Privacy Policy

1. Introduction

Lumi ("the Extension") is a Chrome browser extension developed and operated by Ellvero Technologies Pvt. Ltd. ("Ellvero", "we", "us", "our"), a company registered in India. This Privacy Policy explains in full detail what data we collect, why we collect it, how we process and store it, how we use it, who we share it with, how long we retain it, and what your rights are. By installing or using Lumi, you agree to this policy.

This policy applies to all users of the Lumi browser extension, the Lumi website (lumi.ellvero.ai), and any associated APIs or services. If you do not agree with this policy, please uninstall the extension and stop using our services.

For questions, contact us at: privacy@ellvero.com

2. Data We Collect, Why We Collect It, and How It Is Used

Below is a comprehensive list of every category of user data that Lumi collects or processes. For each category, we explain what data is collected, why it is collected, how it is used, and how and where it is stored.

3. Data We Do NOT Collect

We explicitly do not collect any of the following:

• Your browsing history or a list of websites you visit
• Page content from any tab you have not explicitly interacted with via Lumi
• Passwords, form inputs, keystrokes, or autofill data
• Health, medical, or biometric information
• Precise GPS location or coarse location data
• Personal communications (emails, chat messages, social media messages) unless you explicitly select text and trigger a Lumi action on it
• Contact lists or address books
• Photos, videos, or audio recordings
• Data from other browser extensions
• Cookies from websites you visit

4. How We Use Your Data

We use your data exclusively for the following purposes:

• Providing the Lumi service: Processing your AI requests (summarise, rewrite, explain, reply) by forwarding relevant page content or selected text to AI providers.
• Authentication: Verifying your identity when you sign in with Google or email/password.
• Billing: Tracking your credit balance and processing credit purchases.
• Personalisation: Using your locally-stored tone preference and memory profile to tailor AI responses.
• Error monitoring: Identifying and fixing bugs to maintain service reliability.
• Aggregated analytics: Understanding which features are used most to improve the product (anonymised, no PII).

We do not use your data for advertising, ad targeting, user profiling for third parties, data brokering, or any purpose not listed above.

5. All Third Parties We Share Data With

The following is a complete and exhaustive list of every third party that receives any user data from Lumi. No other parties receive any user data.

6. Conditions for Data Sharing & Transfer

We only share or transfer user data with third parties under the following circumstances:

• To provide the service: As described in Section 5, data is shared with AI providers and infrastructure partners solely to fulfill your requests.
• Legal compliance: If required by law, court order, subpoena, or governmental authority. We will notify you of such requests where legally permitted.
• Security: If necessary to investigate abuse, fraud, or security incidents.
• Business transfer: In the event of a merger, acquisition, or sale of assets, user data may be transferred to the successor entity. You will be notified via email and/or a prominent notice in the extension at least 30 days before any such transfer.

All other transfers of user data are prohibited.

7. Data Security Practices

We implement the following security measures to protect your data:

• Encryption in transit: All data transmitted between the extension and our servers, and between our servers and third-party providers, uses HTTPS with TLS 1.3 encryption. No data is ever transmitted over unencrypted connections.
• Encryption at rest: All data stored on our backend servers (Supabase/PostgreSQL) is encrypted at rest using AES-256. Local data stored in the extension uses Chrome's built-in encrypted storage APIs.
• Access control: Backend database access is restricted to authorised Ellvero personnel using multi-factor authentication and role-based access controls.
• No plain-text storage of sensitive data: Passwords are hashed using bcrypt. Authentication tokens are short-lived. We never store payment card details.
• Content not retained: Page content and selected text sent for AI processing are processed in-memory and immediately discarded. They are never written to disk, database, or log files on our servers.

8. Data Retention

The following table describes exactly how long each type of data is retained:

9. Your Rights

You have the following rights regarding your data:

• Right to access: You can request a copy of all data Ellvero holds about you.
• Right to deletion: You can request deletion of your account and all associated data by emailing privacy@ellvero.com. We will delete all your data from our servers within 30 days (except where retention is required by law).
• Right to data portability: You can request an export of your memory profile, usage history, and account data in a machine-readable format.
• Right to withdraw consent: You can withdraw consent for data processing at any time by uninstalling the extension and requesting account deletion.
• Right to opt out of analytics: You can disable anonymised analytics at any time via the extension's Settings panel.
• Right to local data control: All locally stored data (memory profile, preferences, conversation history) is permanently deleted when you uninstall the extension.

All requests are acknowledged within 7 days and fulfilled within 30 days. Contact privacy@ellvero.com to exercise any of these rights.

10. Chrome Web Store Limited Use Disclosure

Lumi's use of information received from Chrome APIs adheres to the Chrome Web Store User Data Policy, including the Limited Use requirements. Specifically:

• Allowed use: Lumi only uses Chrome permissions (activeTab, storage, identity, scripting, sidePanel, tabs, contextMenus, alarms) to provide user-facing features described in the Chrome Web Store listing and the extension's user interface. No permissions are used for purposes unrelated to the product's functionality.
• Allowed transfer: User data is only transferred to third parties as necessary to provide the Lumi service (AI processing, authentication, payment processing, error monitoring). No data is transferred for advertising, data brokering, or any unrelated purpose.
• No advertising: User data is never used for personalised advertising, retargeting, or interest-based advertising.
• No human reading: No Ellvero employee reads individual user content (page content, selected text, or memory profiles) except where the user explicitly consents for technical support, or where required for security investigation or legal compliance.

11. Permissions We Request & Why

12. Children's Privacy

Lumi is not intended for users under the age of 13 (or the applicable age of digital consent in your jurisdiction). We do not knowingly collect personal data from children. If you believe a child has provided us with personal data, please contact privacy@ellvero.com and we will delete it immediately.

13. International Data Transfers

Ellvero is based in India. Your data may be processed and stored in the United States (where our infrastructure providers Supabase, Vercel, and AI providers are hosted). By using Lumi, you consent to the transfer of your data to these jurisdictions. We ensure that all transfers are protected by appropriate security measures (HTTPS/TLS 1.3, encrypted storage) as described in Section 7.

14. Changes to This Policy

We may update this Privacy Policy from time to time. We will notify users of material changes via an in-extension notification at least 14 days before the change takes effect. The "Last updated" date at the top of this page will be revised. Continued use of the extension after the effective date constitutes acceptance of the updated policy. If you do not agree with the changes, you may uninstall the extension and request account deletion.

15. Contact