Lumae Privacy Policy

Effective Date: July 8, 2025

Last Updated: July 8, 2025

I. Introduction

This document constitutes the Privacy Policy ("Policy") for Alphabetasoup LLC, doing business as LUMAE and LUMAE.ai (Registered Address: 30202 52nd Ave NW, Stanwood, WA 98292 USA, hereinafter referred to as "Lumae," "we," "us," or "our"). This Policy outlines our practices concerning the collection, use, disclosure, protection, and processing of personal information belonging to users ("you," "your") of our website, applications, products, and services (collectively, the "Services").

The purpose of this Policy is to provide transparency regarding how Lumae handles your personal information, ensuring you are informed about our data practices.1 This Policy applies to personal information collected through our online Services and may also apply to information collected offline, as specified herein.4 By using our Services, you acknowledge that you have read and understood this Privacy Policy. Where required by applicable law, we will obtain your consent for specific data processing activities.

Maintaining user trust is paramount, and this Policy aims to foster that trust by being clear, comprehensive, and compliant with applicable data protection laws.2 It is designed to be read in conjunction with our Terms of Service, which provide additional context regarding your use of our Services.1

For clarity, certain key terms used throughout this Policy are defined as follows:

This Policy is effective as of the date first stated above and will be reviewed and updated periodically to reflect changes in our practices or applicable laws. We will notify you of significant changes as described in Section XIII.1


II. User Responsibilities

Lumae uses artificial intelligence tools to assist mortgage professionals in evaluating borrower data and generating reports. These tools do not make lending decisions independently, and users retain full discretion and responsibility for all determinations.

Lumae provides tools and services that allow users to input, upload, or otherwise transmit information, including personal information of third parties such as borrowers, into the platform. You are solely responsible for the accuracy, legality, and appropriateness of all content and data you submit or upload.

By using the services, you represent and warrant that you have obtained all necessary rights, permissions, and consents to provide such data to Lumae, including any third-party personal information. You agree that Lumae shall not be responsible or liable for:

Lumae disclaims all liability related to user-submitted content and expressly disclaims any responsibility for compliance with laws or regulations applicable to such content.


III. What Information We Collect

Lumae provides business-to-business services and processes borrower information on behalf of our business customers (such as mortgage professionals). We do not collect personal information directly from consumers and act as a ‘service provider’ under applicable U.S. state privacy laws.

Lumae utilizes various categories of Personal Information to provide and improve our Services. Being exhaustive in listing the data collected is legally prudent, as omitting categories could lead to non-compliance with regulations like GDPR or CCPA/CPRA.1 However, to enhance readability, we group the information into logical categories.10 The specific types of Personal Information we may collect include:

Sensitive Personal Information (SPI) / Special Categories / Consumer Health Data:

Recognizing and appropriately handling Sensitive Personal Information is critical due to the heightened legal obligations associated with it.1 Lumae does not intentionally request or require the following categories of sensitive information: Government IDs (SSN, Driver's License, Passport), financial account logins, full card numbers with security codes, precise geolocation, race/ethnicity data (though it may appear in user-provided HMDA-related documents), contents of private communications not intended for us, genetic data, biometric data, health data, or data concerning sex life or sexual orientation.

However, some sensitive information (such as Government IDs, race/ethnicity data, or potentially health-related information) might be present within documents you voluntarily upload to the Service (e.g., mortgage application forms like the Form 1003, supporting loan documentation). Any such data that appears incidentally within user-provided content is processed solely for the purpose of providing the requested Service functionality (e.g., analyzing the uploaded document). Lumae does not use this incidental sensitive data for any other purpose. Users may request the deletion of their uploaded documents and associated data at any time, subject to the retention terms outlined in Section VIII.

