LUMAHouseUK · Legal
Privacy Policy
How we look after your information
Last updated: 6 November 2026
The short version
- Luma is your AI companion. To talk to you and remember you, we keep what you tell Luma and what you add to the app.
- Luma is a companionship app, not a health app of any kind, so please do not tell Luma about your health. If you do, it is handled like everything else you say (see section 4).
- Before your first chat, a one-time screen asks you to agree that what you say is sent to our AI companies. If you choose “not now”, you cannot talk to Luma.
- No one at LUMAHouseUK reads your conversations unless a legal matter makes it necessary.
- We use two AI companies, OpenAI and Anthropic, to run Luma. They are not allowed to use your conversations to train their AI.
- We never sell your information, and we don’t use it for advertising.
- You can see, change and delete your memories and conversations, and delete your whole account, in the app. The one exception is a short, condensed record of safety moments, which we keep separately for legal reasons (see section 7). If you stop using Luma for a long time, we delete your account, after warning you first.
- Luma is a companion, not an emergency service. If you are in danger, call your local emergency number.
The rest of this page explains each point in more detail.
1. Who we are
We are LUMA HOUSE GROUP LTD, trading as LUMAHouseUK, a company registered in England and Wales. Our address is Moss Cottage, Moss Lane, Tarporley, Cheshire, CW6 0LE, United Kingdom. We run the Luma app and website. We are the “controller” of your information, which means we decide how and why it is used.
Company number: 17515117.
Our Data Protection Lead is Charlotte Xu-To Ellis. You can contact her at charlie@thaifoodmadeeasy.com or through marni@lumahouse.co.uk. See section 18 for all the ways to reach us.
2. What information we collect
Here is what we collect, with examples and where it comes from.
| What | Examples | Where it comes from |
|---|---|---|
| Account details | Your name, email address, password (we store it scrambled, never as plain text), and a record that you ticked the box to agree to our Terms and confirm you have read this policy. We do not ask for your date of birth. | You |
| What you say to Luma | Your conversations, including Luma’s replies. We keep them so Luma can remember what you talked about between chats. You can delete conversations in the app. | You |
| Your voice | Luma talks with you by voice. Your voice is turned into text so Luma can understand you. We do not keep recordings of your voice. | You |
| Memories | Things Luma learns about you and keeps as “memories”, so you don’t have to say them twice. This can include family, routines, interests, and health or medication details. | You, through conversation |
| Safety records | A condensed summary of a moment of distress or a call for help in a conversation, roughly why, and what Luma did. We keep it so we can deal with any legal matter if one arises. | Created by our safety checks |
| People and reminders | Contacts, reminders and calendar events you choose to store in the app. If you connect your phone and calendar, we also see the calendar details you allow, such as event titles, dates, times and places. We do not use your phone’s contacts. | You, and your phone or calendar if you connect it |
| Phone number (optional) | Your mobile number, only if you add it for text reminders, and a record of when you switched text reminders on. | You |
| Where you are (roughly) | The country you are in. We do not collect your exact location. We work it out from your internet connection (IP address), your app store’s country, and the country you tell us. | Your device, and you |
| Searches Luma does for you | The question Luma looks up for you, such as a shop’s opening hours. We keep a log of these searches. | Created when you ask |
| Push notifications | A code that identifies your device (a device token), only if you allow notifications on your phone, and the wording of the notifications we send you. Notifications can appear on your phone’s lock screen, so other people may see them. You can change this in your phone’s settings. | Your device |
| Technical and usage details | Your device type, app version, how long you use Luma, when you log in, which features you use, and crash reports. | Your device and the app |
| Messages to us | Emails or messages you send to our support, and any feedback you give. | You |
| Subscription details | Whether you are subscribed and when. Apple, Google or our payment provider handles your card details. We do not see them. | You and the payment provider |
Connecting your phone and calendar. This is optional. If you choose to connect them, your phone asks for your permission first, and Luma can only see what you allow. You can switch the connection off at any time in your phone’s settings and in Settings in the app. If you ask Luma to add or change an event, it can do that, but only because you have allowed it to use your calendar. We use what we see only to help Luma help you, for example to remind you of events. We do not use your phone’s contacts. Your calendar can include details about other people. We treat those with the same care, and we do not contact them.
