Privacy Policy

1. Who is responsible for your data

The data controller is Dmytro Budnikov, a sole proprietor registered in CEIDG (Poland), NIP: 5732972952, REGON: 544766206 (the "we"). Contact for all privacy matters: hello@example.com.

This policy explains what personal data Lumo processes, why, and what rights you have under the EU General Data Protection Regulation (GDPR).

2. What data we process

• Account data: your email address; sign-in events (we use passwordless magic links, so we never store a password).
• Quiz answers: your learning goal and preferences (goal, motivation, level, hours per week, deadline, format, learning language, prior attempts). Free-text answers may contain whatever you choose to write — please do not include sensitive data you don't want processed.
• Learning data: your generated courses, lesson progress, homework submissions (text, code, and optional screenshots you upload), AI grades and feedback.
• Payment metadata: subscription plan and status, dates, and transaction references from our payment partner. We never see or store your card details — payments are handled by Paddle as Merchant of Record, which acts as an independent controller for payment processing.
• Technical data: cookies strictly necessary for the Service (session authentication, language preference, an anonymous quiz identifier); IP address used transiently for rate limiting (stored only as a salted hash) and country-level language detection; API usage records (token counts and costs of AI calls linked to your account — needed for billing integrity and abuse prevention).

We do not run advertising or marketing trackers, and we do not sell personal data.

3. Why we process it (legal bases)

• Performing our contract with you (Art. 6(1)(b) GDPR): account, quiz answers, course generation, homework review, payments, support.
• Legitimate interests (Art. 6(1)(f)): service security, rate limiting and abuse prevention, error diagnostics, cost accounting of AI usage.
• Legal obligations (Art. 6(1)(c)): tax and accounting records related to purchases.
• Consent (Art. 6(1)(a)): only where we ask for it explicitly (e.g. optional marketing emails, if ever introduced). Consent can be withdrawn at any time.

Providing your email address and quiz answers is a contractual requirement: without them we cannot create your account or generate your course. Everything else — for example screenshots attached to homework — is optional; not providing it simply means that feature is not used.

4. AI processing — what you should know

• Course content is generated and homework is reviewed by AI models (Anthropic Claude) acting on our instructions. Your quiz answers and homework submissions (including screenshots) are sent to Anthropic for this purpose as processor-style API traffic. Under Anthropic's commercial API terms, such data is not used to train Anthropic's models.
• Automated homework grading: grades (1–10) are produced automatically by AI. The only effect is your progression inside the course — a failed attempt allows a retry, and after two attempts the lesson is marked "passed with remarks" so you are never blocked. If you disagree with a grade, you can report the lesson or contact us and a human will review it.
• AI-generated content is labelled in the interface, and AI can make mistakes — see the Terms of Service.

5. Recipients of data

Processors — providers acting on our instructions, bound by data-processing agreements:

| Provider | Purpose | Location of processing | |---|---|---| | Supabase | database, authentication, file storage | EU (Frankfurt, Germany) | | Vercel | application hosting and delivery | EU/global edge; US company | | Anthropic | AI generation and homework review | US | | Resend | transactional email (sign-in links, service notices) | US |

Independent controllers — services that process your data under their own privacy policies: Paddle (payments, as Merchant of Record) and Google/YouTube (embedded lesson videos). Lessons embed videos via YouTube's privacy-enhanced player (youtube-nocookie.com); the player loads from Google's servers when you open a lesson page containing a video.

Transfers outside the EEA: transfers to the US (Anthropic, Vercel, Resend, Google) rely on the EU–US Data Privacy Framework and/or Standard Contractual Clauses; transfers to the UK (Paddle) are covered by the European Commission's UK adequacy decision. Data in Supabase is hosted in the EU; any remote access by Supabase (a US company) staff is covered by SCCs in our data-processing agreement. You can request copies of the relevant safeguards at hello@example.com; Data Privacy Framework participation can be verified at dataprivacyframework.gov.

6. How long we keep data

• Account and learning data: for as long as your account exists. Deleting your account removes your profile, quiz answers, courses, homework (including uploaded screenshots), and usage logs linked to you.
• Quiz answers not linked to any account (you tried the free preview but did not register): deleted no later than 12 months after submission.
• Purchase and tax records: as long as required by Polish tax law (generally 5 years).
• Rate-limiting hashes and transient technical logs: short-lived and deleted periodically.

7. Your rights

Under GDPR you can: access your data, get a copy, rectify it, erase it ("right to be forgotten"), restrict or object to processing based on legitimate interests, and receive data you provided in a portable format. Where processing is based on consent, you may withdraw it at any time.

To exercise any right, email hello@example.com. We respond within one month. Account deletion is executed as a full cascade across all our systems.

You also have the right to lodge a complaint with a supervisory authority — in Poland: Prezes Urzędu Ochrony Danych Osobowych (UODO), ul. Stawki 2, 00-193 Warszawa, uodo.gov.pl — or with the authority of your country of residence.

8. Cookies

We use only cookies that are strictly necessary for the Service to work: session authentication (Supabase), your language choice, and an anonymous identifier that links your quiz to your account after you register. We set no analytics, advertising, or third-party marketing cookies — which is why the Service shows no cookie banner.

9. Children

The Service is intended for users aged 16+. We do not knowingly process data of younger children; if you believe a child provided us data, contact us and we will delete it.

10. Security

Data is stored in the EU (Supabase, Frankfurt) with row-level security so each user can only access their own records; uploads live in private storage readable only by their owner; API keys and AI calls exist only server-side; access to production systems is limited to the operator.

11. Changes to this policy

We may update this policy as the Service evolves. Material changes are announced by email or in the Service. The date of the latest revision is shown at the top.