Privacy Policy

1. Who we are

Lumeops Ltd ("we", "us", "our") is a web and software studio. We provide branding, websites, custom software, search marketing and automation to businesses in the United Kingdom. We operate lumeops.com along with the client portal and admin tools hosted on it.

We are the data controller for the personal data described in this policy.

Lumeops Ltd, registered in England & Wales, company number 17297362. Registered office: 71-75 Shelton Street, Covent Garden, London WC2H 9JQ. We work from Blackburn, Lancashire and serve clients UK-wide.

We comply with the UK General Data Protection Regulation (UK GDPR), the Data Protection Act 2018 and the Privacy and Electronic Communications Regulations (PECR). For any privacy question, contact [email protected].

2. Who this policy covers

Different sections apply to you depending on how we came to hold your data. We hold personal data about four groups:

• Clients and the people who work for them.
• People who contact us through the site, by email, by phone or by booking a call.
• Website visitors.
• Business contacts we approach directly, where we obtained your details from public sources rather than from you. Section 4 explains this, and section 6 explains how to stop it.

3. Data you give us

When you enquire

If you send us a project brief, request a free audit, use the package planner or book a call, we collect your name, email address, company name, and the details you choose to tell us. Some of our forms include an open text box: whatever you write there is stored with your enquiry, so please do not include anything sensitive that we do not need.

When you become a client

We store the records needed to deliver and bill the work: contact details, project notes, work logs, messages you send us through the portal, invoices and payment records, photos you upload, and any credentials you choose to share with us. Credentials are encrypted at rest.

When you call or message us

Calls to our published number are forwarded to a mobile. If the call is not answered you can leave a voicemail, which is recorded and automatically transcribed so we can respond to it. SMS and WhatsApp messages you send us are stored in our shared inbox.

4. Data we collect from other sources

We approach businesses directly. If we have contacted you out of the blue, this section tells you where your details came from, which UK GDPR Article 14 requires us to do.

What we hold

A business name, a business email address or phone number, a town or city, a trade or category, sometimes a named contact, and our own notes about what we observed on your website or online listings.

Where it came from

• Publicly listed business information, including Google Maps and Google Business Profile listings.
• Your own website and its published contact details.
• Public business directories.
• The Companies House public register, including publicly filed company and officer information.
• Publicly visible professional profiles, such as LinkedIn.

We do not buy marketing lists, and we do not collect special category data about anyone.

Our legal basis, in plain terms

We rely on legitimate interests: contacting UK businesses about services that are plausibly relevant to them. We have weighed that against your rights, and we limit it by keeping the volume low, contacting business addresses rather than personal ones, offering an opt-out in every message, and stopping permanently the first time you ask. You can object at any time and we will stop. See section 6.

5. What we use data for, and our legal basis

We do not sell personal data, and we do not use it for automated decisions that produce legal or similarly significant effects about you.

6. Marketing, and how to make it stop

You have an absolute right to object to direct marketing. You do not have to give a reason, and we have to stop.

You can do any of the following, and all of them work:

• Reply to any email from us with "unsubscribe", "stop", "no thanks" or anything to that effect.
• Tell us on the phone.
• Email [email protected] from any address.

When you opt out we add your address to a suppression list and mark your record as do not contact. We keep that minimal record - your email address, the date, and the fact that you objected - indefinitely, because deleting it is how people get contacted again by mistake. That is the only reason we keep it, and we do not use it for anything else. If you would rather we erased the record entirely, tell us and we will, but we will then have no way of recognising you if your details reappear in a public source.

Service messages to existing clients, such as reports and invoices, are not marketing and continue for the life of the engagement.

7. Google user data

When you connect your Google account in the Lumeops client portal, you grant us access to specific data through Google APIs. We only request the minimum scopes needed for the features you have chosen. The scopes we may request, and why, are:

• Your email address (userinfo.email) - to identify which Google account you connected and link it to your portal account.
• Google Search Console, read-only (webmasters.readonly) - to display your search impressions, clicks and ranking queries inside your portal.
• Google Analytics, read-only (analytics.readonly) - to display your website traffic and conversion metrics inside your portal.
• Google Business Profile (business.manage) - to read your profile insights, rating and reviews and display them in your portal, and to post replies to your reviews on your behalf when you ask us to.

How we store and protect Google data

Google OAuth tokens are encrypted at rest using AES-256-GCM and stored on our own secured infrastructure. We use this access solely to power the features above inside your portal and to perform the optimisation work you have requested. You can disconnect your Google account at any time from the Integrations section of your portal, or by visiting your Google Account permissions page. When you disconnect, we revoke the tokens and stop accessing your Google data.