The potential applicability of the Washington My Health My Data Act (MHMDA) warrants special attention due to its broad definition of "consumer health data" and its reach.8 While Lumae does not intentionally collect Consumer Health Data, should such data be identified within user-uploaded documents, we will handle it according to MHMDA requirements, including obtaining specific consent if any collection, use, or sharing (beyond providing the core service requested by the user) were ever contemplated.8

The provision of most personal information is voluntary. However, choosing not to provide certain information may limit your ability to use some features of our Services.20


IV. How We Collect Your Information

Lumae collects personal information through various methods, ensuring transparency about these processes 1:


V. How and Why We Use Your Information (Legal Basis & Purpose)

Lumae collects and uses your personal information only for specific, explicit, and legitimate purposes. We are committed to the principles of Purpose Limitation and Data Minimization, meaning we only collect and use data that is necessary for the stated purposes and do not repurpose it without a valid legal basis or your consent.3 Collecting data "just in case" is not our practice.16 These principles require operational discipline, influencing our system design, internal processes, and employee training to ensure data is handled appropriately throughout its lifecycle.18

The specific purposes for which we use your information include:

Connecting the categories of data we collect (Section II) to the specific purposes for which we use them provides greater transparency, as required by laws like GDPR and CCPA/CPRA.1 This internal mapping is also essential for effective data governance.9

Business or Commercial Purpose (CCPA/CPRA)

For individuals whose data processing is subject to the California Consumer Privacy Act (CCPA) as amended by the California Privacy Rights Act (CPRA), we use your personal information for the business or commercial purposes described above. Our use of personal information is reasonably necessary and proportionate to achieve the operational purpose for which it was collected or processed, or for another disclosed purpose that is compatible with the context in which the personal information was collected.10


VI. Sharing and Disclosure of Information

Lumae does not "sell" personal information, nor do we "share" personal information for cross-context behavioral advertising, as those terms are defined under the CCPA/CPRA.1 We do not use third-party advertising networks that track your activity across different websites.

Use and Disclosure of Sensitive Personal Information (SPI):

As stated in Section II, Lumae does not intentionally collect most categories of SPI. Where SPI may be incidentally present in user-uploaded documents (e.g., Government IDs, race/ethnicity data in mortgage forms), we process it only as necessary to provide the Service requested by the user. We do not use or disclose this incidental SPI for other purposes that would require offering a "Limit the Use of My Sensitive Personal Information" right under the CCPA/CPRA.5

Sharing/Selling under WA MHMDA:

Lumae does not intentionally collect, share, or sell "Consumer Health Data" as defined under the Washington My Health My Data Act. Should such data be identified within user-uploaded documents, we will not share or sell it without obtaining the specific consent or valid authorization required by MHMDA.8

Disclosure for Business Purposes:

Lumae may disclose your personal information to third parties for legitimate business purposes, consistent with the reasons it was collected. These disclosures are not considered "sales" or "sharing." Categories of recipients include:

In compliance with CCPA/CPRA, we maintain records of the categories of personal information disclosed for a business purpose in the preceding 12 months.10

Advertising Partners: We do not share personal information with third-party advertising partners for targeted advertising purposes.


VII. Cookies and Similar Technologies

Lumae utilizes cookies and similar technologies, such as log files and scripts, on our Services. This section provides details on our use of these technologies.

What are Cookies? Cookies are small text files stored on your computer or mobile device when you visit a website. They enable the website to remember your actions and preferences over time.2

How We Use Cookies and Similar Technologies: We use these technologies for the following purposes:

We do not use cookies for third-party targeted advertising or cross-site tracking.

Your Choices Regarding Cookies:

Since we only use essential and first-party analytics cookies and do not engage in cross-site tracking or sharing/selling of data via cookies, complex cookie consent banners or "Do Not Sell/Share" mechanisms specifically for cookies are not currently necessary for our US-focused service.


VIII. Data Security

Lumae is committed to protecting the security of your personal information.2 We implement and maintain reasonable administrative, technical, and physical security measures designed to safeguard the personal information we process against accidental or unlawful destruction, loss, alteration, unauthorized disclosure, or access.1 Data security is not merely a best practice but a legal requirement under regulations like GDPR (Article 32), CCPA/CPRA, and WA MHMDA.6 Failure to maintain reasonable security can lead to significant liability, including potential private rights of action for data breaches under laws like the CCPA/CPRA.7

Our security measures include, but are not limited to:

While we strive to use commercially acceptable means to protect your personal information, it is important to understand that no method of transmission over the Internet or method of electronic storage is 100% secure. Therefore, we cannot guarantee its absolute security. We aim to provide a level of detail in this policy that demonstrates our commitment to robust security practices without revealing specifics that could compromise those measures.2


IX. Data Retention

Lumae retains personal information for as long as necessary to (i) fulfil the purposes described in this Privacy Policy, (ii) comply with legal obligations, (iii) resolve disputes, and (iv) enforce our agreements. Retention periods are reassessed periodically, and users may request deletion of their data at any time, subject to legal or contractual exceptions.3

This practice adheres to the principle of Storage Limitation reflected in the data minimization principles of CPRA.6 Retaining data indefinitely or "just in case" is generally prohibited unless required by law.16

To determine the appropriate retention period for personal information, we consider:

We retain personal information submitted to our services for a period of six (6) months to allow for reuse and customer access. After this time, information is deleted unless retention is required by law or contract.