You may also tell Luma about other people, such as family or friends. Please share only what you need to. We use this only to help Luma help you. We do not contact those people or build profiles about them.
3. What we do with it, and why
The law says we must have a “legal reason” for using your information. This table gives each purpose in plain words. Where we rely on “legitimate interests”, we have weighed them against your rights, and you can object (see section 11).
| What we do | Our legal reason |
|---|---|
| Run your account and let you talk with Luma, including memories and reminders | Contract. We need to do this to provide the service you signed up for. |
| Take payment and manage your subscription | Contract. |
| Look things up on the internet for you | Contract. It is part of the service. |
| Keep you safe: look for signs you may be in danger, and show you where to get help | Legitimate interests (looking after our users). If it involves health information, we also rely on your explicit permission. In a real emergency we may rely on protecting someone’s life. |
| Show help services for your country | Legitimate interests. We use only your approximate country. |
| Keep a condensed record of safety moments so we can deal with legal matters | Legitimate interests (being able to deal with legal claims and legal duties). Where health information is involved, this is also needed to bring or defend a legal claim. We keep it for a limited time only (see section 10). |
| Use your phone and calendar details to help you | Your permission, which you give when you connect them. You can take it back at any time by switching the connection off. |
| Keep health and other sensitive details Luma learns about you | Your explicit permission (see section 4). |
| Review conversations for quality and safety | Legitimate interests. If health details are involved, your explicit permission. This is always done by automated AI tools. No one at LUMAHouseUK reads your conversations for this. A person looks at your information only if a legal matter makes it necessary, or if you ask a person to review a decision about your account. |
| Send push notifications, such as reminders you asked for and check-ins | Your consent. Your phone asks you first, and you can switch notifications off at any time in your phone’s settings. |
| Send reminder texts | Your consent. You switch them on, and you can switch them off at any time. |
| Keep things secure and prevent fraud and abuse | Legitimate interests. |
| Improve the app by looking at how it is used | Legitimate interests. We use summarised information where we can. |
| Send account emails, such as password resets | Contract. |
| Send product updates or marketing | Your consent. You can unsubscribe at any time. |
| Train AI models using your conversations | We do not do this. If this ever changes, we will ask for your separate permission first. |
| Follow the law and deal with legal claims | Legal obligation, and legitimate interests. |
4. Health and other sensitive information
Luma is a companionship app. It is not a health app of any kind, and it is not designed to look after health information. Please do not tell Luma about your health, medical conditions or medication, and ask a doctor or pharmacist about those instead.
Health information is “special category” data, which the law treats with extra care. If you tell Luma about your health anyway, Luma may remember it as part of what it knows about you.
Before your first chat, we show you a one-time screen. It asks you to agree that what you say is sent to our AI companies, OpenAI and Anthropic, so that Luma can work. This includes anything you choose to say about your health. It is not hidden in our Terms, and carrying on using the app does not count as agreeing. If you choose “not now”, you will not be able to talk to Luma.
You can delete any memory, including one about your health, at any time in Profile & Memories. Luma saves memories automatically as you chat, and there is no setting to turn this off, so it may save new ones from your next chat. If you want to take back your permission, email us. We will delete your account and the health-related memories we hold, because Luma cannot work without sending your words to our AI companies. Taking back your permission does not affect anything we did before.
You never have to tell Luma anything about your health.
5. Your voice
When you speak to Luma, your voice is turned into text so Luma can respond.
We do not store recordings of your voice ourselves. Your voice is sent to OpenAI, which powers the live voice conversation, so that Luma can hear and reply to you. OpenAI’s terms say that it deletes the audio after 30 days. We do not use your voice to identify you.
6. Memories
Memories are short notes Luma keeps about you, like “your daughter is called Anna” or “you walk in the park each morning”. They help Luma remember you.
- You can see and edit all your memories in the app under Profile & Memories.
- You can delete any memory you don’t want Luma to keep, or all of them. Luma saves memories automatically as you chat and there is no setting to turn this off, so it may start saving again from your next chat.
- If you delete your account, we delete your memories too (see section 10).
- If you delete a conversation, we also delete the memories Luma created from it.