Limited Use disclosure

Lumeops' use and transfer of information received from Google APIs to any other app will adhere to the Google API Services User Data Policy, including the Limited Use requirements. Specifically, we do not use Google user data for advertising, we do not sell it, we do not transfer it to third parties except as needed to provide or improve the features you requested, to comply with law, or as part of a merger or acquisition, and we do not allow humans to read this data unless we have your consent for specific support, we are required to by law, or it is necessary for security or to comply with our terms.

Data obtained through Google APIs is never sent to the AI service described in section 8, and is never used to generate outreach.

8. AI and automated processing

We use a third-party large language model service (OpenCode Zen) for two things:

• Drafting outreach emails. A business name, town, trade and our own notes about your public online presence may be sent to the model to draft a message.
• Summarising client portal data. Performance figures and enquiry data may be sent to the model to generate written insights and suggested next actions inside the portal.

Outreach emails are drafted and sent automatically. In normal running, a person does not read each individual message before it goes out. We set the targeting, the approach and the limits, we can and do inspect what is being sent, and we remain fully responsible for every message - but the drafting and the sending are automated.

Neither feature makes a decision that has a legal effect on you or similarly significantly affects you. Nothing here decides whether you get a service, a price or a credit outcome. If the model is unavailable the system falls back to fixed wording rather than inventing something. Google account data is excluded entirely, as stated in section 7.

If we have written something about your business that is wrong, tell us and we will correct it. If you would rather we did not process your data this way at all, say so and we will stop, which for outreach means the opt-out in section 6.

9. Who we share data with

We do not sell personal data. We share it with the service providers we rely on to operate, each bound by contract to protect it and to process it only on our instructions:

• Google - Business Profile, Search Console, Analytics and OAuth.
• Cloudflare - website delivery, security and analytics loading.
• Zoho - our business and outreach mailboxes.
• Twilio - phone, SMS, WhatsApp, voicemail recording and transcription.
• Cal.com - call booking.
• Stripe - card payments. We never see or store your full card details.
• OpenCode Zen - the AI service described in section 8.
• Serper - search results data used to produce audits and rank reports.

We also share data with our accountants and professional advisers, and with authorities where we are legally required to. If we ever sell or restructure the business, records may transfer as part of that, and you would be told.

10. Where your data goes

Our own servers and databases are in the United Kingdom. Some of the providers in section 9 are based in, or process data in, the United States and elsewhere.

Where personal data leaves the UK, we rely on the UK Government's adequacy regulations where they apply, and otherwise on the International Data Transfer Agreement or the UK Addendum to the EU Standard Contractual Clauses, together with the safeguards each provider has in place. You can ask us for details of the safeguards covering any specific transfer by emailing [email protected].

11. How long we keep data

12. Security

We use encryption in transit (HTTPS) and encryption at rest for credentials and OAuth tokens, role-based access controls on our admin tools, and regular review of our systems. Access to client data is limited to the two founders and any team member who needs it to do the work. No method of transmission or storage is completely secure, but we take reasonable steps to protect your data and we will tell you and the ICO about a breach where the law requires it.

13. Your rights

Under UK GDPR you have the right to:

• Ask what personal data we hold about you, and get a copy.
• Have inaccurate data corrected.
• Have your data deleted.
• Restrict or object to how we use it, including an absolute right to object to direct marketing (section 6).
• Receive your data in a portable format.
• Withdraw consent at any time, where we relied on consent.

Email [email protected] and we will respond within one month. There is no charge. You do not need to use a particular form of words, and asking will never affect how we treat you.

If you are unhappy with how we have handled your data you can complain to the UK Information Commissioner's Office at ico.org.uk or on 0303 123 1113. We would rather you told us first so we can put it right.

14. Cookies and analytics

We use essential cookies to operate the site and portal, for example to keep you signed in and to protect forms from abuse. These cannot be turned off without breaking the portal.

We would also like to use Google Analytics 4, loaded through Cloudflare Zaraz, to understand how the site is used: pages viewed, approximate location derived from IP address, device and browser type, and referring source. We look at this in aggregate. We do not use it to build advertising profiles, we do not run advertising pixels, and we do not track you across other websites.

Analytics does not run until you say yes. The first time you visit we ask, and nothing non-essential loads while you are deciding or if you decline. Refusing takes one click, in the same place as accepting, and refusing does not limit anything you can do on the site.

You can change your mind at any time using the Cookie settings link in the footer of any page. We ask again after six months. You can also block cookies in your browser settings, or opt out of Google Analytics everywhere using Google's opt-out browser add-on.

15. Children

Our services are sold to businesses and are not directed at anyone under 16. We do not knowingly collect data from children. If you believe we have, tell us and we will delete it.

16. Changes to this policy

We update this policy when what we do changes. The "last updated" date at the top always reflects the current version, and we will tell clients directly about material changes.

17. Contact us

For any privacy question, request or complaint:
Lumeops Ltd
Email: [email protected]
71-75 Shelton Street, Covent Garden, London WC2H 9JQ, United Kingdom
Company number 17297362