Privacy Policy

1. Introduction

LUMJHAAI (“we,” “our,” or “us”) operates a no-code AI agent platform that enables businesses to build, deploy, and manage intelligent conversational agents trained on their own data. Our platform includes the Engage (chatbot), Discover (site search), and Comply (policy vault) modules, along with integrations to messaging platforms including Facebook Messenger, WhatsApp Business, Instagram, Telegram, TikTok, and Viber.

This Privacy Policy explains what personal information we collect, how we use and protect it, and the rights you have over it. It applies to our website, dashboard, APIs, widgets, and all other services we provide (collectively, the “Service”). By using the Service you agree to the practices described here.

2. Who Controls Your Data

LUMJHAAI is the data controller for the account registration and platform-usage information described in this policy. For Customer Data (the content and documents you upload to power your agents), you are the data controllerand we act only as a data processor on your behalf. See Section 5 for full details.

3. Information We Collect

3.1 Account & Identity Information

• Name, email address, and password (hashed with bcrypt) when you register.
• Organization name and role when you create or join a workspace.
• Team member details (name, email, role) when you invite collaborators.

3.2 Customer Data (Content You Upload)

• Documents, PDFs, Word files, CSVs, JSON, and plain text uploaded to the knowledge base.
• Website content crawled from URLs you provide (via sitemap or robots.txt discovery).
• Policy documents stored in the Comply module.
• Product catalog data from connected Shopify stores.
• Calendar event data from connected Google Calendar accounts.
• Any other material submitted through the platform’s data-source integrations.

3.3 Conversation & Messaging Data

• Messages and chat sessions processed through your agents (text, images, audio, video, documents).
• End-user metadata received from connected channels: external user IDs, display names, profile images, and platform identifiers.
• Lead information collected through your lead forms (name, email, phone, and any custom questionnaire responses).
• Appointment requests and confirmations processed via Google Calendar.

3.4 Usage & Analytics Data

• Dashboard interactions, feature usage, pages visited, and session durations.
• Agent performance metrics: message volumes, conversation counts, token usage, lead conversions, and widget impressions.
• Search queries and analytics submitted through Discover widgets.
• Error logs, API response times, and diagnostic telemetry.
• API key usage and developer integration activity.

3.5 Billing & Payment Information

• Subscription plan, billing period, and usage-limit data.
• Payment is processed by Stripe; we do not store full card numbers on our servers. Stripe’s privacy policy governs payment data it collects.

3.6 Cookies & Tracking Technologies

• Authentication cookies and JWT session tokens to keep you signed in.
• Functional cookies to remember preferences (language, layout settings).
• Analytics cookies to measure aggregate usage and performance.

4. How We Use Your Data

We use the information we collect for the following purposes:

• Service delivery: Providing and operating all platform features including agent creation, knowledge base indexing, message routing, analytics, and billing.
• RAG processing:Generating vector embeddings from your Customer Data so your agents can retrieve accurate, contextual responses. See Section 5 for details.
• Authentication & security: Verifying identities, enforcing role-based access, rate limiting, and detecting abuse or unauthorized access.
• Billing & subscriptions: Managing your plan, enforcing usage limits, generating invoices, and processing payments through Stripe.
• Communications: Sending account notifications, product updates, support responses, and billing alerts. You may opt out of marketing emails at any time.
• Analytics & improvement: Aggregated, anonymized usage data helps us improve performance, prioritize features, and fix issues. We do not sell your data.
• Legal compliance: Retaining records as required by applicable law and responding to lawful requests from authorities.

5. Customer Data, Ownership & RAG Processing

5.1 You Own Your Data

All Customer Data — documents, crawled content, conversation history, lead data, and any other material you upload or generate through the Service — remains your property. We do not claim any ownership or intellectual property rights in your Customer Data.

5.2 Limited Processing License

By using the Service you grant us a limited, non-exclusive, worldwide license to host, store, transmit, index, and process your Customer Data solely for the purpose of operating the Service for your account. We do not use your Customer Data for any other purpose without your explicit written consent.

5.3 No Model Training on Private Data

We do not use your private Customer Data to train, fine-tune, or improve any shared or public AI models. Your uploaded documents are processed only to generate vector embeddings stored in your isolated Qdrant namespace and to serve responses to your agents.

5.4 RAG Pipeline

Our Retrieval-Augmented Generation (RAG) pipeline extracts text from your documents, splits it into chunks, generates semantic embeddings via our BGE encoder service, and stores those embeddings in a dedicated vector namespace. At query time, the most relevant chunks are retrieved and provided as context to the AI model generating your agent’s response. Raw documents are stored in S3; embeddings are stored in Qdrant. Both are scoped to your account and logically isolated from other customers’ data.

6. Data Isolation & Multi-Tenant Security

Our platform is designed for multi-tenant operation. We enforce isolation between customer accounts through the following measures:

• Authentication & authorization: Every API request is validated with JWT tokens. Resource access is scoped to the authenticated account and role (owner, admin, member).
• Role-based access control (RBAC): Within your workspace, owners can assign admin or member roles, restrict team members to specific agents, and control which integrations are accessible.
• Knowledge base isolation:Each agent’s knowledge base is stored and retrieved in a dedicated namespace. No agent can access another account’s indexed data.
• Storage isolation: Files uploaded to S3 are stored under account-scoped prefixes and accessed only via time-limited signed URLs.
• Widget & API key security: Embedded widgets are authenticated by agent-specific API keys. PIN protection is available to restrict chat access on public-facing deployments.

