Effective 13 July 2026. Lumienzo, Inc. ("Lumienzo", "we", "us", "our") is a Delaware corporation building Lumi, an AI assistant for influencer marketing. This Privacy Policy explains how we handle personal information across two moments in our life as a company: today, when the only thing we run is this marketing website and a waitlist, and later, once the Lumi product, accounts and dashboards actually launch. Our promise is simple and we mean it plainly: we do not sell or rent your personal information, we do not use dark patterns, and we collect the least we can. Questions are welcome at [email protected].

Where things stand today

We are pre-launch. The product is not yet open to the public, and every "get started", "sign in" and "claim" button routes to a waitlist page. Right now the only personal data we handle is the email addresses people give us to join the waitlist, plus the basic server logs that any website generates when it serves a page. There are no live accounts, no payments, no escrow, and no social-media connections yet.

The sections below about accounts, Instagram, payments and campaigns describe how the product will work when it launches. They are written in the future tense on purpose. We will update this policy, and where the law requires it we will ask for fresh consent, before any of those features go live.

Information we collect today

Waitlist email address. When you join the waitlist or newsletter, we collect the email address you enter. Our signup form is powered by Buttondown, a third-party email service that stores your address and sends you updates. Every email we send includes a working unsubscribe link.
Server logs. This site is a static website hosted on Netlify. Netlify's content delivery network records standard technical request logs, which include your IP address, browser user agent, the time of the request, and the page requested. These logs are inherent to serving any website and help keep the site available and secure.
Image loads. Some decorative photos on the site are served from Unsplash's image content delivery network (images.unsplash.com). When your browser loads one of those images, Unsplash receives your IP address as part of that request. We do not control Unsplash's own logging.

That is the complete list of what we process today. We do not run analytics, advertising pixels, or any cross-site tracking on this website.

Information we will collect when the product launches

The following describes the Lumi product, which is not yet available. It will apply only once you create an account and choose to use these features.

Account data

When you create an account you will provide your name, email address, a password, your role (creator or influencer, brand, agency, talent manager, or production talent), and the profile information you choose to add. Passwords will be stored only as bcrypt hashes, never in plaintext.

Instagram and social connection

This is the most important future data flow, so we describe it in full. When the product launches, creators will be able to connect their own Instagram account (and, later, TikTok) through the platform's official OAuth flow. Access will be granted by you on Instagram and Meta's own consent screen, and only for the scopes shown there.

With your explicit authorization, Lumienzo will use the Meta Graph API and Instagram API to read insights from your professional or business account, including:

follower count;
reach and average views;
engagement rate;
audience demographics (age, gender, and top locations); and
public comment and caption text, used to gauge audience buying intent.

We will request read-only access to these insights. We cannot post, comment, modify, or delete anything on your Instagram account.

The purpose is narrow: to give brands verified audience data instead of guesswork, shown back to you as a creator. We will use this data only to provide and improve the Lumienzo service to you, and never beyond the scopes you grant. Specifically:

We do not sell this data, and we will not license it or share it with data brokers or ad networks.
We do not use it to train external or third-party AI models, and we will not use it to build competing datasets.
Access tokens will be stored encrypted, will never be returned in API responses, and will never be logged in plaintext.
Our use of Instagram and Meta data will comply with the Meta Platform Terms and Developer Policies.

You stay in control. You will be able to revoke access at any time from your Instagram or Facebook settings, or by disconnecting your account inside Lumienzo. Disconnecting will stop further data collection, and you will be able to ask us to delete the Instagram data we have already ingested by disconnecting in-app or emailing [email protected]. We will confirm when deletion is complete.

Campaign data

Using Lumi to run campaigns will involve briefs, budgets, creator and brand matches, negotiation history, deliverables, contracts, and payout records.

