This policy explains what data Lumii ("the app", available at thelumii.app and go.thelumii.app) collects, what it uses it for, who it shares it with and what rights you have. We wrote it in plain language: if anything is unclear, email us at mauricio@thelumii.app. The Spanish version of this policy is equally valid.
1. Who is responsible for your data
The controller of your personal data is C-Link International LLC (Tax ID 851132139), 1908 N 40th Ave, Hollywood, FL 33021, United States. You can contact us at mauricio@thelumii.app.
2. What Lumii is and why it reads emails
Lumii is a personal finance app. It lets you record your expenses and income, set budgets and savings goals, track your net worth and see statistics.
In most Latin American countries there is still no open-banking system that lets a personal finance app connect to your bank. Banks do, however, email you every time you pay, receive or transfer money. Lumii uses those emails: if you authorize it, it searches your Gmail only for notifications from the bank sender addresses you add and, with the help of artificial intelligence, turns them into organized transactions that you review and confirm. Connecting Gmail is optional: you can also record transactions manually.
3. What data we collect
Account data. If you sign in with Google, we receive your name, email address and profile picture. If you sign in with a one-time code sent to your email, we only receive your email address. We also store the country, currency and time zone you choose.
Data you enter. Categories, budgets, monthly income, transactions (merchant, amount, date, notes), savings goals, accounts and net-worth items. For your accounts and cards we only store a name, the bank, the type and, optionally, the last 4 digits. We will never ask for full card numbers, bank passwords or PINs.
Gmail data (only if you connect your account). With your authorization, the app:
- Searches only for emails sent by the bank sender addresses you add in Settings (for example, notifications from your bank or digital wallet). You can add words to exclude certain emails from those senders. It does not read the rest of your inbox.
- From each matching email it extracts the merchant, amount, currency, date, account and whether it is an expense or income. We store that result together with the email's subject, date and message ID, so you can review it and so it is never processed twice. We do not store the full text of the email.
- Checks those senders automatically once a day, and whenever you tap "Sync now", for as long as Gmail stays connected.
- Has read-only access: it does not send, delete or modify emails, and it does not change your Gmail settings.
Google describes this permission as "View your email messages and settings" because Gmail does not offer a narrower permission that allows reading an email's content. Lumii applies the restriction to your bank senders on every search.
Help messages and surveys. If you contact us through the in-app help button, we store your message, the page you were on and your browser type, so we can reply. If you answer the short in-app surveys (for example, the three questions shown before connecting Gmail: how clear Lumii is, whether you had already added your bank senders and whether you know how to continue past Google's warning), we store your answers and any comment you choose to leave, to improve the app. They are optional: you can skip them.
Technical data. Basic server logs (date, requested page, errors) to operate the app and detect abuse. On the sign-in screen we use a bot check (Cloudflare Turnstile) that analyzes technical signals from your browser. The cookies and browser storage we use are explained in our Cookie Policy. To improve the app, we internally measure how long each usage session lasts: while you have Lumii open, the app signals once a minute that you are still there, and we only store when each session starts and ends, without recording which pages you view or any financial data. We do not use advertising cookies or third-party tracking or analytics tools.
4. How we use your data
- To show you your finances: transactions, budgets, goals, net worth and statistics.
- To suggest transactions based on your bank notifications. Every imported transaction stays pending until you confirm or correct it.
- To generate, when you ask for it, a monthly report with recommendations.
- To send you emails about your account, for example a reminder to finish connecting Gmail if you haven't. You can stop receiving them with the link included in every email.
- To enforce your plan's limits (for example, how many automatic transactions or reports you have left this month).
- To keep the app secure and respond to your support requests.
We do not sell your data, use it for advertising or build profiles for third parties.
5. Use of Google user data
Lumii's use and transfer of information received from Google APIs to any other app will adhere to the Google API Services User Data Policy, including the Limited Use requirements. Specifically:
- We use Gmail data only to provide the feature you see and use: turning your bank notifications into transactions.
- We only transfer it to third parties when necessary to provide that feature (the AI provider, see section 6), to comply with the law, or as part of a merger or acquisition, with prior notice to you.
- We do not use it for advertising or credit assessment, and we do not sell it.
- No human reads your emails, unless you give us explicit permission for a specific support case, it is necessary for security purposes (for example, investigating abuse), or it is required by law.
- We do not use it to train or improve artificial intelligence models, whether our own or third parties'.
6. Who we share your data with
Only with the providers we need to run the app, and only what is necessary:
- Anthropic (provider of the Claude AI model). To extract a transaction we send it the sender, subject, date and text of the email, together with your name (to recognize transfers between your own accounts) and the names of your categories and accounts. For the monthly report we send a summary of your totals by category and your top merchants. Anthropic processes this information only to answer our request and, under its commercial terms, does not use it to train its models.
- Google, for sign-in and, if you authorize it, Gmail access.
- Supabase (database and authentication) and Vercel (app hosting), where your data is stored and processed securely.
- Resend, to email you your sign-in code and emails about your account.
- Cloudflare, for the bot check on the sign-in screen.
- Authorities, only when required by law or court order.
To display a merchant's logo, our server requests the image using the merchant's public domain (for example, rappi.com), without sending any of your data. Help videos are served from YouTube in privacy-enhanced mode and only load if you press play.
C-Link International LLC and most of these providers are located in the United States, so your data is transferred to and stored outside your country. We only make such transfers to providers that offer an adequate level of protection, and we apply the same safeguards described in this policy.
7. How long we keep your data
We keep your data while you have an account. You can delete your account at any time from Settings: we then revoke access to your Gmail and delete your data immediately; technical backups are deleted within 30 days at most, except for anything the law requires us to keep. Server logs are deleted automatically within 90 days at most.
You can disconnect Gmail at any time from Settings or from your Google Account permissions. When you disconnect it from Lumii, we revoke the permission with Google, delete the stored access and stop reading your emails. Transactions already imported are kept until you delete them.
8. How we protect your data
We use encrypted connections (HTTPS) and store your Gmail access token encrypted. Each user can only see their own data. We limit internal access to what is strictly necessary: no one on our team reviews your transactions or emails, except in the cases described in section 5. No system is infallible: if a security incident affecting your data occurs, we will notify you and report it to the authorities when applicable.
9. Your rights
Wherever you are, you can ask us at any time for:
- Access: to know what data we hold about you. You can also download it yourself from Settings ("Export my data").
- Rectification: to correct inaccurate data.
- Deletion: to delete your data or your account.
- Objection: to object to a specific use of your data.
You also have these rights under the data protection law of your country — for example, Law No. 29733 in Peru, the Federal Law on the Protection of Personal Data Held by Private Parties in Mexico, Law 1581 of 2012 in Colombia, Law 25,326 in Argentina, Law 19,628 in Chile or the LGPD in Brazil.
Email us at mauricio@thelumii.app. We will reply within the time limits set by the law that applies to you. If you are not satisfied with our answer, you can contact the data protection authority in your country.
10. Cookies
We only use cookies and browser storage that are strictly necessary to keep you signed in, protect the Google connection and remember a few preferences. See our Cookie Policy for details.
11. Minors
The app is only for people aged 18 or over. We do not knowingly collect data from minors.
12. Changes to this policy
If we change this policy we will notify you in the app and update the date above. If the change is significant — for example, if we started using your data for something new — we will ask for your consent.
13. Contact
For any privacy question, email us at mauricio@thelumii.app. See also our Terms of Use and Cookie Policy.