Privacy Policy

Controller: Digital Ventures Partners (DVP), a French société par actions simplifiée (SAS) with its registered office at 122 rue Amelot, 75011 Paris, France, registered with the Paris Trade and Companies Register under number 951 762 228 (RCS Paris 951 762 228). DVP is the data controller for the personal data described in this policy.

Contact: support@dvp.digital

Website: https://golumi.co

If you are in the EEA or the UK and have questions or want to exercise your rights, you can contact us at the email above.

2.1 Account and identity data

• Email address (required to create and log in to your account).
• Display name and avatar choice (optional).
• Country / language preference (used to localise content and currency).

2.2 Voice and content data

• Audio recordings of your speaking exercises.
• Transcripts generated from those recordings.
• Text you type into the Service (e.g., notes, prompts, journal entries).
• Speech metrics calculated from your audio: pronunciation, fluency, pace, energy, confidence, and similar scores.

2.3 Usage and progress data

• Exercises completed, badges earned, milestones, streaks, XP and level.
• How you interact with the app (screens visited, buttons tapped, time spent).
• Device and technical information: device model, OS, app version, language, time zone, crash and error logs, IP address.

2.4 Payment data

• If you purchase through the Apple App Store, Apple manages payment; we receive purchase status (active, expired, refunded) and product identifiers via RevenueCat.
• If you purchase on our website, our payment processor processes your payment; we receive transaction status, partial card details (last 4 digits, brand), country, and invoice metadata. We do not store full card numbers.

2.5 Marketing and analytics data

• How you reached us (referral URL, campaign IDs, UTM parameters).
• If you arrived from a Meta ad, Meta-related identifiers (for example, click identifiers) that help us measure ad performance.
• Email engagement (open/click data) for transactional and marketing emails.
• In-app usage data to improve our services.

We use your data to:

• Provide the Service: create your account, run speaking exercises, generate transcripts, scores, and coaching tips.
• Personalise your experience: recommend exercises, track progress, award badges, surface the right content.
• Operate subscriptions and billing: confirm purchases, manage renewals, prevent fraud and abuse.
• Communicate with you: send transactional emails (welcome, password reset, receipts, important updates) and, with your consent, marketing emails about new features.
• Improve the Service: understand which features work, fix bugs, prioritise the roadmap, evaluate AI quality.
• Protect the Service: detect security incidents, prevent abuse, enforce our Terms.
• Comply with legal obligations (accounting, tax, responding to lawful requests).

AI training. We do not use your raw voice recordings or transcripts to train generally available AI models without your separate, explicit opt-in consent. We may use aggregated or de-identified information to evaluate and improve the Service.

If you are in the EEA or the UK, we rely on the following legal bases under the General Data Protection Regulation:

• Performance of a contract: to provide the Service you signed up for (account, exercises, scores, subscriptions).
• Legitimate interests: to keep the Service secure, prevent abuse, measure product performance, and improve features. We balance these interests against your rights and freedoms.
• Consent: for non-essential cookies, marketing emails, optional analytics, and any future opt-in AI training programmes. You can withdraw consent at any time.
• Legal obligation: to comply with applicable accounting, tax, and law-enforcement obligations.

We share personal data only with providers and partners who need it to run the Service. Our current sub-processors and integrations include:

• Supabase (hosting, authentication, database, edge functions).
• Microsoft Azure Speech Services (speech-to-text, pronunciation and prosody scoring).
• OpenAI (GPT-4o / GPT-4o-mini for coaching analysis and conversational features).
• ElevenLabs (text-to-speech and conversational AI agents).
• Resend (transactional and authentication emails).
• Stripe (payments for web purchases).
• RevenueCat and Apple (entitlement and in-app purchase management for iOS).
• Cloudflare R2 (video and asset storage).
• Meta (Facebook/Instagram) tools for advertising, measurement, and remarketing on our web marketing.
• Natively / BuildNatively (iOS WebView wrapper used to deliver the app on the App Store).

We may also share data with professional advisers (lawyers, accountants), with authorities where required by law, and, in case of a corporate transaction, with a buyer or successor, subject to confidentiality safeguards.

We do not sell your personal data.

Some of our providers are based outside the EEA/UK (notably in the United States). When we transfer personal data outside the EEA/UK, we rely on appropriate safeguards such as the European Commission's Standard Contractual Clauses or the EU-US Data Privacy Framework, where applicable. You can request more information about these safeguards by contacting us.

• Account data: while your account is active, plus a limited retention period after deletion for fraud prevention and legal purposes.
• Voice recordings and transcripts: kept as long as needed to provide the Service and show you your progress. You can delete individual recordings from the app. When you delete your account, we delete your recordings within a reasonable period.
• Usage and analytics data: typically kept in aggregated or pseudonymised form.
• Billing data: kept for the period required by accounting and tax law (typically up to 10 years in France).
• Marketing data: kept until you withdraw consent or unsubscribe, plus a short suppression list to make sure we don't email you again.

Depending on where you live, you have some or all of the following rights:

• Access: ask for a copy of the personal data we hold about you.
• Rectification: ask us to correct inaccurate or incomplete data.
• Deletion: ask us to delete your data (the "right to be forgotten").
• Restriction: ask us to restrict the processing of your data.
• Portability: ask for your data in a portable format.
• Objection: object to processing based on our legitimate interests, including profiling.
• Withdraw consent: withdraw consent where processing is based on it.
• Complain: lodge a complaint with a supervisory authority. In France this is the CNIL — https://www.cnil.fr.

You can exercise your rights by emailing support@dvp.digital. We will respond within the timeframe required by law (one month under the GDPR, extendable in complex cases).

You can delete your Lumi account at any time:

• From the app: open Settings → Account → Delete account.
• By email: send a deletion request to support@dvp.digital from the email linked to your account.

Deleting your account terminates your active subscription on our side. For App Store subscriptions, you must also turn off auto-renewal in your Apple ID settings. After deletion, we permanently remove or anonymise your personal data, except where we are required to keep some records (for example, invoices for tax purposes).

We take reasonable technical and organisational measures to protect your data, including:

• Encryption in transit (HTTPS) for all communications with our servers.
• Encryption at rest for our database and stored audio.
• Row-level security policies that limit access to each user's own data.
• Access controls and least-privilege principles for our team and providers.
• Server-side handling of all AI provider API keys (never embedded in the app).

No system is perfectly secure. If you suspect a security issue, please contact us at support@dvp.digital.

Our website currently uses only strictly necessary cookies and similar technologies required to operate the site and remember essential preferences (for example, keeping you signed in). These are always on because the site cannot function without them.

We do not currently set non-essential analytics or advertising cookies on our website, and no third-party marketing pixel is loaded without your consent. If we introduce non-essential cookies in the future, we will ask for your consent through a cookie banner before setting them and give you a way to change your choices.

The mobile app does not use third-party advertising SDKs and does not track you across other companies' apps or websites.

Lumi is not directed to children under 16, and we do not knowingly collect personal data from them. If you believe a child has provided us with personal data, contact us and we will delete it.

We use automated systems to score your speech, recommend exercises, and personalise your Journey. These decisions are not legal or similarly significant decisions about you within the meaning of the GDPR. You can request human review of any AI output you believe is incorrect by emailing us.

We may update this Privacy Policy from time to time. When we make material changes, we will notify you in advance through the app, by email, or on our website. The "Last updated" date at the top tells you when the current version took effect.

Email: support@dvp.digital