Documenting the rationale for retention periods is part of our accountability obligations.6 Once personal information is no longer necessary for the purposes for which it was collected, we will securely delete or anonymize it in accordance with our data retention policies and applicable law.18 Operationalizing data retention requires defined policies, procedures, and technical mechanisms for data disposal.18


X. Your Privacy Rights

Depending on your jurisdiction of residence and the applicable data protection laws, you have certain rights regarding your personal information. Lumae is committed to facilitating the exercise of these rights. Key rights may include:

The specific rights available to you, and any exceptions, depend on the laws applicable in your jurisdiction. The patchwork of US state privacy laws continues to evolve.21

Table: Summary of Your Key Privacy Rights (as applicable to Lumae's current practices)

Right CCPA/CPRA (California Residents) WA MHMDA (WA Residents - Health Data) Other US States (General Trend)
Access / Know Yes Yes Yes
Correct / Rectify Yes No (but implied by accuracy needs) Yes
Delete / Erasure Yes (with exceptions) Yes Yes (with exceptions)
Opt-Out of Sale / Sharing / Targeted Ads N/A (Not Applicable Currently) N/A (Authorization for Sale) N/A (Not Applicable Currently)
Limit Use of Sensitive PI N/A (Not Applicable Currently) Yes (Consent for Collection/Sharing beyond service) Varies (Often Opt-In Consent)
Data Portability Yes (limited scope) No Yes
Object to Processing No No Varies (Often Opt-Out)
Restrict Processing No No Varies
Withdraw Consent Yes (for marketing etc.) Yes Yes
Non-Discrimination Yes Yes (implied) Yes
Automated Decision Rights Yes (developing) No Varies (Often Opt-Out)

Note: This table provides a simplified overview based on Lumae's current data practices. Specific details, definitions, and exceptions vary by law. "N/A" indicates the concept is addressed differently or not applicable to current operations.

Successfully fulfilling these rights requires Lumae to maintain robust internal Data Subject Access Request (DSAR) processes. This involves having mechanisms to receive requests, verify identity, locate data across potentially disparate systems, execute the requested action (access, deletion, correction), track the process, and respond within legally mandated timeframes.1


XI. How to Exercise Your Rights

To exercise any of the privacy rights described above, please submit a verifiable request to us via email 1:

We currently do not offer a web form or toll-free number for these requests.

Information Needed for Your Request: Please include sufficient information in your request to allow us to reasonably verify you are the person about whom we collected personal information or an authorized representative. Please also describe your request with sufficient detail to allow us to properly understand, evaluate, and respond to it.

Verification Process: We need to verify your identity before processing most requests to protect your privacy and prevent fraudulent requests.11 The verification process will depend on the nature and sensitivity of your request. We may ask you to provide additional information to confirm your identity, such as confirming details associated with your account or responding to an email sent to the address on file. We aim to make this process reasonable and proportionate.11

Response Timing and Format: We will endeavor to acknowledge receipt of your request within 10 business days (for CCPA/CPRA requests) and respond substantively within the timeframe required by applicable law (e.g., 45 days for CCPA/CPRA, potentially extendable by another 45 days with notice).11 For WA MHMDA deletion requests concerning Consumer Health Data (if applicable), the timeframe is generally 30 days from authentication.8 If we require more time, we will inform you of the reason and extension period in writing. Our response will be provided in a format that is readily usable, and requests are generally free of charge.6

Appeals: If we deny your request, we will explain the reasons for the denial. Some state laws provide a right to appeal our decision. If applicable, our denial notice will include instructions on how to submit an appeal.

Authorized Agents: You may designate an authorized agent to make a request on your behalf under certain laws like the CCPA/CPRA. We will require proof that you have provided the authorized agent with signed permission to act on your behalf, and we may also require you to verify your own identity directly with us, unless the agent provides power of attorney.

