DRAFT FOR COUNSEL REVIEW - not legal advice - counsel review is planned after launch
Lumioh Cloud Privacy Policy (draft)
Draft 0.2, updated 14 October 2026.
This policy explains what personal information Lumioh Cloud collects, why, who sees it, where it is held, how long it is kept and how to have it deleted. We handle personal information in line with the Privacy Act 1988 (Cth), the Australian Privacy Principles and the Notifiable Data Breaches scheme, whether or not the law strictly requires it of us. Where the product does not yet do something a reader might assume, this policy says so.
1. Who we are and what this policy covers
[COMPANY LEGAL NAME], ABN [ABN], of [REGISTERED ADDRESS] ("Lumioh", "we", "us") runs Lumioh Cloud, an optional online service at https://app.lumioh.com. It gives agencies and site owners a central view of the health and search performance of their WordPress sites. It works with a Lumioh plugin on each WordPress site: the Lumioh Cloud Connector companion plugin or, when released, the optional Lumioh Cloud module of the Lumioh SEO plugin (off until you switch it on). You install and approve the connection on each site. The Lumioh SEO plugin works without Lumioh Cloud and is not changed by it. If you never connect a site, none of the site data in this policy reaches us.
This policy covers Lumioh Cloud's web application, its background services and the e-mail it sends. It does not cover your WordPress site, your own website, the Lumioh marketing website at lumioh.com, or the services of other companies you use (Google, your e-mail provider).
2. Our two roles
- Account, billing, security and product-operation data. We decide why and how this is used. It is the e-mail addresses, sign-in records, billing records, product analytics and logs described below. For this data we are the responsible organisation (the "controller" in privacy law terms).
- Customer site data. This is the information about a customer's sites and clients that an agency or site owner (the "customer") puts into Lumioh Cloud. The customer decides what to connect and why, and we handle it on the customer's behalf under our data processing agreement. If you are a client or colleague of an agency using Lumioh Cloud, the agency is your first contact for questions about its use of your data. You can also write to us (section 16).
3. What we collect
3.1 When you create an account and use the product
| What | Detail |
|---|---|
| Sign-in details | Your e-mail address and a password. Passwords are handled by our sign-in provider and stored only as a one-way hash; we cannot read them. We do not ask for your personal name. Social sign-in is not offered |
| Workspace details | Whether the workspace is for an individual or an organisation or agency, its name, its members and their roles (Owner, Admin, SEO Manager, Technician, Reporter, Client Viewer), and the invitations sent (including the invitee's e-mail address) |
| What you accepted | Which version of the Terms of Service and Privacy Policy you accepted and when. We do not record your IP address or browser for this |
| Preferences | Alert opt-outs, whether you want the daily digest, and notification mute windows (a reason of up to 200 characters, free text, if a manager enters one) |
| Sessions | A sign-in session cookie and the sign-in records kept by our sign-in provider, including IP addresses in its audit entries |
| Bot check | When you sign up, sign in or reset a password, a Cloudflare Turnstile check runs. Cloudflare receives your IP address and browser signals; our sign-in provider verifies the result |
| Your actions | A workspace audit log of sensitive actions (who, what, when, on which item and a request number), kept to protect the workspace. It avoids secrets and unnecessary personal data |
| Messages to us | Anything you send to our support address or privacy contact (section 16) |
3.2 Billing and trial
| What | Detail |
|---|---|
| Trial | Each person may claim one 90-day trial, once. We record who claimed it, for which workspace, and when. No payment card is needed to start |
| Trial marker | If a trial claim is erased (with a workspace or an account), we keep a salted one-way hash of your verified e-mail address for 24 months, with a date, so that a second free trial can be refused. It holds no name, no workspace and no readable e-mail address. A different address, or waiting 24 months, avoids it |
| Payments | Paid plans are billed in Australian dollars through Stripe. You enter payment details directly at Stripe; Lumioh Cloud does not store card numbers. We keep Stripe customer, subscription and price identifiers, subscription state, and a copy of Stripe's records in our database. Invoices show GST where it applies |
3.3 Customer site data
This data reaches us only after a site administrator approves it for a connected site. The connector asks for each permission ("scope") separately, shows what it sends, and lets you revoke at any time. Scopes you do not approve are not sent.
