Lumi is built for children ages 3–10 and is set up and supervised by a parent or legal guardian. We practise data minimisation: we collect only what is needed to personalise conversations and run the service, we do not sell personal data, we do not show advertising to children, and we do not use children's data for behavioural tracking, profiling, or targeted advertising.
| Category | Examples | Why |
|---|---|---|
| Parent account | Name, email, and account identifier from your Google sign-in (via Clerk); your plan/trial status | To create and secure your account and manage access |
| Child profile | First name (or nickname), age, class/grade, language comfort, personality traits, interests, goals, favourite character | To personalise how Lumi talks to your child |
| Activity & progress | XP, level, badges, and words introduced (vocabulary) | To power the gamification and Growth features |
| Conversation transcripts | The text of chats between your child and Lumi | So you can review them in Parent Corner and so Lumi has conversation context |
| Payment reference | The UPI transaction reference you submit (not your bank/card details) | To verify your payment and activate access |
| On-device data | Your active-child selection and daily-usage counter, stored in your browser's localStorage | Convenience and the on-device daily-limit control; not sent to our servers |
| Technical logs | Standard server logs (e.g. request metadata) from our hosting provider | Security, debugging, and reliability |
Speech-to-text (understanding what your child says) runs in your device's browser using the browser's built-in speech features. We do not receive or store audio recordings of your child's voice. The resulting text of what your child said is sent to our server to generate Lumi's reply and to save the transcript for you. To speak that reply aloud, the reply text (not your child's voice) is sent to our text-to-speech provider (Google Cloud), which returns generated audio of Lumi's voice for playback — this process never involves any recording of your child.
We process personal data to provide, personalise, secure, and improve Lumi, to process payments and manage access, and to comply with law. Our legal basis is your consent (including consent you give as a parent on your child's behalf) and, where applicable, the necessity of processing to provide the service you have requested. You can withdraw consent at any time (Section 9); withdrawal does not affect processing already carried out.
We do not sell your data. We share it only with service providers who help us run Lumi, under contractual confidentiality and security obligations:
| Provider | Purpose | Note |
|---|---|---|
| Anthropic | AI that generates and safety-checks Lumi's replies | Receives conversation text; may process outside India |
| Google Cloud (Text-to-Speech) | Converts Lumi's reply text into spoken audio | Receives reply text only, not your child's voice; may process outside India |
| Clerk | Sign-in and account security | Handles Google authentication |
| Neon (PostgreSQL) | Database storage of profiles and transcripts | Stores your account data |
| Vercel | Application hosting | Serves the app and API |
| Google Analytics (GA4) | Aggregate visit & traffic measurement | Marketing pages and blog only; IP anonymised |
Our public marketing pages and blog use Google Analytics 4, with IP anonymisation enabled, to
measure visits and understand how people find Lumi. The Lumi app itself (everything under
/app) contains no analytics or advertising trackers of any kind, and no analytics
data is ever collected about children.
We may also disclose data where required by law, to protect the safety of a child or any person, or to enforce our Terms.
Some providers above may process data outside India (for example, in the United States). Where we transfer personal data internationally, we do so in accordance with applicable law and take reasonable steps to ensure it remains protected.
Subject to applicable law (including India's Digital Personal Data Protection Act, 2023), you may:
We keep personal data only as long as needed to provide Lumi or as required by law. Conversation transcripts and profiles are retained until you delete them or delete the account. When you delete a child, their profile and transcripts are removed from our active database; deletion of a child also cascades to their sessions. We aim to complete deletion requests within the timelines required by applicable law, subject to limited retention where the law requires it (e.g. records of a transaction).
We use reasonable technical and organisational measures to protect personal data, including transport encryption (HTTPS), authenticated and access-scoped APIs (each parent can access only their own account's data), server-side handling of AI keys, and an automated safety check on AI replies. No method of transmission or storage is perfectly secure, but we work to protect your information and will notify affected users and authorities of a personal-data breach as required by law.
Lumi is aimed at families in India and elsewhere. If you use Lumi from the United States, note that we rely on verifiable parental consent for any collection of information relating to a child under 13, consistent with the Children's Online Privacy Protection Act (COPPA). A parent may review or delete their child's information and refuse further collection at any time by contacting us or using Parent Corner.
We may update this Policy as Lumi changes. We will update the "Effective date" above and, for material changes, aim to provide notice. Continued use after changes take effect means you accept the updated Policy.