Privacy Policy

Last updated: 25 August 2026

1. Overview

This policy explains what happens to your personal data when you visit our websites or use our services. Personal data means any information that can identify you, such as your name, your email address or your IP address.

It applies to these LuminoSana websites:

• luminosana.com, including the customer account and dashboard
• support.luminosana.com
• hub.luminosana.com
• academy.luminosana.com and akademie.luminosana.com

Our shop has its own privacy policy, which you will find directly in the shop.

2. Controller

LuminoSana Ltd.
Terra Santa 1, Office No. 12
6012 Larnaca
Cyprus

Phone: +49 30 2239951608
Support page: support.luminosana.com

Controller means: this company decides how and for what purpose your personal data is processed. For any question about data protection, you can reach us through our support page at support.luminosana.com.

3. What we never do

Our websites run no analytics tools and no advertising trackers. We do not build user profiles, we make no automated individual decisions, and we do not sell your data.

4. Your rights

Under the General Data Protection Regulation (GDPR) you have the following rights:

• Access to the data we hold about you (Article 15 GDPR)
• Rectification of inaccurate data (Article 16 GDPR)
• Erasure (Article 17 GDPR)
• Restriction of processing (Article 18 GDPR)
• Data portability, meaning a copy of your data in a common format (Article 20 GDPR)
• Objection to processing based on our legitimate interest (Article 21 GDPR)
• Withdrawal of any consent you have given, at any time with effect for the future (Article 7(3) GDPR)
• Complaint to a data protection supervisory authority, for example where you live (Article 77 GDPR)

5. Encryption

All our websites use TLS encryption. You can recognise it by the padlock symbol in your browser and by the https address. Everything you send us is encrypted on its way.

6. Hosting and delivery

When you open a page, your browser automatically sends technical access data to the service that delivers it: your IP address, date and time, the page requested, your browser type and your operating system. These server logs keep the sites running and help us fend off attacks. The legal basis is our legitimate interest in secure and stable delivery (Article 6(1)(f) GDPR).

luminosana.com is delivered through Webflow. The provider is Webflow, Inc., San Francisco, USA. Pages, images and scripts come from Webflow and its delivery networks, and your access data may be transferred to the USA. For customer data, Webflow commits to a data processing agreement based on the EU Standard Contractual Clauses.

support.luminosana.com and hub.luminosana.com are delivered through Cloudflare. The provider is Cloudflare, Inc., San Francisco, USA, with a worldwide network of delivery locations, including in Europe. Cloudflare bases its data transfers on the EU-US Data Privacy Framework and on the EU Standard Contractual Clauses.

A few script files also load from the delivery networks of our technical service providers when a page opens. These providers receive your IP address in the process.

7. Chat and support assistant

On luminosana.com, our chat is available to you straight away. It loads with the page and stores one cookie plus two local entries in your browser. They recognise your chat session when you change pages or come back later. On support.luminosana.com, the chat only loads once you click the chat button.

The chat provider is CRISP IM SAS, 2 Boulevard de Launay, 44100 Nantes, France. According to the provider, Crisp stores chat data in Europe (Netherlands, Germany, Ireland). We have a data processing agreement with Crisp.

When you write in the chat, we process your details to answer your request. The legal basis is the performance or preparation of our contract with you (Article 6(1)(b) GDPR), and for general questions our legitimate interest in a working support channel (point (f)).

The first reply in the chat comes from Dennis, our automated support assistant. He runs on an external AI service. Your chat messages are passed to this service and answered automatically. A human takes over as soon as you wish, or whenever the assistant cannot help.

8. Review seal

On the content pages of luminosana.com we show our ProvenExpert review seal. It loads from the provider's server when the page opens. The provider then receives your IP address and the page you are visiting. The provider is Expert Systems AG, Quedlinburger Straße 1, 10589 Berlin, Germany. The legal basis is our legitimate interest in showing genuine customer reviews (Article 6(1)(f) GDPR).

9. Newsletter

Our newsletter runs on KlickTipp. The provider is Klick-Tipp Limited, 15 Cambridge Court, 210 Shepherd's Bush Road, London W6 7NJ, United Kingdom.

When you sign up, the form sends your details to KlickTipp. You then receive a confirmation email, and only your click on the confirmation link completes the sign-up. The legal basis is your consent (Article 6(1)(a) GDPR). You can unsubscribe from any issue with one click.

On the newsletter pages of hub.luminosana.com, a protection script from KlickTipp loads with the page. It shields the form against automated sign-ups, and KlickTipp receives your IP address in the process. In its own privacy policy, KlickTipp bases third-country transfers on adequacy decisions under Article 45 GDPR and names, among others, Amazon Web Services (EU) as a service provider for its operations.

10. Appointments and calls

When you book an appointment, a link takes you to Calendly. The provider is Calendly LLC, Atlanta, USA. Calendly processes your booking details in the USA and states that it is certified under the EU-US Data Privacy Framework. Calendly's own participant terms and privacy notices also apply to the booking.

Booked calls take place on Zoom. The provider is Zoom Communications, Inc., San Jose, USA. We record our calls and analyse them with AI. This protects both sides and helps us improve.

11. Customer account and dashboard

When you create a customer account or sign in, we process your details to provide your account, your products and your manuals. The legal basis is the performance of our contract with you (Article 6(1)(b) GDPR).

Account data is held in a database run by our database service provider in the USA. It operates on a large cloud platform with locations in the USA and the EU. ⬜ We are currently finalising the exact server location and the contractual basis with this provider and will update this section afterwards.

Emails about your account, for example for signing in or resetting your password, are sent for us by an email delivery provider in the USA. It receives your email address and the content of each message. It bases its data transfers on the EU-US Data Privacy Framework, the EU Standard Contractual Clauses and binding corporate rules.

12. Academy

Our academy at academy.luminosana.com and akademie.luminosana.com runs on the Mentortools platform. The provider is Mentortools AG, Hagenbuchstrasse 25, 9000 St. Gallen, Switzerland. When you use the academy, Mentortools processes your sign-in and usage data. Mentortools names Hetzner Online GmbH (Germany) as its hosting provider. ⬜ We are currently finalising the contractual basis with Mentortools and will update this section afterwards. The legal basis for the processing is the performance of our contract with you (Article 6(1)(b) GDPR).

14. External links

Our pages link to external services, for example our shop, Telegram or Zoom. A link on its own sends no data. Only once you follow it does the privacy policy of that provider apply.

15. How long we keep your data

We keep personal data only for as long as the purpose requires. Account data stays for as long as your account exists. Newsletter data stays until you unsubscribe. Where statutory retention periods apply, for example under tax or commercial law, we delete the data once those periods end.

16. Changes to this policy

We update this policy whenever our services or the legal situation change. The version published here is the one that applies.