Data Processing Addendum (DPA): If you are a business customer using Lumae’s services to process personal information of third parties—such as borrowers—you acknowledge and agree that Lumae acts as a service provider under applicable U.S. state privacy laws and processes such information solely on your behalf and in accordance with your instructions.

Our obligations as a service provider are further detailed in our Data Processing Addendum (DPA), which is hereby incorporated by reference into our agreements with business customers. The DPA outlines our data handling practices, security measures, and commitments regarding consumer rights under applicable privacy laws.

To request a copy of our DPA or to execute one as part of your agreement with Lumae, please contact us at [support@lumae.ai], with Subject Heading “Data Processing Addendum,” or your customer success representative.


XII. Children's Privacy

Lumae's Services are directed to U.S. mortgage professionals and are not intended for children under the age of 16. We do not knowingly collect personal information from children under 16.2

If you are a parent or guardian and believe we may have collected personal information from your child under 16 without required consent, please contact us at support@lumae.ai. If we learn that we have collected personal information from a child under 16 without necessary consent, we will take steps to delete that information promptly.


XIII. International Data Transfers

Lumae's primary operations and target market are within the United States. Our website and application hosting infrastructure (Amazon Web Services - AWS) is located in the US-West region. Our LLM processing (Microsoft Azure OpenAI Service) utilizes U.S. datacenters.

We do not routinely transfer personal information outside of the United States. However, should we ever process personal data originating from the European Economic Area (EEA), UK, or Switzerland, we would ensure such transfers comply with applicable data protection laws. For transfers to the United States, Lumae would rely on appropriate safeguards such as the EU-U.S. Data Privacy Framework (DPF), the UK Extension to the DPF, the Swiss-U.S. DPF, and/or the Standard Contractual Clauses (SCCs) adopted by the relevant authorities, potentially supplemented by Transfer Impact Assessments (TIAs) as necessary.3

Regardless of where your information is processed, we apply the protections described in this Privacy Policy.


XIV. Changes to This Privacy Policy

Lumae reserves the right to amend this Privacy Policy at any time to reflect changes in the law, our data collection and use practices, the features of our Services, or advances in technology.1 The privacy landscape is constantly evolving.11 Therefore, maintaining an up-to-date policy is essential for compliance.1

We will make the revised Privacy Policy accessible through our Services, and we will update the "Last Updated" date at the top of this Policy. If we make material changes to this Policy, we will provide you with notice as required by applicable law, which may include posting a notice on our website or sending an email notification to the address associated with your account.5 We encourage you to review this Privacy Policy periodically to stay informed about how we are protecting the personal information we collect. Your continued use of our Services after the revised Policy has become effective indicates that you have read, understood, and agreed to the current version of the Policy.


XV. Contact Information

If you have any questions, comments, or concerns about this Privacy Policy or our data practices, or if you wish to exercise your privacy rights, please contact us 1:

Alphabetasoup LLC (d/b/a Lumae / Lumae.ai)

Attn: Privacy Inquiry

30202 52nd Ave NW

Stanwood, WA 98292 USA

Email: support@lumae.ai (Please include "Privacy" in the subject line for inquiries)


XVI. Jurisdiction-Specific Information (Addendum)

This addendum provides additional information required under specific data protection laws.

A. California Residents (CCPA/CPRA)

This section supplements the information contained in the main policy and applies solely to residents of California.

B. Washington Residents (My Health My Data Act - MHMDA)

This section supplements the information contained in the main policy and applies solely to Washington residents regarding their "Consumer Health Data" as defined broadly under the MHMDA.8

C. Residents of Other US States

Comprehensive state privacy laws are now in effect or coming into effect in numerous US states (e.g., Colorado, Connecticut, Delaware, Florida, Indiana, Iowa, Kentucky, Maryland, Minnesota, Montana, Nebraska, New Hampshire, New Jersey, Oregon, Tennessee, Texas, Utah, Virginia).21 Residents of these states generally have rights similar to those described under CCPA/CPRA and GDPR, such as rights to access, correct, delete, obtain a copy of their data, and opt-out of certain processing activities like targeted advertising or the sale of personal data (though Lumae does not currently engage in these opt-out relevant activities). Please refer to Sections IX and X to understand and exercise your rights. We strive to honor these rights in accordance with applicable state laws.