Privacy Policy

1. Who is responsible for your data

Geheim van de Smith B.V., also trading as Lumares, is the controller for the personal data processed through Lumares. You can reach us at hello@lumares.ai or by post at Laanenderweg 33, 1812 PW Alkmaar, the Netherlands.

This policy explains which data we process when you use Lumares, why we do so, how long we keep it and which rights you have under the General Data Protection Regulation (GDPR).

2. What data we process

Depending on how you use Lumares, we process:

• Account data: your name, email address, password (stored encrypted, never in readable form), and — if you sign in with Google — the basic profile data Google shares with us.
• Consent records: the date, time and version of the terms and privacy policy you accepted when registering.
• Boat and equipment data: boat name, type, dimensions, callsign, crew size, engines, systems, tanks, batteries, maintenance history and the manuals, invoices and other documents you upload.
• Logbook and voyage data: trips, waypoints, positions, distances, times, notes, weather observations, photos and any voyages you choose to publish.
• Assistant conversations: the questions you ask Luma, the answers given, ratings and the document extracts used to answer.
• Technical data: IP address, device and browser information, and log data needed for security, error diagnosis and abuse prevention.
• Correspondence: messages you send us by email or through support forms.
• Purchase and subscription data: which plan you bought, the transaction reference, the start and end date of your paid access and the identifier our reseller Paddle uses for you. Card details, billing address and tax data are collected and stored by Paddle as Merchant of Record — we never see or store your card number.

3. Why we process it, and on what legal basis

• To provide the service — creating your account, storing your boat knowledge, answering your questions, keeping your logbook and rendering shared voyages. Basis: performance of the agreement with you.
• To keep Lumares secure and reliable — logging, abuse prevention, backups and troubleshooting. Basis: legitimate interest in a safe and functioning service.
• To improve Lumares — aggregated and, where possible, anonymised usage insights. Basis: legitimate interest; you may object at any time.
• To send service messages — email confirmations, password recovery, important changes to the service or these documents. Basis: performance of the agreement and legal obligation.
• To send optional product updates — only if you have opted in. Basis: your consent, which you can withdraw at any time.
• To sell and administer paid plans — activating your access, keeping track of your paid period, handling cancellations and refund requests together with Paddle, and keeping the records required for invoicing and tax. Basis: performance of the agreement with you and legal obligation.
• To comply with the law and to establish or defend legal claims. Basis: legal obligation and legitimate interest.

4. Special note about documents and AI

Manuals, invoices and photos you upload may contain personal data, such as names or addresses on an invoice. You decide what you upload; please only upload material you are entitled to use.

To make documents searchable we convert them to text and create numerical representations (embeddings). When you ask Luma a question, the relevant extracts and your question are sent to the AI provider that generates the answer.

AI providers act as processors on our behalf and are contractually prohibited from using your data to train their own models. We do not use your content to train models either.

5. Who we share data with

We never sell your data. We only share it with the parties needed to run Lumares, each under a data processing agreement:

• Hosting, database, authentication and file storage providers that operate the platform behind Lumares.
• AI providers that generate the assistant's answers and process documents for search.
• Email providers that deliver account and service emails from our notify.lumares.ai domain.
• Weather, tide and vessel-traffic data providers, which receive only the location or query needed to return the requested information.
• Paddle, our reseller and Merchant of Record, for the sale of paid plans, subscription management, payments, tax compliance and invoicing. Paddle processes your purchase data under its own privacy terms; we receive only the information needed to activate your plan.
• Advisers, auditors or authorities, where we are legally obliged to share data.

6. Transfers outside the European Economic Area

We prefer processing within the EU. Where a provider processes data outside the EEA — for example some AI providers in the United States — we rely on the European Commission's Standard Contractual Clauses or another lawful transfer mechanism, combined with appropriate technical measures.

7. How long we keep your data

• Account, boat, logbook and document data: for as long as you have an account, and deleted within a reasonable period after you ask us to delete your account.
• Consent records: kept for as long as your account exists and for a limited period afterwards, as evidence that consent was given.
• Assistant conversations: until you delete them, or with your account.
• Technical and security logs: normally up to 12 months.
• Purchase, subscription and invoice records: 7 years, as required by Dutch tax law.

8. Security

We use encrypted connections (HTTPS), encryption at rest, row-level access rules so that you can only reach your own data, hashed passwords and access controls limited to those who need it.

No system is completely risk-free. If a data breach occurs that poses a risk to you, we will report it to the Dutch Data Protection Authority and inform you where required by law.

9. Cookies and similar technologies

Lumares uses functional storage that is strictly necessary to run the app: a session cookie and local storage to keep you signed in, plus offline storage so the logbook keeps working without a connection.

We do not use advertising cookies. If we ever add analytics or marketing technology that requires consent, we will ask for your permission first.

10. Your rights

You have the right to access, correct, delete or restrict your data, to object to processing based on legitimate interest, to withdraw consent, and to receive your data in a portable form.

Send your request to hello@lumares.ai. We respond within one month. We may ask for confirmation of your identity to make sure we do not disclose data to the wrong person.

You may also lodge a complaint with the Dutch Data Protection Authority (Autoriteit Persoonsgegevens).

11. Public voyages

You choose whether a voyage or logbook entry is public. Anything you publish — including photos, positions and notes — becomes accessible to anyone with the link and may be indexed by search engines or cached by third parties.

You can make a public voyage private again at any time, but we cannot remove copies that others have already saved or that remain in external caches.

12. Children

Lumares is not intended for children under 16. If you believe a child has provided us with personal data, contact us and we will delete it.

13. Changes to this policy

We may update this policy, for example when we add features or change providers. The current version, with its version number and date, is always available at lumares.ai/privacy. We will inform you of material changes by email or in the app.