| What | Detail |
|---|---|
| Site identity and health | Site name and address, plugin, WordPress and PHP versions, connection health ("heartbeats"), and the connector's declared abilities. Requested by default (the site_status scope) |
| Audit findings | Current findings from the Lumioh SEO audit (what check, how severe, status, a reference to the affected item and plugin-supplied description fields). Requested by default (the audit_findings scope) |
| Optional summaries (separate consent each) | A summary of which Lumioh SEO features are switched on (17 on/off flags and a fingerprint, no option values), summaries of SEO changes made on the site (allowlisted metadata, settings and migration events, not old or new values), summaries of audit activity, redirect summaries, and link-graph summaries |
| Crawl results | Our crawler visits pages of your connected site, identified as LumiohCloudCrawler, and records for each page the address, HTTP status, redirect path, canonical address, content type, title, meta description, robots directives, hreflang links and structured-data types. See section 4 for what is not kept |
| Search Console data | If you connect Google Search Console: daily clicks and impressions for your properties, and for connected sites the top 50 pages or search queries per date. Page addresses and search query text can contain personal data |
| Clients and client viewers | Client names and the Client Viewer accounts an agency creates for its clients (e-mail address and the sites each can see) |
| Reports and branding | Reports generated from the data above (on screen, print, or PDF) and, for agencies, a brand kit: a display name, a free-text contact line (which may hold an e-mail address or phone number), two colours and a logo image (PNG or JPEG, up to 256 KiB) |
| Alerts | Alert rules, alert history, and delivery details (see section 10) |
| Secrets | The credential created when a site is connected, and the refresh token for Google, are stored encrypted. They are never shown again and never logged |
Lumioh's use and transfer of information received from Google APIs adheres to the Google API Services User Data Policy, including its Limited Use requirements. We use Search Console data only to show it to the workspace that connected it. We do not use it for advertising, do not sell it, and do not let people read it other than as this policy describes.
3.4 Logs and technical data
Our servers write logs. Our own application logs refer to requests, jobs and, for web requests, the acting account, workspace, site and connection by random identifiers (UUIDs), not by name, e-mail address, URL, token or content. The one place a log line can carry a page path is the browser's security-policy violation report, whose path can contain a site identifier. Our providers keep their own platform logs, which can contain request lines and sign-in e-mail addresses (see sections 10 and 12).
3.5 Product analytics
We use PostHog to see how Lumioh Cloud is used: which pages and features are used, and where people stop during sign-up and setup. We use this to fix problems and decide what to build. Each analytics event carries a random user identifier, a random workspace identifier, the plan, the event name (for example "site connected"), counts (such as the number of sites) and the page route. The user identifier is linked to your account, so we treat it as personal information, not as anonymous. The limits that apply to it are in section 4.
4. What we do not do
- We do not keep the HTML of your pages. The crawler reads each page in temporary memory, takes the fields listed above and discards the rest. It also reads
robots.txt, keeps only a small set of normalised rules, and discards the file. If a future support feature ever needed to capture page content, it would be off by default, need your consent and be deleted within 24 hours. No such feature exists. - We do not receive your post or page text, your database, your passwords or arbitrary WordPress options from the connector.
- We do not store card numbers. Stripe does.
- We do not sell personal information, show advertising, or use your customer site data to train AI models. Lumioh Cloud does not send customer data to an AI provider.
- We do not send your e-mail address, personal name, the addresses or content of customer sites, tokens, or the data in your reports to PostHog. Analytics uses random identifiers. We do not record sessions or screens, and we ask PostHog not to store IP addresses.
- We do not change your WordPress site on our own. The optional write feature is off by default, is not available in the beta, and is controlled on your site (Terms of Service, section 11).
5. Why we use it
- To run the service you asked for: show your portfolio, run crawls, ingest Search Console data, raise alerts and build reports.
- To secure the service: sign-in, bot checks, rate limits, an audit log and investigation of misuse.
