Privacy Notice
Last updated: October 6, 2026
This Luminos Inc. (“Luminos”, “we”, or “us”) Privacy Notice explains how we collect, use, share, and protect personal data when you: (1) visit or interact with Luminos public websites, marketing pages, blogs, and online resources that link to this Notice (collectively, the “Sites”), and (2) register for, access, or use our AI evaluation platform, APIs, developer tools, and associated cloud applications (the “Services”).
We are committed to safeguarding your personal data, applying robust encryption at rest and in transit, and respecting your privacy choices across all jurisdictions. Depending on where you reside, you may have statutory rights to opt out of the sale or sharing of your personal data for targeted advertising, restrict data processing, or manage cookie categories.
You can use the interactive privacy control panel to opt out of targeted advertising or customize cookie preferences for your jurisdiction at any time.
Your Privacy Choices
Under California (CPRA/CCPA) and other state privacy laws, you have the right to opt out of the sale or sharing of your personal information for targeted advertising.
1. Our Roles: Data Controller vs. Data Processor
Data protection laws distinguish between a “controller” (who determines the purposes and means of processing) and a “processor” or “service provider” (who processes data on behalf of a controller). Luminos acts in both capacities depending on the context:
- Luminos as a Data Controller: We act as a data controller for personal data collected through our Sites, our marketing and advertising initiatives, our customer relationship management (CRM) systems, and for the administration of customer accounts (such as user credentials, contact details, developer API tokens, and billing records).
- Luminos as a Data Processor: When our Customers use our Services to build, test, and run AI evaluations, they may submit or connect datasets, prompt suites, model completions, logs, or benchmark inputs (“Customer Evaluation Data”) that contain personal data. In that context, our Customer is the data controller, and Luminos acts as a data processor (or service provider). We process Customer Evaluation Data strictly pursuant to the Customer’s instructions, our Software Terms and Conditions (or enterprise agreement), and applicable Data Processing Addenda (DPAs).
2. Personal Data We Collect
The categories of personal data we collect depend on how you interact with our Sites and Services:
A. Account & Profile Information
When you create an account, register for a free tier, or sign in to our Services, we collect your name, business email address, job title, company name, phone number, password, and account preferences. If you authenticate using a third-party single sign-on (SSO) or identity provider, we receive authentication tokens and basic profile details authorized by your provider.
B. Billing & Transaction Information
For paid subscriptions, capacity upgrades, or self-service usage tiers, billing transactions and metered usage are managed through our third-party payment processing and billing infrastructure partners (which are certified under PCI-DSS Level 1 standards). We collect billing contact details, company tax identifiers, and transaction history. Payment card numbers, expiration dates, and security codes are transmitted directly to our PCI-DSS compliant payment processors; Luminos does not store raw credit card numbers on our servers.
C. Device, Technical & Usage Telemetry
When you visit our Sites or interact with our Services, we automatically log technical data, including your IP address, browser type and version, device hardware specifications, operating system, referring URLs, pages visited, time spent, interaction timestamps, developer API key usage, API request volumes, error logs, and client SDK/CLI diagnostic telemetry.
D. Customer Success, Communications & CRM Records
When you submit a contact form, schedule a product demo, attend a webinar, engage with our customer success team, request customer support, or participate in surveys, we collect the contents of your messages and record your professional interests, onboarding notes, and interaction history within our Customer Relationship Management (CRM) platform.
E. Inferred & Partner-Enriched Professional Information
To better understand our commercial audience and deliver relevant B2B communications, we may receive commercially available professional and firmographic data from third-party business partners, lead intelligence services, identity resolution providers, and advertising networks. This may include company size, industry classification, derived professional attributes, and commercial identifiers associated with corporate IP ranges or digital ad network profiles.
3. How We Collect Personal Data
We collect personal data through three principal channels:
- Direct Interactions: Data you provide directly when registering for an account, purchasing capacity, submitting web forms, issuing API calls, booking demos, or communicating with our team.
- Automated Technologies & Cookies: Automated tracking technologies deployed across our Sites and web applications, such as cookies, web beacons, server logs, and analytics scripts (see Section 6 for details on cookie consent).
- Third Parties & Business Partners: Data provided by commercial data partners, advertising networks, identity resolution services, and public corporate registries, as well as enterprise administrators provisioning access on your behalf.
4. How We Use Personal Data
We use personal data for the following legitimate business and commercial purposes:
- Service Delivery: To create and manage accounts, authenticate users, execute requested AI evaluations, generate evaluation benchmark reports, and provide technical platform access;
- Billing & Capacity Management: To meter API consumption, process subscription payments, calculate invoices, and manage self-service account quotas;
- Customer Success & Support: To onboard users, facilitate customer adoption, provide proactive customer success guidance, deliver technical and product support, troubleshoot operational issues, maintain CRM records, and send service-critical notifications (such as security notices and system updates);
- Product Quality & Security: To monitor platform reliability, assess site usability, detect and prevent fraudulent or abusive activity, and maintain system integrity;
- Marketing & Targeted Advertising: To analyze prospective customer interest, serve targeted B2B advertisements across standard ad networks, assess marketing campaign efficacy, and communicate product releases and features;
- Legal & Compliance: To comply with statutory tax, financial, and regulatory obligations, resolve disputes, enforce our terms, and protect the legal rights, safety, and property of Luminos and our users.
