Privacy Policy

We take the protection of your personal data seriously. This Privacy Policy informs you about which personal data we process when you use our website www.LumAIa.ch, our Software-as-a-Service platform "LumAIa" (the Agentic Agency OS), and in the context of communication, marketing, and support, as well as for what purposes, on what legal basis, and to whom we disclose it.

This policy applies to all processing operations for which we are the data controller. For personal data that our customers upload to the platform and that we process on their behalf, the customers are the controllers and we act as the data processor – see Section 3.

The Swiss Federal Act on Data Protection (FADP) and, to the extent applicable, the EU General Data Protection Regulation (GDPR) govern these practices. Terms such as "processing" are used interchangeably under both laws.

Controller: LumAIa by Dewave GmbH, Bahnhofstrasse 59, 6312 Steinhausen, Switzerland Data Protection Inquiries: privacy@lumaia.studio Data Protection Officer / Advisor: Remo Girard

a) We as Controller: For data relating to website visitors, prospective clients, contact persons of our customers, job applicants, and user accounts (registration, billing, support, security), we determine the purposes and means ourselves. This Privacy Policy applies fully to these processing operations.

b) We as Data Processor: Content uploaded by customers to the platform or connected via interfaces – such as customer lists, CRM data, image material depicting individuals, or campaign data – is processed by us exclusively in accordance with the customer’s instructions on the basis of a Data Processing Agreement (DPA). For information and to exercise data subject rights regarding such data, individuals should contact the respective customer. If we receive an access or deletion request concerning such data, we will forward it immediately to the customer.

Master and Contact Data: First and last name, company, position, business address, email address, phone number, language.

Account and Usage Data: Username, role and permissions, time of registration, login timestamps, booked modules and plans, number of seats, credit consumption, created projects and assets (metadata), support history.

Contract and Payment Data: Contract contents and term, invoice and payment details, payment method, payment status, reminders. Full payment card details are processed exclusively by our payment service provider (Stripe); we only receive a token, card type, the last four digits, and the expiration date.

Technical Data: IP address, date and time of access, requested pages and resources, HTTP status codes, data volume transferred, referrer URL, browser type and version, operating system, device type, screen resolution, language settings, error and security logs.

Behavioral and Analytics Data: Interactions with our website and platform, accessed features, click and scroll behavior, session recordings and heatmaps (see Section 8 regarding Smartlook), opening and click rates of our emails.

Communication Data: Content of emails, contact forms, support tickets, chat histories, notes on conversations and appointments, recordings of online meetings (only with prior information and consent).

Content and AI Data: Prompts, briefings, and uploads entered by users, as well as the resulting outputs (texts, images, videos, evaluations). These may contain personal data if users input or upload such data.

Application Data: Application documents, CV, references, interview notes (only for applications to our company).

We primarily collect personal data directly from you. Additionally, we may collect data from publicly accessible sources (websites, commercial registries, LinkedIn), from customers, intermediaries, or cooperation partners, and automatically when you visit our services.

We process personal data for the following purposes:

Provision and operation of the platform, user management, support – Legal Basis: Art. 6(1)(b) GDPR (Performance of contract) / Contract performance, Art. 31(2)(a) FADP

Billing, payment processing, credit and fraud checks – Legal Basis: Art. 6(1)(b) and (f) GDPR / Legitimate interest in secured payment

Security, abuse and attack detection, logging – Legal Basis: Art. 6(1)(f) GDPR / Legitimate interest in system security

Improvement and development of the platform, product analytics – Legal Basis: Art. 6(1)(f) GDPR; Art. 6(1)(a) for non-essential cookies / Consent where required

Direct marketing to B2B clients, newsletter, events – Legal Basis: Art. 6(1)(f) or (a) GDPR upon consent / Comply with Art. 3 UWG; opt-out possible at any time

Compliance with legal obligations (accounting, VAT, reporting) – Legal Basis: Art. 6(1)(c) GDPR / Legal obligation

Legal enforcement and defense against claims – Legal Basis: Art. 6(1)(f) GDPR / Legitimate interest

Application procedures – Legal Basis: Art. 6(1)(b), Art. 88 GDPR / Pre-contractual relationship

Where we request your consent, you may revoke it at any time with effect for the future (datenschutz@LumAIa.ch or via cookie settings). The lawfulness of processing conducted prior to revocation remains unaffected.

We use cookies and similar technologies (Local Storage, pixels, SDKs) on our website and platform.

Essential Cookies: Enable login, session management, load balancing, security, and storage of your cookie preferences. They are required for operation and set without consent.

Analytics and Performance Cookies: Help us understand usage and improve our services. They are set only after your consent in the cookie banner.

Marketing Cookies: Used to measure and control advertising and are set only with your consent.

You can adjust your choices at any time via the Cookie Settings and delete or block cookies in your browser settings. If essential cookies are blocked, parts of our services may not function.

We share personal data with:

Service providers and data processors supporting our operations (hosting, AI services, email dispatch, analytics, payment processing, support tools, accounting) – see the table in Section 8. They are contractually bound to process data only according to our instructions and maintain adequate security;

Advisors and authorities (attorneys, auditors, insurers, tax and regulatory authorities, courts), to the extent necessary or required by law;

Acquirers or investors in the context of corporate transactions, subject to confidentiality.

We do not sell personal data.

Below are the services used in operating and marketing LumAIa. This list is kept up to date; changes are communicated pursuant to the DPA.