- To manage trials, plans and billing, and to refuse a second free trial.
- To send service messages: invitations, sign-in and password e-mails, critical alert e-mails, the daily digest if you opt in, and notices about account deletion and ownership transfers. Trial, cancellation and payment notices are sent to the billing Owner.
- To answer support requests and handle privacy requests.
- To understand and improve the product (section 3.5) and to plan capacity and cost, using internal counters (requests, bytes, durations) with no URLs or personal information.
- To meet our legal obligations, including tax records and breach notification.
6. Who sees your data
- Other people in your workspace, according to their role. A Client Viewer sees only the clients and sites assigned to them. Other workspaces cannot see yours.
- Our service providers (subprocessors), listed in subprocessors-draft.md: Supabase (database, sign-in, file storage), Google Cloud (servers, encryption keys), Resend (e-mail), Stripe (payments), Cloudflare (bot check and DNS) and PostHog (product analytics). Google is also the source of your Search Console data, when you connect it.
- Our operators. A small number of authorised people can review privacy requests on an operations page and can look at the platform to keep it running and to give support. They cannot confirm a deletion for you.
- Authorities and advisers, where the law requires or to protect rights.
- A buyer, if the business is sold. We would tell you first, and the buyer would have to honour this policy.
7. Where your data is held
Our database, sign-in records and file storage are held by Supabase in Sydney, Australia. Our servers, encryption keys and secrets are on Google Cloud in Sydney. Our other providers handle limited data outside Australia: Resend (e-mail address and message text), Stripe (billing contact and payment data), Cloudflare (IP address and browser signals at sign-in) and PostHog (product analytics events). The regions are in the subprocessor list. Before we disclose personal information overseas we take reasonable steps to make sure the recipient protects it in line with the Australian Privacy Principles, mainly through the recipient's data processing terms. We make no promise of regional hosting beyond this section.
8. Cookies, browser storage and analytics
| What | Purpose | Lifetime |
|---|---|---|
| Sign-in session cookies | Keep you signed in. Set by our sign-in provider through our web application. Secure and SameSite=Lax in production | Until you sign out or the session expires |
lumioh_gsc_oauth_state cookie | Protects the Google connection flow against forgery. Set only when you start connecting Search Console, and not readable by scripts | 10 minutes |
lumioh-cloud-theme (browser local storage) | Remembers your light or dark choice. It never leaves your device | Until you clear it |
| Turnstile reload flag (browser session storage) | Avoids a loop if the bot check needs a reload | Until you close the tab |
| Cloudflare Turnstile | The bot check on the sign-up, sign-in and password-reset pages loads a script and frame from Cloudflare, which may store a small token in your browser | Cloudflare's own |
We do not use advertising cookies or third-party tracking pixels. Product analytics (section 3.5) is collected without an analytics cookie or local storage entry in your browser, so it does not need a cookie banner; if that changes, we will ask for your choice first and update this table.
9. Security and data breaches
We use: tenant isolation in the database so one workspace cannot read another's data; encryption of site credentials and Google tokens at rest (AES-256-GCM with workspace-specific context, and Google Cloud KMS for the keys in the hosted service); private file storage; a content-security policy and frame protection in the web application; rate limits and the bot check on public forms; signed requests between your site and Lumioh Cloud; and an audit log. The full list is in the DPA draft, Annex 2. No system is perfectly secure.
If we suspect a data breach, we start an assessment straight away and finish a first assessment within 72 hours of becoming aware. If a breach is likely to cause serious harm, we notify the affected customers and the Office of the Australian Information Commissioner as soon as practicable, and never later than 30 days after we became aware. To report a suspected security problem or data exposure, see section 16.