7. Safety, and getting you help
Luma looks for signs that you may be in danger or in serious distress. If it sees them, it will show you helpline numbers for your country and encourage you to contact them yourself. It may use a directory called ThroughLine (findahelpline.com) to show help services for your country. We only send ThroughLine your country, not your name or conversations.
Luma does not contact anyone on your behalf. It does not contact these helplines for you, and it cannot call the emergency services for you or tell anyone what you have said. If you are in danger, please call your local emergency number straight away.
These checks use automated tools. They are not perfect. They can miss things, and sometimes they may react when you are fine. The country they use might also be wrong, for example if you are travelling.
When Luma sees signs of danger or serious distress, we keep a short, condensed record of that moment. It is a summary of the relevant part of the conversation, why it was flagged, and what Luma did. It is not the full conversation. We keep it so that we can deal with any legal matter if one arises.
You can delete your conversations, memories and account, but we keep this record. It is kept separately for 24 months and then deleted. Only our three directors can see it, and only if they need to for a legal matter. You can ask for a copy of it at any time. If you think we should not keep it, you can object, and we will look at your request. If a safety check ever leads us to limit your account, you can ask us to have a person look at that decision.
8. Who we share your information with
We use a small number of trusted companies to run Luma. They act on our instructions and must look after your information. We do not sell your information, and we do not share it for advertising.
| Who | Why | What they get |
|---|---|---|
| OpenAI | Powers your live voice conversation and the internet searches Luma does for you. | What you say and Luma’s replies, so it can respond. If you connect your calendar, event details may be included when Luma uses them to help you. For searches, they get only the search question. We tell Luma not to include your name or personal details, and we do not search health or medication questions. |
| Anthropic | Does background tasks, such as creating memories and checking conversations for quality and safety. | Your conversations and memories. |
| Twilio | Sends the reminder texts you switched on. | Your mobile number and the wording of the reminder. |
| Apexia | Hosts our database and servers, and runs our mail server, which sends account emails (such as your welcome email and password resets) and, if you agreed, newsletters from website@lumahouse.co.uk. | All the information stored in the app, and the emails we send you, held securely. Our servers are in Winsford, Cheshire, in the UK. |
| Apple, Google and our payment provider | Handle your subscription. | Your payment details. We only learn whether you have paid. |
| Apple and Google | Deliver push notifications to your phone. | Your device code and the wording of the notification. |
| ThroughLine | Finds help services for your country. | Your country only. |
| Advisers | Lawyers, accountants and insurers who help us. | Only what they need. |
| Authorities | Where the law requires it, or to protect someone’s life. | Only what is needed. |
| A buyer of our business | If we are ever sold or merged. | Your information, on the basis that this policy keeps applying. |
OpenAI and Anthropic process your information for us under business terms. Under those terms they cannot use your conversations to train their AI models. OpenAI and Anthropic each keep information for 30 days, for example for safety and abuse checks. This means that if you delete a conversation, they may still hold a copy for up to 30 days under their own terms.
9. Sending your information to other countries
Our own servers, and the mail server that sends our emails, are in the UK. Some of the other companies above, such as OpenAI, Anthropic, Twilio, Apple and Google, are based outside the UK, including in the United States. If you use Luma from outside the UK, your information is also handled in the UK.
When we send information outside the UK, we use legal protections the UK approves, such as the UK’s standard contract terms (the IDTA or the UK Addendum) or an arrangement such as the UK–US data bridge for certified companies. You can ask us for details of the protection used for a particular company.
10. How long we keep it
We keep your information until you delete it. You are in control: you can delete a conversation, a memory, or your whole account in the app. The one exception is the condensed safety record, explained in the table.
