Privacy Policy

Effective Date: 1 January 2025
Last Updated: 30 August 2025

This Privacy Policy explains how Lumy, owned and operated by Asaya Labs AB (“we,” “our,” or “us”), collects, uses, shares, and protects your personal data when you use our services, including our Slack application, web app, and related services (the “Service”).

We are committed to protecting your privacy and handling your information in a transparent, fair, and lawful way in accordance with applicable data protection laws, including the EU General Data Protection Regulation (“GDPR”).


1. Data We Collect

We collect the following categories of information:

a. Account & Workspace Information

  • Slack team ID, workspace name, and installation details (including bot tokens).

  • Slack user ID, name, display name, email address, title, and avatar.

  • Role within Lumy (admin or member).

b. Feedback & Usage Data

  • Feedback requests and submissions (content, sentiment, skill references).

  • Metadata such as timestamps, request/response IDs, and activity logs.

  • Interaction data with Lumy in Slack (messages, actions, commands).

c. Technical Data

  • Log data, including IP address, browser type, and operating system.

  • Usage statistics to monitor performance and improve the Service.

d. AI Processing

  • When you submit or request feedback, we may send content (including text you write) to AI providers (e.g., OpenAI) for analysis, sentiment detection, and message generation.


2. How We Use Your Data

We process your personal data to:

  • Provide and operate the Service.

  • Facilitate giving and receiving feedback.

  • Analyze and improve team engagement and performance.

  • Send nudges, reminders, and personalized AI-powered suggestions.

  • Maintain security, monitor performance, and prevent abuse.

  • Comply with legal obligations.

  • Send you product updates, news, and promotional communications about Lumy. If you are a customer, we may use your email under our legitimate interest to keep you informed about similar products and services. If you are not a customer, we will only send you marketing if you have given your consent (e.g., by signing up to our waitlist or newsletter). You can opt out of marketing emails at any time by clicking “unsubscribe” in the email or contacting us at privacy@asayalabs.com.


3. Legal Basis for Processing

We process your data based on:

  • Contractual necessity: To provide the Service to your organization.

  • Legitimate interests: To improve Lumy and ensure security.

  • Consent: For optional AI features, email notifications, or other non-essential processing.


4. Sharing of Data

We do not sell your personal data. We may share information with:

  • Service providers such as Railway (hosting), Slack (integration), OpenAI (AI processing), analytics providers, and email delivery services.

  • Your organization’s administrators who control access to the Lumy account.

  • Legal authorities, when required to comply with applicable law or enforce our rights.

Where data is transferred outside the EU/EEA, we ensure appropriate safeguards (e.g., Standard Contractual Clauses or EU-based hosting where possible).


5. Data Retention

  • We retain personal data as long as your account is active or as necessary to provide the Service.

  • Feedback content and related data are retained until deleted by your organization or upon termination of the Service.

  • Log data is kept for shorter periods (typically up to 12 months) for troubleshooting and security.


6. Security

We implement appropriate technical and organizational measures to protect your personal data, including:

  • Encryption in transit and at rest.

  • Role-based access controls.

  • Pseudonymization and anonymization where possible.

  • Regular audits and monitoring of systems.


7. Your Rights

You have the following rights under GDPR:

  • Access, correction, or deletion of your data.

  • Restriction or objection to certain processing.

  • Data portability.

  • Withdrawal of consent (where processing is based on consent).

Requests can be made by contacting us at privacy@asayalabs.com.


8. Cookies & Tracking

Lumy primarily operates in Slack, but our website and dashboard may use essential and analytics cookies. You can manage cookies through your browser settings.


9. Children’s Privacy

Our Service is not intended for individuals under 16. We do not knowingly collect data from children.


10. Contact Information

The data controller is:

Asaya Labs AB
(owner and operator of Lumy)
Rävekärrsgatan 109,
431 33 Mölndal
Sweden
Email: privacy@getlumy.app


11. Changes to this Policy

We may update this Privacy Policy from time to time. Material changes will be notified via email, Slack, or through the Service.