10. How long we keep things (retention and deletion schedule)
Periods marked "policy" are decided but not yet enforced by an automatic clean-up. Until that clean-up runs, that data is kept until the site or workspace is erased (section 12). Counsel has not yet confirmed these periods.
| Data | How long | Note |
|---|---|---|
| Account and workspace records | While the account or workspace exists | Removed by erasure (section 12) |
| Record of the terms you accepted | While your account exists | Removed with the account |
| Locked workspace after the 30-day export window | Up to 12 months after the window ends, then deleted after 30 days' notice to the Owner | Section 13. Done by us, not yet by an automatic job |
| Support messages | 24 months after the last message | |
| Product analytics events (PostHog) | 13 months | We delete the person's events when an account or workspace is erased once that is built (section 12) |
| Search Console daily figures | 36 months (Foundation) or 60 months (Pro and Agency), from first collection | Page and query rows: 120 days |
| Plugin events (change history) | 36 months, or 60 months for Pro and Agency, from receipt | Cleaned up automatically |
| Crawl results and audit findings | Policy: 36 months, or 60 months for Pro and Agency | |
| Site snapshots | Policy: 36 or 60 months; the latest snapshot per site is kept | |
| Heartbeat detail | Policy: 90 days | The latest state is kept |
| Plugin event batch receipts | Policy: 30 days after the last batch | |
| Report PDFs | Removed within about 24 hours of being made | You can generate again |
| Agency logo | Until you replace or remove it, or the workspace is erased | |
| Alert delivery details, and finished alert queue rows | 90 days | Payload-free |
| E-mail delivery status records | 90 days | An address that hard-bounced or complained stays blocked, as a salted hash with no readable address, until the account that owns it is erased |
| Account-deletion and ownership-transfer notices | Unsent: 21 days. Finished: 90 days | The completed-deletion notice keeps one copy of your address for at most 21 days, so we can send it after your account is gone |
| Pairing codes | Valid 10 minutes; the record is deleted 24 hours after use or expiry | |
| Command receipts (if the optional write feature is ever used) | Linking details 24 months; sensitive result data removed after acknowledgement and no later than 30 days if unresolved | |
| Ownership-transfer records | 24 months after they are resolved | |
| Deletion tombstones (a record that an erasure happened), account-deletion request records, and released legal holds | 24 months, longer under a legal hold | A tombstone holds a request number, an opaque workspace reference and timestamps; no names or addresses |
| Audit records that name an erased site or client | The identifiers are removed 24 months after the audit row was written; the row itself stays | Other audit rows stay while the workspace exists |
| Trial marker | 24 months | Section 3.2 |
| Application logs | 30 days | Provider platform logs: the provider's own period |
| Backups | Database backups and point-in-time recovery are not switched on at launch. When they are, the plan keeps them for [BACKUP RETENTION] | Section 12 |
| Stripe and tax records | As the law requires, generally five years | Held by Stripe and by us |
| Revoked credentials | Deleted at once; a non-secret reference stays in the audit log |
11. Your choices and rights
You can ask to see, correct or delete personal information we hold about you, and to object to how we use it, by writing to us (section 16). We will respond within 30 days. We may need to confirm who you are first. We do not charge for a reasonable request. If your data is customer site data held for an agency, we may refer you to the agency.
What you can do yourself:
- Export. An active Owner or Admin can download a machine-readable (JSON) export of one site or of the whole workspace: sites, clients, members' roles, invitations, consent records, findings, crawl alert records, billing summaries, deletion-request history and relevant audit information. The export excludes connector credentials, raw site event payloads, raw payment-provider messages and account e-mail addresses. Exports are available while the workspace has paid or trial access and for 30 days after it ends.
- Disconnect a site or revoke a scope at any time. This stops data flowing. The data already received stays until you delete it.
- Disconnect Google Search Console. We delete the stored Google token and stop reading; you choose whether to delete the stored figures too.
- Turn off the daily digest and set your alert preferences.
- Delete a site, a client, a workspace or your account (section 12).
- Complain. Write to us (section 16). If you are not satisfied you may contact the Office of the Australian Information Commissioner (oaic.gov.au). If you are in the European Economic Area or the United Kingdom you may also contact your local data protection authority.