Payment data

Payments and escrow will be handled by Stripe, a regulated third-party payment processor. Brand funds will be held in escrow with the processor, not by Lumienzo directly, and Lumienzo will never see full card numbers. Stripe is PCI DSS compliant and will return only tokens and metadata to us. Funds will release when the brand approves the work, or automatically after a 24-hour review window.

Communications and product usage

We will process the messages you send us or exchange through the platform, and basic product usage information needed to operate, secure and improve the Service.

How we use information

Where the GDPR or UK GDPR applies, we rely on these lawful bases:

Consent for sending you waitlist and marketing emails. You can withdraw consent at any time, and unsubscribing is as easy as subscribing.
Contract to provide the Service once you have an account, including matching, negotiation, contracts and payouts.
Legitimate interests to keep the website and product secure and available, to prevent abuse, and to understand how the Service is used (server logs today, and product usage later), balanced against your rights.
Legal obligation to meet tax, accounting and other legal requirements.

We do not sell your personal information, and we do not use your data to train external AI models.

Cookies and tracking

Today we set no analytics or advertising cookies, and we do no cross-site tracking. The website uses only strictly-necessary technical state, if any. Because we set no non-essential cookies, no consent banner is required at this stage. If we later add privacy-friendly analytics or any non-essential cookies, we will update this policy and, where required, ask for your consent before turning them on.

Who we share information with

We share personal information only with the service providers we need to run the Service, and with campaign counterparties once the product launches. Our providers act on our instructions under contracts that require them to protect your data.

Today:

Buttondown: waitlist and newsletter email.
Netlify: website hosting and content delivery.
Unsplash: decorative image content delivery.

At launch, we will add:

Google Cloud (Google LLC and Google Ireland): application hosting, database, and storage.
Stripe: payments and escrow.
Campaign counterparties: creators will see brand names and the briefs they accept, and brands will see creator handles, rates, and verified audience data. Brands never see street-level creator addresses, because shipping is masked.

We do not sell or rent your personal information to anyone.

International data transfers

Lumienzo is a US company, and some of the people and service providers who help us operate the Service may be located in other countries. Our product infrastructure at launch will run on Google Cloud. This means personal data may be transferred across borders, including out of the European Economic Area and the United Kingdom. Where those transfers happen, we rely on appropriate safeguards, including the EU Standard Contractual Clauses and the UK International Data Transfer Agreement or Addendum, together with a transfer risk assessment.

How long we keep data

Waitlist emails: kept until you unsubscribe or ask us to delete them, whichever comes first.
Server logs: retained only for a limited period for security and operational purposes.
Account and campaign data (once the product launches): kept while your account is active, plus a limited period afterward to meet legal, tax and audit obligations.

You can ask us to delete your data at any time by emailing [email protected]. We will honor the request, except for records we are legally required to keep.

Your rights

Depending on where you live, you have rights over your personal information.

Under the GDPR and UK GDPR, these include the rights to access, rectification, erasure, restriction, data portability, and objection, the right to withdraw consent at any time, and the right to lodge a complaint with a supervisory authority.

Under the CCPA and CPRA, California residents have the rights to know, delete, and correct their personal information, to opt out of the sale or sharing of personal information, and to non-discrimination for exercising these rights. We do not sell or share your personal information as those terms are defined, so there is nothing to opt out of, but you can still contact us with any request.

To exercise any right, email [email protected] with the subject "Privacy Request", and we will respond within the timeframes the law allows.

Children

The Service is not intended for anyone under 18, and we do not knowingly collect personal information from children.

Security

We take security seriously and hold as little data as we can. You can read about the specific measures we operate on our security page. To report a vulnerability, email [email protected].

Changes to this policy

As the product develops, this policy will change, especially before accounts, payments and social connections go live. When we make material changes we will update the effective date at the top of this page, and where we can reach you (for example, by email) we will let you know. Where the law requires fresh consent, we will ask for it before the new processing begins.

Contact us

Lumienzo, Inc.

2093 Philadelphia Pike #7740, Claymont, DE 19703, USA

[email protected]