5. Data Security & Encryption Standards
We implement comprehensive organizational, technical, and administrative safeguards designed to protect personal data from accidental loss, unauthorized access, misuse, alteration, or disclosure:
All business data and customer data in our systems is encrypted in transit using modern cryptographic protocols (TLS 1.3 / 1.2) and encrypted at rest across all production storage volumes and databases using industry-standard AES-256 encryption.
Access to production environments is strictly restricted to authorized personnel under principles of least privilege, authenticated via multi-factor authentication (MFA), and subjected to automated continuous logging and vulnerability scanning.
6. Cookies, Digital Advertising & Identity Resolution
We use cookies, web beacons, pixels, and server-side tracking technologies to analyze site usage and deliver tailored marketing.
A. Website & Application Cookie Consent
We maintain cookie and privacy consent controls across both our public Sites and our web applications. To modify your settings for both the applications and sites, visit https://www.luminos.ai/privacy.
In jurisdictions requiring prior opt-in consent (such as the European Union, United Kingdom, and EEA), non-essential analytics, targeting, and advertising cookies are blocked by default until you grant consent. In jurisdictions operating on an opt-out basis (such as the United States), cookies deploy by default, and you may opt out at any time using our on-page privacy toggle or by enabling Global Privacy Control (GPC) signals in your browser.
B. Advertising Networks & Identity Resolution
We partner with third-party digital advertising networks and commercial identity resolution providers to evaluate visitor engagement and present relevant B2B advertising across third-party websites. These partners may utilize tracking pixels, cookie identifiers, and device association techniques to connect online browsing signals with verified professional profiles or ad network identifiers.
This helps us identify which business organizations are interested in AI evaluation solutions and deliver appropriate marketing communications. You can restrict or opt out of these audience-matching and targeted advertising activities at any time through our interactive Privacy Choices widget on this page.
7. How We Share Personal Data
Luminos does not sell personal data for monetary consideration. We share personal data only in the following limited circumstances:
- Third-Party Cloud & Infrastructure Providers: We engage trusted cloud infrastructure, server hosting, and network delivery providers to store data, execute compute workloads, and maintain high-availability systems.
- Payment & Billing Processors: We share billing identifiers and transaction data with third-party payment processing and billing infrastructure partners (which are certified under PCI-DSS Level 1 standards) to securely process card payments, calculate usage tiers, and generate invoices.
- CRM, Customer Success & Operations Vendors: We share contact, usage, and inquiry data with service providers that power our CRM, customer success management tools, help-desk, email delivery, and customer communications infrastructure.
- Analytics & Advertising Partners: We share web analytics, interaction metrics, and digital identifiers with third-party website analytics providers and digital advertising networks to analyze site traffic and deliver targeted campaigns.
- Corporate Transactions: In connection with any actual or contemplated merger, financing, acquisition, reorganization, or sale of company assets, personal data may be shared with acquiring entities and their legal advisors subject to standard confidentiality protections.
- Legal Compliance & Protection: We may disclose personal data if required by applicable law, regulation, subpoena, or valid legal process, or when necessary to protect the rights, property, and safety of Luminos, our customers, or the public.
8. Data Hosting, International Transfers & Adequate Jurisdictions
Luminos operates globally while adhering to strict territorial data handling standards:
US Production Infrastructure
All production servers, storage repositories, and database clusters where Customer Evaluation Data and active customer account records reside are located exclusively in the United States.
Authorized Personnel Access from Adequate Jurisdictions
We maintain an international engineering and customer support team. While our production systems reside in the United States, authorized Luminos personnel may access customer systems and support tickets remotely from locations outside the United States. All such personnel are located exclusively in countries recognized by the European Commission as providing an adequate level of data protection (under formal EU adequacy decisions), or operate subject to binding Standard Contractual Clauses (SCCs) and strict access logging.
9. Data Privacy Framework (DPF) Compliance
Luminos complies with the EU-U.S. Data Privacy Framework (“EU-U.S. DPF”), the UK Extension to the EU-U.S. DPF (“UK Extension”), and the Swiss-U.S. Data Privacy Framework (“Swiss-U.S. DPF”) (collectively, the “Data Privacy Framework” or “DPF”) as set forth by the U.S. Department of Commerce regarding the processing of personal data received from the European Union, the United Kingdom (and Gibraltar), and Switzerland in reliance on the DPF.
Luminos has certified to the U.S. Department of Commerce that it adheres to the DPF Principles with respect to such personal data. If there is any conflict between the terms in this privacy notice and the DPF Principles, the DPF Principles shall govern. To learn more about the Data Privacy Framework program and view Luminos’s certification, please visit https://www.dataprivacyframework.gov/.