12. Deleting data: what is removed, and what is not
We do not claim that deletion removes every trace. This table is the honest position.
| You ask to delete | What we remove | What can remain |
|---|---|---|
| A site (an Owner or Admin confirms) | The site and what hangs off it: connector credential, snapshots, heartbeats, events, findings, crawl results, Search Console figures and mappings, alerts, commands, assignments | A minimal record (request number, workspace reference, timestamps) for 24 months; audit-log rows naming the site, with identifiers removed after 24 months; a report PDF for up to about 24 hours; Search Console property names that include the site's domain; logs; backups |
| A client (the Owner confirms by typing its name) | The client, its viewer grants and every site assigned to it (as above) | The same as a site, plus member accounts |
| A workspace (the Owner asks, an operator reviews and approves, the Owner confirms by typing its name) | Everything keyed to the workspace: members and invitations, clients, sites and their data, billing mirrors, the trial claim, saved report templates, the brand kit and logo files, the workspace audit log, Google tokens (revoked at Google first, as far as Google allows) | A minimal workspace record for 24 months; the trial marker; any legal-hold record; user accounts (separate); Stripe, Google and e-mail copies; logs; backups; exports you downloaded |
| Your account | Your sign-in record (e-mail, sessions, passwords, MFA), your memberships and what hangs off them (assignments, alert opt-outs, digest preference), invitations to you, pairing codes you made, Google tokens you connected (revoked first, as far as Google allows); your identity is cleared or replaced by a random one-way reference in history rows and the audit log | The workspaces, sites and other members' data; a completed request record and the trial marker for 24 months; Stripe and e-mail copies; sign-in provider audit entries; analytics events (random identifiers, up to 13 months, until deletion through PostHog is built); logs; backups |
How an account deletion works: you ask in Settings, Privacy, confirm by typing your exact e-mail address right after signing in again, then there is a seven-day cooling-off period during which you can cancel. It is refused while you are the only Owner of any workspace (you must transfer ownership or delete the workspace first). Other Owners are told when a co-owner is erased. A legal hold on a workspace you belong to can postpone it. The sign-in record is deleted last. Account deletion is irreversible. We aim to finish a confirmed erasure within 30 days; the product shows its state while it runs. If you cannot use the page, write to us (section 16).
Backups and logs. Erasure does not purge backups or logs. If backups are switched on and we restore one, erased data could come back; we would then re-run the erasures. Logs and backups are kept for the periods in section 10.
Other places. We cannot reach your WordPress site (the connector is not uninstalled by deletion), files you exported, or the copies held by Stripe, Google, Resend and PostHog under their own rules. Cloud never deletes the Stripe customer record on its own.
13. Trial end, cancellation and non-payment
When a trial ends without payment, or a paid plan ends, we stop paid work (new crawls, Search Console reading, plugin sync, alert e-mails) and the workspace becomes read-only for 30 days, during which you can read and export your data and make a privacy request. Billing recovery is separate. After the 30 days you can no longer read or export in the product, apart from the Owner's privacy and deletion tools.
We keep a locked workspace for up to 12 months after the 30 days end. Before deleting it, we e-mail the Owner at least 30 days ahead, and you can ask us to delete it sooner or restore access by paying. When the 12 months are up we intend to delete the workspace's data as section 12 describes. The product does not do this automatically yet, so it is done by us. The Lumioh SEO plugin keeps working locally whatever the Cloud state.
14. Children
Lumioh Cloud is a business tool and is not directed at people under 18.
15. Changes to this policy
We will post changes at https://app.lumioh.com/legal/privacy, and e-mail workspace Owners at least 30 days before a material change takes effect.
16. Contact and complaints
[COMPANY LEGAL NAME], [REGISTERED ADDRESS].
- Privacy requests and complaints: [PRIVACY CONTACT E-MAIL]. Our privacy officer is [PRIVACY OFFICER NAME].
- Support and general contact: support@lumioh.com. We answer on business days, Monday to Friday in Australian Eastern time, normally within one business day.
- Suspected security problem or data exposure: write to support@lumioh.com with SECURITY in the subject. We aim to acknowledge it within one hour, on any day of the week.
Facts to verify with counsel
- Whether the Privacy Act 1988 and the Australian Privacy Principles apply to the operator (the small business exemption) and whether adopting them voluntarily, as the opening paragraph does, is what the owner wants (README question 2).