7. Technical & Organizational Security Measures

• Encryption in transit: All data exchanged between your browser, our APIs, and third-party services is encrypted using TLS/HTTPS.
• Password hashing: Passwords are hashed using bcrypt with appropriate work factors before storage. Plaintext passwords are never stored.
• Rate limiting: API endpoints are rate-limited to mitigate brute-force and denial-of-service attacks.
• AI safety filters: Agents can be configured with topic-blocking rules and moderation actions to prevent misuse.
• Secrets management: Integration credentials (OAuth tokens, API keys) are stored encrypted and never exposed in client-side code.
• Infrastructure: Our backend services, databases (MongoDB, Redis, Qdrant), and message broker (RabbitMQ) are hosted in controlled environments with network-level access controls.

No system is completely secure. We recommend using strong, unique passwords and notifying us immediately at info@lumjha.ai if you suspect any unauthorized access to your account.

8. Third-Party Integrations & Subprocessors

To deliver the Service, we share data with the following categories of third parties. Each integration is activated only when you explicitly connect it.

• Messaging platforms (Meta, Telegram, TikTok, Viber): When you connect Facebook Messenger, WhatsApp Business, Instagram, Telegram, TikTok, or Viber, messages flow through those platforms’ APIs. Their respective privacy policies govern end-user data on their platforms.
• Google (Drive, Calendar): Connecting Google Drive allows us to ingest documents you select. Connecting Google Calendar enables appointment booking. We access only the scopes you authorize via OAuth.
• Shopify: Connecting your Shopify store allows us to index your product catalog for agent responses. We access only product data within the authorized scope.
• Stripe: Payment processing is handled by Stripe, Inc. We pass billing information to Stripe and receive subscription and invoice status in return. We do not store full card details.
• Cloud infrastructure providers: We use cloud hosting, object storage (S3-compatible), and managed database services. These providers process data on our behalf under data processing agreements.
• AI model providers: Agent responses may be generated using third-party large language model APIs. Only the relevant context chunks retrieved from your knowledge base (not full documents) are sent as part of a query. We maintain data processing agreements with these providers.

We do not sell, rent, or trade your personal information or Customer Data to any third party for their own marketing purposes.

9. Cookies & Tracking Technologies

We use the following cookie categories:

• Essential cookies: Required for authentication and secure session management. Cannot be disabled without breaking the Service.
• Functional cookies: Remember your preferences such as language and layout settings.
• Analytics cookies: Collect aggregated, anonymized data about how the Service is used to help us improve it.

You can manage non-essential cookies through your browser settings. Disabling cookies may affect Service functionality, particularly authentication.

10. Data Retention

• Account data: Retained while your account is active and for a reasonable period after cancellation to fulfill legal or contractual obligations, after which it is deleted or anonymized.
• Customer Data (documents, embeddings): Retained while your subscription is active. Upon account deletion or explicit deletion requests, documents and associated vector embeddings are removed from our systems. Residual copies in backups are purged on rolling backup-expiration schedules.
• Conversation history & leads: Retained per your account settings and applicable plan. You can delete conversation history and leads from the dashboard at any time.
• Usage & analytics data:Aggregated metrics are retained for service improvement purposes and may be retained for up to 24 months in anonymized form.
• Billing records:Retained for at least 7 years as required by financial regulations.

11. Your Privacy Rights

Depending on your location, you may have the following rights regarding your personal data:

• Access: Request a copy of the personal data we hold about you.
• Correction: Ask us to correct inaccurate or incomplete data.
• Deletion: Request deletion of your account and associated personal data, subject to legal retention obligations.
• Portability: Request your data in a structured, machine-readable format.
• Restriction & objection: Ask us to restrict processing or object to certain uses of your data.
• Withdraw consent: Where processing is based on consent, withdraw it at any time without affecting prior processing.

To exercise any of these rights, contact us at info@lumjha.ai. We will respond within 30 days (or as required by applicable law).

12. International Data Transfers

Our services are hosted and operated in cloud environments that may be located outside your country of residence. When we transfer personal data internationally, we rely on appropriate transfer mechanisms (such as standard contractual clauses or adequacy decisions) to ensure your data receives an equivalent level of protection.

13. Children’s Privacy

The Service is intended for business use and is not directed to individuals under the age of 18. We do not knowingly collect personal information from children. If you believe a child has provided us with personal information, please contact us and we will delete it.

14. Changes to This Policy

We may update this Privacy Policy to reflect changes in our practices, technology, or legal requirements. When we make material changes, we will update the “Last updated” date at the top of this page and, where appropriate, notify you by email or in-app notification. Continued use of the Service after the revised policy takes effect constitutes your acceptance of the changes.

15. Contact Us

For questions about this policy, to exercise your data rights, or to report a security concern, please contact us at info@lumjha.ai. You also have the right to lodge a complaint with your local data protection authority.