Google Cloud Platform / Vertex AI – Google Ireland Ltd., IE / Google LLC, USA – Hosting, computing power, image/text generation, asset storage – EU/CH regions, potentially USA

Google Workspace – Google Ireland Ltd., IE – Internal communication, documents, calendars – EU, potentially USA

Supabase – Supabase, Inc., USA – Database, user authentication, asset storage – EU (Frankfurt/Zurich) recommended

Stripe – Stripe Payments Europe Ltd., IE / Stripe, Inc., USA – Payment processing, subscription management, fraud prevention – EU and USA

Customer.io – Peaberry Software, Inc., USA – Transactional emails, onboarding sequences, newsletters – USA

Smartlook – Smartlook s.r.o., CZ (Cisco Group) – Usage analytics, heatmaps, error diagnostics via pseudonymized session recordings – EU (Czech Republic), intra-group transfers to USA possible

Regarding Smartlook: Session recordings reproduce interactions with our interface. Smartlook is configured to mask input fields and sensitive areas so that no passwords, payment data, or sensitive personal data are captured. Usage occurs only upon your consent in the cookie banner.

Personal data may be transferred to countries outside Switzerland and the EEA, particularly the USA, if service providers operate infrastructure or provide support there. Not all of these countries possess data protection laws recognized as adequate by the Swiss Federal Council or the European Commission.

In such cases, we base the transfer on: Standard Contractual Clauses (SCCs) in the version approved by the EU Commission, incorporating adaptations recognized by the Swiss FDPIC, supplemented by technical and organizational measures; where applicable, the recipient’s certification under the EU-U.S. Data Privacy Framework and its Swiss-U.S. Extension; in individual cases, your explicit consent or statutory exceptions (Art. 17 FADP, Art. 49 GDPR).

You may request a copy of the applied safeguards at datenschutz@LumAIa.ch.

We retain personal data for as long as necessary to fulfill the stated purposes, and beyond that, as required by statutory retention duties or to defend against claims.

Account and Contract Data: Duration of contract and 10 years thereafter (commercial and tax retention duties, Art. 958f CO)

Invoice and Payment Data: 10 years

Customer Content on Platform: Contract duration, export available for 30 days thereafter, deletion within 90 days

Server and Security Logs: 90 days; retained until resolution in case of security incidents

Session Recordings (Smartlook): 3 months

Newsletter / Marketing Data: Until revocation; suppressed on a suppression list thereafter to honor opt-out

Contact Inquiries (no contract): 24 months

Application Data: 6 months after completion of hiring process; longer upon consent

Upon expiration of these periods, data is deleted or anonymized. Backup copies may persist until regular rotation cycles complete.

We implement appropriate technical and organizational measures (TOMs) to protect personal data against unauthorized access, loss, and misuse. These include transmission encryption (TLS) and storage encryption, role-based access control based on least privilege, multi-factor authentication for administrative accounts, logging and monitoring, regular backups, segregation of production and test environments, employee training, and contractual obligations for all service providers.

Despite diligent measures, no internet transmission is entirely secure. In the event of a high-risk data breach, we will notify the competent authorities and affected individuals in accordance with Art. 24 FADP and Arts. 33–34 GDPR.

The platform generates AI-driven suggestions (texts, images, budget, and channel recommendations). These suggestions are reviewed and approved by human users; they do not trigger automated individual decision-making producing legal effects or significantly affecting data subjects pursuant to Art. 21 FADP / Art. 22 GDPR.

For payment processing and fraud prevention, our payment service provider may conduct automated risk assessments. If this results in a declined transaction, you may contact us to request a manual review.

Inputs entered into the platform are not used by us to train general third-party AI models. For deployed model providers, we utilize configurations and contractual terms that exclude the use of inputs for model training purposes.

Under the FADP and – where applicable – GDPR, you have the following rights: Access to your personal data processed by us; Rectification of inaccurate data; Erasure or destruction of data; Restriction of processing; Objection to processing based on legitimate interests, particularly direct marketing; Data Portability in a structured, commonly used electronic format; Revocation of granted consent with effect for the future; Lodge a Complaint with a supervisory authority.

To exercise your rights, please contact datenschutz@LumAIa.ch. To prevent abuse, we may verify your identity. We will respond within 30 days; for complex requests, we will notify you of an extension.

Supervisory Authorities: Switzerland – Federal Data Protection and Information Commissioner (FDPIC), Bern, edoeb.admin.ch. EU/EEA – The data protection authority of your place of residence or work.

Server Logs: Visiting our website generates technical log data as specified in Section 4. This is necessary for infrastructure provision and security (legitimate interest).

Contact Forms and Demo Requests: We use your information to process requests and follow up. In a B2B context, where permissible, we may send follow-up information regarding similar products. You can opt out of these communications at any time.

Newsletters: Dispatched via Customer.io. Registrations are confirmed via Double Opt-In. We track open and click rates to optimize content. Every email contains an unsubscribe link.

Social Media: Profiles hosted on networks are governed by the privacy policies of the respective platforms. We process messages, posts, and analytics received on these platforms for communication and reach measurement. Third-party content embedded on our site (e.g., videos, map services) loads only upon your consent.

Applications: Candidate data is processed solely to evaluate suitability for employment. Access is restricted to HR and involved hiring managers.

We may revise this Privacy Policy to reflect changes in our processing practices, integrated services, or applicable law. The current version published on our website shall apply. Registered users will be notified of material changes via email or platform announcements.