Privacy Policy

1Who we are

Lumin ("we", "us", "our") is a social platform for financial discussion and education, operated from the United Kingdom. Our website is lumin.pro. We are the data controller responsible for your personal data under UK GDPR.

Lumin Pro Ltd.
66 Paul Street, London, EC2A 4NA
Email: privacy@lumin.pro

2What data we collect

We collect the following personal data when you use Lumin:

Account information: email address, username, display name, and password (stored as a secure hash)
Profile information: avatar image, bio, social media links, and any other details you choose to add
Identity verification data: if you choose to verify your identity, we use a third-party provider (Didit) to process your ID documents. We store only the verification status, not your documents
Content you create: posts, comments, reposts, and any images you upload
Messaging data: private messages exchanged between you and your peers, including message reactions
Interactions: likes, bookmarks, follows, peer connections, peer reviews, and notification preferences
Platform activity: conviction marketplace data (virtual token trades, holdings, and balances), promotion credits, and subscription details. Note: conviction tokens are virtual and do not involve real money. Credit purchases and subscriptions are processed by Stripe
Usage data: profile views, post impressions, and session activity timestamps
Technical data: IP address, browser type, and device information collected via server logs

3How we use your data

We use your personal data to:

Provide and maintain your Lumin account
Display your content to other users
Send verification codes for authentication and account changes
Deliver in-app and email notifications based on your preferences
Send news and updates by email, only if you've opted in. You can opt out in Settings or from the link in any of these emails
Process payments and manage your subscription, credits, and marketplace activity
Calculate engagement metrics such as Lumin Rating and trending scores
Facilitate peer connections and private messaging between users
Fund environmental impact initiatives (tree planting and carbon offsetting) through promoted posts
Display commercial content including MPU advertisements purchased by company accounts and promoted posts boosted by users, neither of which are targeted using your personal data
Moderate content and enforce our Terms of Service
Analyse platform usage to improve the service

4Legal basis for processing (GDPR)

We process your data under the following legal bases:

Legal basis	What it covers	Article
Contract	Processing necessary to provide the Lumin service you signed up for	6(1)(b)
Legitimate interests	Platform security, fraud prevention, analytics, and service improvement	6(1)(f)
Consent	Analytics and advertising cookies (not currently used), and marketing communications	6(1)(a)
Legal obligation	Where we are required to retain or disclose data under applicable law	6(1)(c)

5Cookies and local storage

Lumin stores what it needs to work, such as keeping you signed in and saving your drafts. We don't currently use analytics or advertising cookies. For full details, and how to manage your choices, see our Cookie Policy.

7Creator Subscriptions

Where a user enables Creator Subscriptions on their account, payment data flows as follows:

Subscribers pay Lumin via Stripe. Lumin is the merchant of record on the transaction and appears as "LUMIN" on the subscriber's bank statement
Creators receive 90% of each subscription payment via Stripe Connect directly to their linked bank account. Lumin retains a 10% platform fee. Card processing fees are deducted before the split
Lumin shares each Creator's identity data (name, address, date of birth, tax reference, business information) with Stripe to enable the KYC (identity verification) required by law before Creator payouts can be released
Creators can see their active subscribers' public Lumin profile information (username, display name, avatar, and subscription start date) via the Subscribers page. Subscribers' email addresses, payment card details, and other personal information are not shared with Creators

Payments to Creators are handled entirely by Stripe. Lumin does not hold Creator funds and does not have direct access to Creator bank accounts.

8Sealed records

To make Lumin's staking system transparent and tamper-proof, we keep a sealed record of token activity: stakes, withdrawals, locks, refunds and yield payments.

What we publish. Once a day, we combine that day's records into a single fingerprint (a cryptographic hash) and publish it on Base, a public blockchain. Each individual record also has its own fingerprint, which can be checked at lumin.pro/verify. Fingerprints can't be reversed to reveal what they contain.

