Privacy Policy

Effective August 18, 2026 · Lumon8 LLC

This policy explains what Lumon8 LLC (“Lumon8,” “we”) collects, why, and the choices you have. It covers our website (lumon8.ai), the app (app.lumon8.ai), and the Lumon8 tag our customers install on their own websites. Plain-English summary up front: we collect business contact details from our customers, we collect very little about visitors to our customers’ websites (no cookies, no names, no addresses), and we do not sell or share personal information with anyone for advertising.

1. Information we collect from our customers

• Account details — name, work email, phone, role, company, and password or Google sign-in identifier when you create an account. If you opt in to SMS, the mobile number you provide and your consent record.
• Business data — the dealership names, addresses, websites, and markets you add to your account, plus the reports we generate about them. Much of this is public business information.
• Billing — handled by Stripe. We store your subscription status and Stripe customer reference; we never see or store card numbers.
• Product usage — pages viewed and features used inside the app (via PostHog analytics), and standard technical logs from our hosting provider.
• Email and SMS activity — whether report emails we send are delivered, bounced, or marked as spam (via Resend), and delivery status of text messages you opted in to (via Twilio). Every report email includes an unsubscribe link; reply STOP to any text to opt out.
• Approvals — when you approve or decline a proposed correction (in the app or by clicking an emailed link), we record what was approved, when, and from which contact, so we can show you an audit trail of changes made on your behalf.

2. What the Lumon8 tag collects on customer websites

Our customers (car dealerships and their agencies) can install a small script on their own websites. Besides measuring AI-driven traffic, the tag inserts structured data about the business into the page and delivers approved content updates; those functions publish information about the business and collect nothing about visitors. We process this data on the customer’s behalf as a service provider under our Data Processing Addendum. The tag’s measurement function is deliberately minimal. It collects:

• The page path visited (for example /inventory/used-toyota) and the referring site’s domain (for example chatgpt.com), used to attribute visits that came from AI assistants;
• The browser’s user-agent string, used to recognize visits by AI crawlers (bots, not people);
• A random session identifier that exists only in the visitor’s browser session storage and expires when the browser session ends.

The tag does not use cookies, does not collect names, email addresses, phone numbers, form contents, or account identifiers, does not store IP addresses, does not collect precise location, and does not track visitors across different websites. When a visitor submits a lead form or taps a phone number, we record only that a lead event happened on a given page — never the contents of the lead.

3. How we use information

• To provide the Service: run audits and scans, generate reports, attribute AI traffic, and send the reports you sign up for.
• To operate the business: billing, support, service emails, security, and abuse prevention.
• To improve the product, using aggregated or de-identified usage data.
• We do not sell personal information, and we do not share it for cross-context behavioral advertising.

4. AI engine queries, public reviews, and demand data

To measure visibility, we send queries about businesses and markets (for example, “best Toyota dealer near Claremont”) to third-party large language model providers. These queries describe businesses and geographies — they never include personal information about you or about visitors to customer websites. We store the responses (including quotations we show you as evidence) for a limited period.

To understand how AI systems describe your business, we also retrieve publicly available business information and reviews (for example from Google Business Profile) and aggregated data about questions people ask AI systems and how those systems answer from a licensed third-party data provider. Review content we use is already public; we may quote it with attribution and reviewer first name where the source displays one, and we never collect reviewer contact details. Demand data is aggregate and contains no personal information.

5. Service providers (subprocessors)

We engage service providers to run the Service — hosting, database, payments, email, SMS, analytics for our own app, error monitoring, and public business data. Every provider that processes personal data on our behalf is named on our Subprocessors page, along with what it does, which data it sees, and where the entity is located.

Each provider is bound by a written agreement and processes data only to provide its service to us. We will notify customers before adding or replacing a subprocessor — see section 3 of the Data Processing Addendum.

The large language model providers and licensed data providers described in section 4 are not subprocessors: what we send them contains no personal data.

6. Retention

Account data is kept while your account is active and deleted or de-identified within a commercially reasonable period after account closure, except where the law requires longer (for example, billing records). Tag data is retained as long as needed to provide reporting to the customer whose website it came from, and is deleted when that customer’s account closes. Stored AI responses used as evidence in reports are retained for approximately 90 days; aggregate, de-identified market data may be kept longer to show trends.

7. Security

Data is encrypted in transit, access to production systems is restricted and role-gated, tenant data is isolated per account with server-side ownership checks, and payment credentials never touch our servers. No system is perfectly secure; if a breach affects your data, we will notify you as required by law.

8. Your rights (including California)

Depending on where you live, you may have rights to access, correct, delete, or receive a copy of your personal information, and to opt out of sale or sharing (we do neither). California residents have these rights under the CCPA/CPRA. To exercise them, email hello@lumon8.ai — we will verify and respond within the time the law requires, and we will not discriminate against you for exercising your rights.

If you are a visitor to a dealership website that uses our tag, the dealership is the business responsible for that data; contact the dealership, and we will assist them with your request as their service provider. (As described above, tag data contains no name or contact information, so in most cases there is nothing identifiable to return.)

9. Children

The Service is for businesses and is not directed to anyone under 16. We do not knowingly collect personal information from children.

10. Changes

We will post updates here and, for material changes, notify account holders by email or in-app before they take effect.

11. Contact

Lumon8 LLC · hello@lumon8.ai