Privacy Policy

1. Information We Collect

2. Cookies and Tracking Technologies

We use cookies and similar technologies to operate the Service:

Essential Cookies: Required for the Service to function, including maintaining your login session and preferences.

Analytics Cookies (optional): We use Google Analytics to understand how visitors use our website. These are only set after you accept analytics cookies. You can also opt out of Google Analytics at tools.google.com/dlpage/gaoptout.

Advertising Cookies (optional): We use Google Ads and the Meta pixel to measure our own advertising campaigns. These are only set after you accept advertising cookies.

You can change your choices at any time. Our Cookie Policy explains each category and how to withdraw consent.

3. How We Use Your Information

We use your information to:

• Provide, maintain, and improve the Service
• Create and manage your account
• Deliver the features and analysis you requested
• Communicate with you about the Service, including service notifications and updates
• Ensure the security of the Service and prevent abuse
• Comply with legal obligations

We may use automated tools to assist in processing and analyzing data accessed through the Service, solely for the purpose of delivering our services to you.

4. How We Share Your Information

We do not sell your personal information. We share information only in the following circumstances:

Service Providers: We share information with service providers who perform services on our behalf: hosting and database (DigitalOcean, Supabase), email delivery, and AI model providers (such as Anthropic and OpenAI) that process data under no-training-on-customer-data terms. We require these providers to handle your information appropriately and in accordance with applicable law.

Legal Obligations: We may disclose information to comply with applicable laws, regulations, or legal processes, or to respond to lawful requests from government authorities.

Business Transfers: If we are involved in a merger, acquisition, or sale of assets, your information may be transferred as part of that transaction. We will provide notice before your information becomes subject to a different privacy policy.

With Your Consent: We may share information for other purposes with your explicit consent.

5. Platform API Services

Google user data

Clients connect their Google account from the Connections page of their private client portal ({client}.lumensingularity.com). We only ask for the platforms we work on for you, and you see the exact permissions on Google's consent screen before granting them.

What we access and why:

• Google Analytics (read-only): traffic reports such as daily sessions by source, medium and campaign, and key events. We show this in your portal dashboard (for example organic traffic and traffic from AI assistants) and use it in the reports we prepare for you.
• Google Tag Manager (read-only): your accounts, containers and container configuration (tags, triggers, versions). We use this to link the right container and to audit your conversion tracking. We never edit or publish containers.
• Google Search Console (read-only): search performance (queries, pages, clicks, impressions), sitemaps and URL inspection results, shown in your dashboard and used in SEO reporting and audits.
• Google Ads: campaign structure, settings and performance (spend, clicks, conversions, search terms), shown in your dashboard and used to report on and manage the campaigns you engaged us for.
• Your Google email address: to show which Google account is connected.

How we store it: Access tokens are stored encrypted and are only used by our servers. Report data we sync from Google (for example daily Analytics and Search Console figures) is stored in our database, isolated per client, so your dashboard loads quickly. Only you and our team can see it.

Who we share it with: We do not sell Google user data. It is only processed by the service providers listed in Section 4, including AI model providers that help us analyse your data for you, solely to provide the Service and never to train their models.

Revoking access and deletion: You can disconnect Google at any time from the Connections page in your portal, or from your Google Account permissions. We then stop accessing your Google data immediately. We delete the Google data we stored on your request, or within 30 days after our engagement ends.

Our use and transfer of information received from Google APIs adheres to the Google API Services User Data Policy, including the Limited Use requirements. This means:

• We use Google user data only to provide and improve the user-facing features of our Service: your dashboard, reports, audits and the marketing work you engaged us for
• We do not use Google user data for serving advertisements, including retargeting or interest-based advertising
• Our team only reads your Google data to deliver the work you engaged us for (which you agree to when connecting), when necessary for security, or when required by law
• We do not transfer Google user data to third parties except as necessary to provide the Service, as required by law, or with your explicit consent
• We do not use Google user data to develop, improve, or train generalized AI or machine learning models

LinkedIn and Meta

Our Service also uses the LinkedIn Marketing API to access advertising data from LinkedIn Ads accounts you administer. Our use of information received from LinkedIn APIs adheres to the LinkedIn Marketing API Terms. This means:

• We use LinkedIn data only to deliver the reporting and campaign management features you have requested
• We do not sell LinkedIn data, and we do not share it with third parties except as necessary to provide the Service or as required by law
• We do not use LinkedIn data to develop, improve, or train generalized AI or machine learning models
• You may revoke our access at any time through your LinkedIn settings, and we will delete LinkedIn data on disconnection or on request

Our Service also uses the Meta Marketing API to access advertising data from the Meta (Facebook and Instagram) ad accounts and datasets you share with our business portfolio, such as campaign settings and results, and pixel and dataset settings and quality. Our use of information received from Meta adheres to the Meta Platform Terms. This means:

• We use Meta data only to deliver the reporting and campaign setup review features you have requested
• We do not sell Meta data, and we do not share it with third parties except as necessary to provide the Service or as required by law
• We do not use Meta data to develop, improve, or train generalized AI or machine learning models
• You may revoke our access at any time by removing our partner access in your Meta Business Settings, and we will delete Meta data on disconnection or on request

6. Data Retention

Account Information: We retain your account information for as long as your account is active. If you request account deletion, we will delete your information as soon as reasonably practicable, except where we are required by law to retain it.

Connected Account Data: Data we sync from connected platforms is kept while our engagement is active. When you disconnect, we stop accessing the platform immediately. We delete the stored data on your request, or within 30 days after our engagement ends.

Aggregated Data: We may retain anonymized, aggregated data for analytics purposes. This data cannot be used to identify individuals.

7. Data Security

We implement appropriate technical and organizational security measures to protect your information against unauthorized access, alteration, disclosure, or destruction. However, no method of transmission over the internet is 100% secure, and we cannot guarantee absolute security.

If we become aware of a data breach that affects your personal information, we will notify you and relevant authorities as required by applicable law.

8. Your Data Protection Rights

Under the General Data Protection Regulation (GDPR) and applicable data protection laws, you have the right to:

• Access the personal information we hold about you
• Rectify inaccurate or incomplete personal information
• Erase your personal information in certain circumstances
• Restrict processing of your personal information
• Port your personal information in a structured, machine-readable format
• Object to processing of your personal information
• Withdraw consent at any time, where processing is based on consent

To exercise any of these rights, contact us at [email protected]. We will respond within 30 days.

You also have the right to lodge a complaint with a supervisory authority. In Spain, the relevant authority is the Agencia Española de Protección de Datos (AEPD).

9. International Data Transfers

Lumen Singularity is based in Spain. We process data primarily within the European Economic Area (EEA). When data is transferred outside the EEA, we ensure appropriate safeguards are in place as required by applicable law.

10. Children's Privacy

The Service is not directed to children under 16. We do not knowingly collect personal information from children under 16. If you believe we have collected such information, please contact us at [email protected].

11. Changes to This Privacy Policy

We may update this Privacy Policy from time to time. We will notify you of material changes by posting the updated policy on our website and updating the effective date. Your continued use of the Service after changes are posted constitutes your acceptance of the updated policy.

12. Contact Us

If you have any questions about this Privacy Policy or our data practices, contact us at [email protected].