Luminos conducts an annual self-assessment of its personal data processing practices to verify that the attestations and assertions Luminos makes about its DPF privacy practices are true and that Luminos’s privacy practices have been implemented as represented and in accordance with the DPF Principles.
In compliance with the Data Privacy Framework, Luminos commits to resolve complaints about its collection and use of personal information received in reliance on the DPF. EU, UK, and Swiss individuals with inquiries or complaints should first contact Luminos at privacy@luminos.ai with the subject “Data Privacy Framework”.
In compliance with the DPF, Luminos commits to refer unresolved complaints concerning our handling of personal data to JAMS, an alternative dispute resolution provider based in the United States. If you do not receive timely acknowledgment of your complaint, or if we have not addressed your complaint to your satisfaction, please visit https://www.jamsadr.com/DPF-Dispute-Resolution for more information or to file a complaint. The services of JAMS are provided at no cost to you. Under certain conditions, individuals may invoke binding arbitration through the Data Privacy Framework Panel.
Luminos remains responsible for personal data received under the DPF that is subsequently transferred to a third party acting as our agent. Luminos complies with the DPF Principles for all onward transfers, including the onward transfer liability provisions, unless Luminos proves that it is not responsible for the event giving rise to damage. The Federal Trade Commission has jurisdiction over Luminos’s compliance with the Data Privacy Framework.
10. Data Retention
We retain personal data only for as long as necessary to fulfill the purposes for which it was collected, including to provide the Services, satisfy legal, regulatory, tax, or accounting requirements, and resolve disputes:
- Customer Account & Profile Records: Retained for the duration of the active subscription or account relationship, plus a statutory period (typically up to 7 years) to maintain audit, financial, and tax records.
- Customer Evaluation Data: Processed and retained in accordance with the Customer’s active evaluation configuration, subscription tier, and DPA instructions. Customers may delete test datasets, prompts, and evaluation runs at any time through the platform interface.
- Marketing & CRM Contacts: Retained until the individual unsubscribes, opts out, or requests deletion, with periodic automated purging of stale or unengaged records.
11. Your Privacy Choices & Rights
We respect your autonomy over your personal data and provide clear mechanisms to exercise your rights:
Account Information Updates
You can correct, update, or modify your profile, organization details, and developer credentials at any time by logging into the Luminos console and visiting your account settings.
Opt Out of Promotional Communications
You may opt out of promotional emails by clicking the “unsubscribe” link in any marketing message or by emailing privacy@luminos.ai. Critical account notifications and security alerts will still be delivered.
To submit an access, deletion, correction, or portability request under applicable regional laws, email privacy@luminos.ai. We will verify your identity before executing statutory requests to ensure your account security.
12. Additional Information for Specific Jurisdictions
United States Privacy Disclosures (California, Virginia, Colorado, Connecticut, Utah, and Others)
If you are a resident of California (under the CCPA/CPRA) or other US states with comprehensive privacy legislation, you have specific rights regarding your personal information:
- Right to Know & Access: You may request the categories and specific pieces of personal information we have collected, sources of collection, business purposes, and categories of third parties with whom we share it;
- Right to Delete: You may request the deletion of personal information we maintain, subject to permitted statutory exceptions;
- Right to Correct: You may request that we correct inaccurate personal information;
- Right to Opt Out of Sale / Sharing: You have the right to opt out of the “sale” or “sharing” of personal information for cross-context behavioral advertising (targeted advertising). We do not sell personal information for money. You can exercise this right via our on-page privacy toggle or by enabling Global Privacy Control (GPC);
- Right to Non-Discrimination: We will not discriminate against you in pricing, service quality, or access for exercising your statutory privacy rights.
European Economic Area (EEA), United Kingdom, and Switzerland
For individuals in the EEA, UK, and Switzerland, our processing of your personal data is governed by the GDPR, UK GDPR, and Swiss FADP. We process personal data under the following legal bases:
- Performance of a Contract: To provide our Services, process transactions, and support our contractual agreements with you;
- Legitimate Interests: To operate and secure our platform, detect fraud, analyze system metrics, manage business relationships, and conduct B2B marketing, where our interests are not overridden by your data protection rights;
- Compliance with Legal Obligations: To satisfy tax, accounting, and regulatory compliance duties;
- Consent: Where you have granted explicit consent, such as opting into non-essential analytics and marketing cookies. You may withdraw consent at any time without affecting prior lawful processing.
You also have the right to lodge a complaint with your competent data protection supervisory authority.
13. Children’s Privacy
Our Sites and Services are commercial B2B offerings designed for businesses, developers, and professionals. We do not knowingly solicit or collect personal data from children under the age of 16. If you believe a child has provided us with personal data without parental consent, please contact us immediately at privacy@luminos.ai and we will take prompt steps to delete the information.
14. Changes to This Privacy Notice
We may update this Privacy Notice from time to time to reflect changes in our technologies, legal requirements, or operational practices. The revised version will be indicated by the “Last updated” date at the top of this page. We encourage you to review this Notice periodically to stay informed about our data handling practices.