What we don't publish. Your name, handle, email address, stake amounts and post content are never published on the blockchain. Within each record, you're represented only by a scrambled identifier created using a secret value that we hold.

Permanence. Information published on a blockchain can't be edited or deleted by anyone, including us. If you delete your Lumin account, we delete the secret value that links your records to you and remove or anonymise the related information we hold. After that, the published fingerprints can no longer be connected to you.

Why we do this. Sealed records let anyone confirm that staking activity on Lumin hasn't been altered, which supports the integrity of the platform for all users. We rely on our legitimate interest in providing a trustworthy, verifiable service.

Services involved. Publishing uses Cloudflare (which runs the daily publishing process), Coinbase Developer Platform (our connection to the Base network), Base and Ethereum Attestation Service. These services only ever handle fingerprints, never your personal details. When you check a record at lumin.pro/verify, your browser connects directly to public Base network services and a content delivery network to carry out the check. As with any website, those services can see your IP address.

9Data retention

Account data: retained for as long as your account is active
Content: retained until you delete it, or until your account is deleted
Messages: retained until you delete the conversation, or until your account is deleted
Email records: who each email was sent to and whether it was delivered, kept for 12 months. If you unsubscribe, or an email to you bounces or is marked as spam, we keep that address on a do-not-send list so we don't email it again, even after your account is deleted. If we invite you and you don't join, we keep a scrambled form of your address so we never email it again
Transaction data: credit purchases and payment records processed via Stripe are retained for up to 7 years in accordance with UK record-keeping requirements. Virtual marketplace data (conviction token trades and balances) is retained for the lifetime of your account
Verification codes: automatically expire after 15 minutes
Session data: expires after 90 days of inactivity

When you delete your account, we delete or anonymise your personal data. Locked stakes stay on the posts they back, but are no longer linked to you. Transaction records may be retained as required by law.

10Your rights

Under the UK GDPR, you have the right to:

Access your personal data
Rectify inaccurate data (via your profile settings)
Erase your data (via Settings > Delete Account, or by contacting us)
Restrict processing in certain circumstances
Data portability: receive your data in a structured format
Object to processing based on legitimate interests
Withdraw consent at any time for consent-based processing (without affecting the lawfulness of processing before withdrawal)

To exercise any of these rights, email privacy@lumin.pro. We will respond within 30 days.

11Data security

We protect your data with:

HTTPS encryption on all connections
Secure password hashing (bcrypt)
Session regeneration on login to prevent fixation attacks
Rate limiting on authentication endpoints
HTTP security headers (X-Frame-Options, CSP, XSS protection)
HMAC signature verification on third-party webhooks

12International transfers

Your data is primarily stored on servers in the United Kingdom. Some third-party services we use (such as Stripe) may process data in the United States or other jurisdictions. Where data is transferred outside the UK, appropriate safeguards are in place, including Standard Contractual Clauses and the service provider's participation in recognised data protection frameworks.

13Age restriction

In accordance with the UK GDPR and the Data Protection Act 2018, Lumin is not intended for individuals under the age of 18. We do not knowingly collect, solicit, or process personal data from children under the age of 18.

If you are under 18, you are prohibited from registering for an account, accessing the Services, or submitting any personal data to us. Any accounts or data suspected of being associated with individuals under 18 will be terminated and permanently deleted.

If we become aware that personal data has been collected from a child under the age of 18, we will promptly take steps to delete such data. If you believe that someone under 18 has provided us with personal data, please email support@lumin.pro.

14Changes to this policy

We may update this Privacy Policy from time to time. Material changes will be communicated via in-app notification. The "Last updated" date at the top indicates the most recent revision.

15Complaints

If you are unsatisfied with how we handle your data, you have the right to lodge a complaint with the Information Commissioner's Office (ICO):

Website: ico.org.uk
Phone: 0303 123 1113

Questions about this policy?

Get in touch