Emails: they pass through Resend under its terms and its data processing agreement (Providers).
• Outside the EEA: our providers may process your data outside the EEA under the EU standard contractual clauses; see Providers and international processing.

Employers

Lumen never sends anything to employers. You apply yourself on the employer’s site, with your own CV. Employers handle applications under their own privacy notices. Deleting Lumen data can’t delete an application already sent to an employer; ask the employer directly.

Job postings and company information

This section is for people who aren’t Lumen users, such as a recruiter named in a job posting (GDPR Art. 14).

• Source: job postings that companies publish themselves, through their hiring systems’ public job feeds, and company facts: the name and web address from that hiring system, plus a short description and sectors we write from the company’s postings (Anthropic processes the postings for this, see Providers).
• Purpose and basis: letting job seekers find and compare open jobs. Basis: legitimate interests (Art. 6(1)(f)): people looking for work, and employers who publish jobs to be found.
• What we keep: the posting’s facts, a summary in our own words, a link to the employer’s page, and the posting text for matching only. Users never see the posting text. We don’t need anyone’s contact details: we remove email addresses and phone numbers and drop contact blocks such as “Contact:” before storing. A name inside a sentence may remain in the stored text.
• How long: while the posting is open, and 7 days after it closes or leaves the employer’s feed; postings older than 6 months are removed too. Encrypted backups: 3 days (below).
• Your rights: you can object or ask us to delete or correct data about you at support@lumen.observer.
• Companies and site owners: we read only public job feeds, honour robots.txt, and stop reading a company’s postings and remove its jobs on request, within one business day, at support@lumen.observer.

Immigration guides

This section is for members of the public Telegram group @kyrillic (GDPR Art. 14).

• What we did: to learn which immigration questions people ask, we read an export of the group’s public messages (December 2021 to October 2026) on our own computer. Names were replaced by codes, and phone numbers, emails, links and usernames were removed. Anthropic (see Providers) labelled the topics and wrote the questions in English.
• What we keep: only counts of questions per country and topic, which don’t identify anyone. We deleted everything else on 25 October 2026.
• What we publish: guide pages answer each question from laws and official sources only. They contain no messages, quotes, stories or names from the group.
• Basis: legitimate interests (Art. 6(1)(f)): writing guides that answer the questions people actually have. Telling every member individually would take a disproportionate effort (Art. 14(5)(b)), so we publish this section instead.
• Your rights: you can object or ask questions at support@lumen.observer. Before we ever read the group again, we will update this section first.

Retention and deletion

We retain your materials while you use Lumen. Delete my Lumen data (in My data) removes Lumen profile data and related resume versions, preferences, answers, matches (including the jobs you marked applied), scoring tasks and usage records, match-run records, CV import records, feedback, Lumen Pro subscription, withdrawal and refund records, acceptance records and sessions from the live database, and Book a Call data (booking page, hours, connected Google accounts and calendars, bookings). Before that it cancels your upcoming calls (guests are told) and asks Google to revoke Lumen’s access to each connected Google account; if Google doesn’t answer, Lumen’s copy of the token is deleted anyway. Disconnecting a Google account needs its upcoming calls cancelled or over first, then asks Google to revoke. From then on new bookings no longer go to that account; its busy times still count until Google confirms the revoke, and stop being read once it does. If Lumen Pro ends, connected Google accounts and their tokens stay, so you can still cancel calls and disconnect, until you disconnect them or delete your Lumen data. Book a Call bookings are deleted 90 days after the booked call’s end, cancelled or not. Deletion first cancels an active Lumen Pro subscription, then removes any stored files before deleting database records. If file cleanup fails, you can retry the deletion; the remaining database facts are preserved meanwhile. Employer job records remain. Operational rate-limit records use short windows and are cleaned on later login requests. Lumen sessions expire after 30 days.

Deleting Lumen data preserves your authentication account. We also keep a SHA-256 hash of your email address, so the free plan can’t be restarted with the same email (our legitimate interest in preventing misuse of the free plan). Contact us to request deletion of the whole account; we will handle applicable legal retention requirements. Encrypted database backups are kept for 3 days and then overwritten, so deleted data disappears from them within 3 days. Payment records stay in Stripe for as long as tax and accounting law requires us to keep them.

Your rights

You can export your Lumen information in JSON and delete your Lumen data from My workspace. Contact us for access, correction, restriction, objection, portability or a whole-account deletion request. Where processing relies on consent, you can withdraw it without affecting earlier lawful processing. You may complain to the Cyprus Office of the Commissioner for Personal Data Protection or your applicable supervisory authority. Statutory exceptions may apply; we explain any restriction in our response.

Cookies and logs

We use secure, HTTP-only session cookies for authentication, and Cloudflare Turnstile to prevent automated abuse. When you pay, you go to Stripe’s checkout page, which may use cookies it needs for payment and fraud prevention, under Stripe’s notice. Lumen uses no advertising cookies.

Public pages only (home, About, How it works, Companies, Guides, Terms, Privacy, Refund Policy and Consulting Call Terms), never your workspace or matches:

• Umami, which we host ourselves on our server at Hetzner in Finland, counts page views, referrers, device and browser type and country. It sets no cookies, doesn’t store your IP address, and never receives your email or job-search data. Basis: legitimate interest in knowing which pages help visitors.
• Microsoft Clarity records clicks and scrolling, with form fields masked, to show us where the page is confusing. It sets cookies, so it runs only if you choose Allow in the banner. Microsoft processes this data under its own privacy statement, which can include processing outside the EU. You can change your choice at any time with Cookie settings at the bottom of these pages.

Operational failure logs identify the request and failed stage, without recording resumes, answers, email addresses or tokens.

Updates

We version this notice and record acknowledgement during login. Material changes will be communicated before they take effect where required. Acknowledging this notice is not the legal basis for the contractual processing described above.