Data Processing Addendum
Effective August 18, 2026 · Lumon8 LLC
This Data Processing Addendum (“DPA”) forms part of the Terms of Service between Lumon8 LLC (“Lumon8”) and the Customer, and applies whenever Lumon8 processes Website Visitor Data on the Customer’s behalf — primarily through the Lumon8 tag installed on the Customer’s (or its clients’) websites.
1. Roles
For Website Visitor Data, the Customer (or its client dealership) is the business / controller, and Lumon8 is the service provider / processor under the California Consumer Privacy Act as amended (CCPA/CPRA) and equivalent laws. For Customer account data (logins, billing, business records), Lumon8 acts as an independent business as described in its Privacy Policy.
2. Scope of processing
| Item | Description |
|---|---|
| Data processed | Page paths, referring domain, browser user-agent string, ephemeral session identifier, lead-event flags (occurrence only, never contents). No cookies, no names, no contact details, no stored IP addresses, no cross-site tracking. |
| Purpose | Measuring AI-crawler activity and attributing AI-referred visits and lead events for the website on which the tag is installed; producing reports for the Customer. |
| Duration | For the term of the Customer’s subscription plus a commercially reasonable deletion window. |
3. Lumon8’s commitments
Lumon8 will:
- Process Website Visitor Data only to provide the Service and as permitted for service providers by the CCPA — never sell it, never share it for cross-context behavioral advertising, and never combine it with data from other sources except to perform the Service;
- Limit access to personnel who need it and bind them to confidentiality;
- Maintain reasonable technical and organizational security measures (encryption in transit, per-tenant isolation with server-side ownership checks, restricted production access);
- Assist the Customer in responding to verified consumer rights requests relating to Website Visitor Data;
- Notify the Customer without undue delay of any breach affecting Website Visitor Data;
- Delete or de-identify Website Visitor Data on termination of the subscription, subject to legal retention requirements;
- Notify the Customer (via email or in-app notice) before adding or replacing subprocessors, and allow reasonable objection.
4. Subprocessors
Current subprocessors for Website Visitor Data: Supabase (database) and Vercel (hosting/ingest). AI engine providers do not receive Website Visitor Data.
The full list of subprocessors across the Service — what each processes and where the entity is located — is maintained at lumon8.ai/subprocessors.
5. Customer’s responsibilities
- Install the tag only on websites the Customer owns or is authorized to act for;
- Make the privacy disclosures required by applicable law on those websites;
- Use the reports in compliance with applicable law.
6. Audit and verification
Upon reasonable written request (no more than once per year), Lumon8 will provide information reasonably necessary to demonstrate compliance with this DPA.
7. Order of precedence
If this DPA conflicts with the Terms of Service, this DPA controls with respect to the processing of Website Visitor Data.
Contact
Lumon8 LLC · hello@lumon8.ai