| Information | How long we keep it |
|---|---|
| Conversations | Until you delete them. When you delete a conversation, we remove it from our live systems straight away. We also delete the memories that came from it. The one exception is the condensed safety record described below. |
| Memories | Until you delete them, or you delete the conversation they came from, or you delete your account. |
| Account details | While your account is open. If you delete your account, we remove it from our live systems within 14 days. This short delay is in case you change your mind. |
| Voice recordings | We do not store them ourselves. OpenAI’s terms say it deletes the audio after 30 days. |
| Safety records (condensed) | We keep these for 24 months even if you delete the conversation or your account, and then delete them. They are held separately, and only our three directors can see them, and only for a legal matter. |
| Search logs | Until you delete your account. |
| Phone and calendar details | Only while your phone or calendar is connected. If you switch the connection off, we stop reading it and delete the copies we hold. Anything Luma saved as a memory stays until you delete it. |
| Phone number and text reminder consent | While text reminders are switched on and your account is open. We keep a record of your consent for as long as we need to show you agreed. |
| Push notification device code | Until you switch notifications off, or your phone stops accepting them, or you delete your account. |
| Technical and usage details | Until you delete your account. |
| Messages to us | Until you delete your account. |
| Inactive accounts | If you do not use Luma for 24 months, we delete your account and your information, apart from the condensed safety record. We email you a month before, so you can keep your account if you want to. |
| Payment and tax records | As the law requires, usually at least 6 years. |
| Backups | Copies of deleted information are cleared from our backups within 30 days. |
Our providers (see section 8) may keep information for a short time under their own terms (30 days for OpenAI and Anthropic). The exceptions to everything above are the condensed safety records and any records we must keep by law, or need to deal with a legal claim.
11. Your rights and choices
You have these rights over your information:
- See it. You can ask for a copy of what we hold about you.
- Correct it. You can ask us to fix anything wrong or incomplete.
- Delete it. You can ask us to delete your information, and in the app you can delete conversations, memories or your whole account yourself. We may refuse to delete the condensed safety record while we still need it for a legal matter. If we do, we will tell you why.
- Limit it. You can ask us to pause how we use your information in some cases.
- Take it with you. You can ask for the information you gave us in a format you can reuse.
- Object. You can object to us using your information where we rely on legitimate interests, and to marketing at any time.
- Take back your permission. Where we rely on your consent, you can withdraw it at any time.
- Ask for a person to look at a decision. Our safety checks use automated tools. You can ask for a person to review any decision that affects your account.
How to use your rights: use the app (Profile & Memories, or Settings → Delete my account), or email marni@lumahouse.co.uk. We usually reply within one month. It is free. We may ask you to confirm who you are.
If you are unhappy: please tell us first so we can put it right. You can also complain to the UK’s data protection regulator, the Information Commissioner’s Office, at ico.org.uk or on 0303 123 1113. If you live elsewhere, you can complain to the data protection authority in your country.
12. AI and automated decisions
Luma is an AI. You are not talking to a human. We do not use automated tools to make decisions about you that have legal effects or affect you in a similarly big way. Our safety checks use automated tools, and you can ask for a person to review any resulting decision (see section 11).
13. Keeping your information safe
We use sensible technical and organisational protection, such as scrambling passwords, encrypting information when it moves and while it is stored, limiting who can access it, and training the people who work with it. No system is completely secure. If a data breach is likely to put you at risk, we will tell you and the regulator as the law requires.
14. Children
Luma is designed for adults and is not aimed at children. We do not ask for your date of birth. If we find that a child has been using Luma, we will close the account and delete their information.
15. If you live outside the UK
- European Union and European Economic Area. You have rights like those in section 11 and can complain to the authority in your country.
- United States. Some states give you rights to know, delete and correct your information and to limit how sensitive information is used. We do not sell your information or share it for advertising.
- Other countries. If your country’s law gives you extra rights, we will respect them. Contact us to use them.
16. Cookies and our website
Our website uses only essential cookies. These are small files that the website needs in order to work properly. We do not use analytics, tracking or advertising cookies, so we do not ask you to accept cookies.
17. Changes to this policy
We may update this policy from time to time. If we make an important change, we will tell you before it starts, for example by email or a message in the app. If we ever want to use your information in a new way that needs your permission, we will ask you first. The date at the top shows when this policy was last updated.
18. Contact us
LUMA HOUSE GROUP LTD (trading as LUMAHouseUK)
Company number: 17515117
Moss Cottage, Moss Lane, Tarporley, Cheshire, CW6 0LE, United Kingdom
Email: marni@lumahouse.co.uk
Data Protection Lead: Charlotte Xu-To Ellis (charlie@thaifoodmadeeasy.com)
This policy should be read with our Terms and Conditions. If the two disagree about how we handle your personal information, this policy applies.