- Whether GDPR or UK GDPR apply because agency customers or their clients are in the EEA or UK, and what legal-basis wording is needed (README question 3).
- The roles statement in section 2 (README question 1), especially for Client Viewer accounts created by agencies.
- The retention periods in section 10, all provisional: 24 months for tombstones, trial marker, support messages and audit-row identifiers; 30 days for logs; 13 months for analytics; 12 months for a locked workspace; 36 and 60 months for site evidence; 90 days, 30 days and 24 hours for the operational records; and the "policy, not enforced" notes.
- The wording of section 12. Doc 32 states that no complete-erasure claim may be made until its remediation list is closed or accepted by the owner and privacy counsel. Is the table acceptable, and may site and client tombstones go with an erased workspace (Q70)?
- Disclosure of the trial marker (a hash of the e-mail address), of Turnstile and of the one address copy that the erasure-completed notice keeps for up to 21 days (Q109).
- Whether the cross-border wording in section 7 meets APP 8 and where Resend, Stripe, Cloudflare and PostHog process data.
- Whether the Limited Use sentence in section 3.3 is enough for Google's API Services User Data Policy (README question 10).
- Whether legal holds can be described as in section 12 without disclosing a hold.
- Whether "we do not use customer site data to train AI models" is a statement the business wants to make as a promise.
- Whether the breach statement in section 9 (72-hour assessment, 30-day outer limit) is the right promise, and whether a 72-hour notice to customers is needed if GDPR applies.
- Whether the analytics statement in section 8 (no analytics cookie, no banner) matches how PostHog is finally implemented, and whether PostHog's region requires more disclosure.
Facts this draft assumes that the code may not yet implement
- PostHog. Not in the product code. Every statement in sections 3.5, 4 and 8 about what is sent, the missing cookie, the absent session recording, discarded IP addresses and the 13-month period is a commitment the implementation must meet before analytics is switched on (doc 35: server-side capture, a PostHog project setting for IP discard and for retention, and deletion of a person's events when an account or workspace is erased, which is part of E5 and not built). The region is the owner's choice (doc 35 recommends the EU region, Frankfurt).
- Account deletion is built (ADR-088, ADR-096: worker, web page, notices to the account and to co-owners) and tested locally with synthetic data. It is not enabled on a hosted environment: the Terraform gates and the hosted enable review (doc 34 E7) are open. The 30-day completion aim and the seven-day, 10-minute and 24-hour windows are provisional.
- Workspace and client erasure in hosted use waits for the same gates. Provider-side deletion at Stripe, Google and Resend (E5) is not done.
- Retention jobs. The maintenance job enforces plugin events (36 or 60 months), terminal alert queue rows (90 days), pairing codes (24 hours), tombstones, ownership-transfer records, trial markers and audit-row identifiers (24 months), and command payloads (30 days). The notice, delivery-record and Search Console jobs run in the workers. It is built and tested locally; the job and its migration (
20261019100000) are not deployed to hosted. Snapshots, heartbeat detail, event batch receipts, crawl results and findings have no job yet, and no job deletes a locked workspace after 12 months. - Support messages and analytics periods are recommended defaults, not decisions in the decision log.
- Logs and backups. Hosted logging and its 30-day retention are not provisioned (R4). Backups are deferred by the owner until 10 paying users (C1); no restore has been rehearsed on the hosted project, and after a restore the expedited re-erasure (Q71) is a decision, not built.
- Google token revocation is built (Q58) but not verified against Google's real responses or the hosted key permissions.
- Export window. Export links are hidden after the 30-day window; the Owner's privacy-request exception is kept. A copy of data after the window is not a self-service path.
- Lifecycle notices. E-mails about trial end, cancellation or payment failure, and the notice before a locked workspace is deleted, are not built.
- Payments. No checkout or billing portal exists. Test mode only.
- Public API and webhooks. Not available; keys, webhook destinations and delivery logs would become personal-data holdings to add here.
- Alert e-mail from hosted. No real hosted delivery has been accepted yet.