Privacy built for serious client work.

This Privacy Policy explains how Lume11 collects, uses, stores, shares, and protects personal information when you use our website, client portal, onboarding workflows, and related services.

We process personal data for the purpose of operating a client collaboration platform for agencies and their clients, including account creation, project delivery, file sharing, billing, approval workflows, communication, and security monitoring.

This Policy applies to agency users, client users, prospects, and visitors who interact with our website or sign in via Google, LinkedIn, or Microsoft single sign-on.

Lume11 collects the information necessary to operate the service: account details, client and contact records, project metadata, messages, files, approvals, contracts, invoices, and payment information required to process transactions.

This includes names, email addresses, phone numbers, company information, work files, timestamps, activity log data, billing details, and technical information such as browser type, device data, IP address, and usage logs needed to maintain security and service reliability.

We also collect information from third-party identity providers when you sign in with Google, LinkedIn, or Microsoft, such as your name, email address, profile image, and basic account identifiers, solely to create or access your account and confirm your identity.

We use the information to provide the service, manage client workspaces, coordinate projects, send notifications, generate invoices, and support approvals and onboarding workflows.

For agencies, this means client data is used to run projects, manage delivery, track billing, and maintain a clear operational record. For clients, the data is used to access a shared workspace, review files, approve work, and interact with their agency.

When you sign in with Google, LinkedIn, or Microsoft, we may receive limited profile data from the identity provider, including your name, email address, and profile image, to create or access your account and support secure sign-in.

We may also use information to respond to support requests, maintain service continuity, prevent fraud, enforce account security, improve the user experience, and comply with legal obligations.

Lume11 is built around shared client workspaces. Files, messages, drafts, contracts, invoices, approvals, and project updates may be visible to agency users and, where relevant, to the appropriate client.

Access is controlled by the agency through role-based permissions and project visibility settings. Agency administrators decide which users can access a workspace, review files, approve deliverables, or manage billing. Lume11 does not independently sell or rent personal data for marketing purposes, and we do not identify individuals in aggregated product analytics.

If a client or agency invites another person into a workspace, that person may receive access to limited project content as needed to complete the workflow. We process this information only to support the authorized collaboration requested by the account owner.

If an agency or client uses Lume11 to collect or manage payments, payment details may be sent to a secure third-party processor. We do not store full payment card details in our systems where possible and rely on trusted providers for payment handling, invoicing, and related transactions.

We store only the billing information necessary to reconcile payments, issue invoices, and handle disputes, refunds, or tax obligations. Agencies remain responsible for their own legal and tax compliance related to their services and billing practices.

In some circumstances, we may be required to retain account records or transaction data to satisfy legal, accounting, or regulatory obligations.

Lume11 may integrate with providers such as Stripe, PayPal, Google Drive, Slack, Calendly, Zapier, and analytics services. These providers operate under their own privacy policies, and we share only the minimum information required for the relevant workflow.

We also use infrastructure and monitoring providers to host the service, process notifications, and maintain secure storage. These providers are contractually required to protect the information we share with them.

Data may be transferred to countries where our service providers or hosting infrastructure operate. Where required, we rely on contractual safeguards and lawful transfer mechanisms consistent with applicable privacy law.

We use commercially reasonable technical and organizational safeguards, including encryption in transit, access controls, role-based permissions, monitoring, and audit logging, to protect personal information against unauthorized access, misuse, or loss.

Information is retained only as long as necessary to provide the service, comply with legal obligations, resolve disputes, and support operational requirements. When an account is deleted, we remove or de-identify data in line with the account settings and applicable retention policies.

We may keep limited records of billing, account status, and security events for legitimate business or legal purposes even after a user account is deactivated, subject to the retention periods required by law or business need.

Depending on your jurisdiction, you may have rights to access, correct, delete, export, or restrict the processing of personal data, and to object to or withdraw consent where required. Agency administrators and individual clients may request updates or access to account information through the portal or by contacting us.

If you are a client, your agency controls the workflow and may determine which data is visible in the shared portal. If you want to exercise a legal right or raise a concern about data handling, contact the agency first and then contact us for support.

You can manage your sign-in credentials, disconnect third-party account access, and update email preferences through your account settings or by contacting the account administrator. If you are using SSO with Google, LinkedIn, or Microsoft, you can also manage the data permissions granted to Lume11 in your provider account settings.

We may use cookies, beacons, and similar technologies to understand how the website and portal are used, support authentication, remember preferences, and improve product usability. Some cookies are required for core functionality; others support analytics and marketing.

We may also use limited analytics or performance tooling to detect errors, measure user journeys, and improve product quality. These tools do not sell personal data and are used only for internal product and service improvement.

You can manage browser cookie preferences in your browser settings. Disabling non-essential cookies may reduce personalization or limit some features.

We may update this Privacy Policy from time to time to reflect changes in the product, legal requirements, or business practices. If a change is material, we will update the effective date and notify relevant users through in-app notices or email where appropriate.

Continued use of the service after an update constitutes acceptance of the revised policy.

If a material change affects how we use personal data or SSO information, we will provide a clear update in the product or by email where practical.

Questions about this Privacy Policy, account data, or your rights under applicable privacy laws can be sent to privacy@lume11.com. We will respond as promptly as reasonably possible and work to resolve privacy concerns in good faith.