Privacy policy.

1.1 Registered address: 138 Queen Edith's Way, Cambridge, CB1 8NW, United Kingdom.

1.2 Privacy contact: privacy@lumin-hive.com.

1.3 We are not currently required to appoint a Data Protection Officer. Our privacy contact handles all enquiries.

2.1.1 Server logs. When you visit lumin-hive.com our hosting provider records your IP address, browser user-agent, request time, and the page you requested. These logs are kept short-term to defend the site against abuse.

2.1.2 Consent records. If you dismiss our cookie notice, a small record is stored in your browser's localStorage under the key lh_cookie_notice. This is not sent to us.

2.1.3 Forms and calculators. If you use the "revenue lost" calculator on the homepage, the numbers you enter stay in your browser. We do not receive them.

2.1.4 Contact you initiate. When you email us or book a call, we receive the information you choose to share (name, email, phone, what you tell us about your business).

2.2.1 Account details. Name, business name, email, phone number, billing address, payment method.

2.2.2 Service data. Inbound calls, voicemails, transcripts, messages, contact records, calendar events, invoices, and other business records you ask our agents to work with. This is your firm's data. We act as processor of it on your behalf under a separate data processing agreement.

2.2.3 Usage data. Which features you use, how often, when. Used to keep the product working and to decide what to build next.

3.1 Contract. To operate your account and deliver the service you signed up for.

3.2 Legitimate interests. To secure our systems, prevent abuse, analyse site usage in aggregate (without cookies), respond to enquiries, and improve the product. We balance these interests against your rights and do not rely on legitimate interests where the impact on you would outweigh the benefit to us.

3.3 Consent. We ask for consent before sending marketing emails. You can withdraw consent at any time using the unsubscribe link.

3.4 Legal obligation. To keep accounting records, answer lawful requests from regulators, and comply with tax law.

4.1 Server logs. 30 days, then deleted or anonymised.

4.2 Enquiry emails. 2 years from the last message, then deleted unless they relate to an ongoing customer relationship.

4.3 Account data. For the life of your account, plus 7 years afterwards for accounting and tax purposes (UK statutory minimum is 6 years, we keep a year's buffer).

4.4 Service data (your firm's data). For the life of your account, deleted on your written request or within 90 days of account closure, whichever is sooner.

4.5 Marketing consent records. 3 years from last interaction.

5.1 Google Workspace (Google LLC, US) — email, calendar, document storage. Transfers covered by the EU-US Data Privacy Framework and UK Extension.

5.2 Netlify (Netlify Inc, US) — marketing website hosting and logs. Transfers covered by Standard Contractual Clauses and UK IDTA.

5.3 Squarespace Domains (Squarespace Inc, US) — domain registration and DNS.

5.4 Professional advisers — accountants, lawyers, bankers as needed and only when necessary.

5.5 Regulators and law enforcement — where required by law, and after challenge where appropriate.

6.1 The EU-US Data Privacy Framework and its UK Extension, for processors certified under it (e.g. Google).

6.2 Standard Contractual Clauses (EU) and the UK International Data Transfer Addendum, for processors not certified under the DPF.

6.3 We do not transfer personal data to jurisdictions without an adequacy decision or appropriate safeguards.

7.1 Right of access. Ask us what personal data we hold about you, and receive a copy.

7.2 Right to rectification. Ask us to correct inaccurate or incomplete data.

7.3 Right to erasure ("right to be forgotten"). Ask us to delete your data, where the reasons for keeping it no longer apply.

7.4 Right to restrict processing. Ask us to pause what we do with your data while we resolve a dispute about it.

7.5 Right to data portability. Ask us to send you your data in a machine-readable format, or send it to another provider you choose.

7.6 Right to object. Object to our use of your data for legitimate interests or direct marketing. Where you object to marketing, we will stop immediately.

7.7 Right to withdraw consent. Where we rely on consent, you can withdraw it at any time.

7.8 Right to complain. You can complain to the UK Information Commissioner's Office (ico.org.uk) or your local EU data protection authority.

8.1 Right to know what personal information we have collected about you, the categories of sources, the purposes, and the categories of third parties we share it with.

8.2 Right to delete personal information we have collected from you, subject to certain exceptions.

8.3 Right to correct inaccurate personal information.

8.4 Right to opt out of sale or sharing of personal information. See section 10.

8.5 Right to limit use of sensitive personal information. We do not use sensitive personal information for purposes that require offering this limit.

8.6 Right to non-discrimination. We will not charge you more, give you worse service, or deny you service because you exercised a privacy right.