Privacy Policy

1. Two different roles

Which part of this Policy applies to you depends on whose website you are on.

• On lumarealtyai.com and our demo sites, we are the controller. We decide what is collected and why, and this Policy governs it.
• On a client website we host, the real estate agent or brokerage is the controller and we are their processor. We handle the data on their instructions, to run their site. Their own privacy policy governs what they do with it. If you submitted a form on an agent's site and want your information corrected or deleted, the fastest route is to contact that agent directly. You can also contact us and we will pass the request to them.

2. Information we collect

Information you provide. When you submit a contact, valuation, showing, or “Book a call” form, save a search, or chat with our AI assistant, we collect what you choose to provide: typically your name, email address, phone number, agency name, the property or area you asked about, and the contents of your message or conversation.

Client account information. If you subscribe as a client, we collect your business and billing details: legal entity name, contact name, email, phone, billing address, licence number, brokerage details, and the administrative logins you create.

Payment information. Card payments are processed by Stripe. Card numbers are entered directly into Stripe's hosted fields and are never transmitted to or stored on our servers. We retain only what Stripe returns to us: a customer and payment-method identifier, the card brand, the last four digits, and the expiry month and year, so that we can show you which card is on file.

Signature and agreement records. When a client signs a service agreement electronically, we record the signer's name, email, job title, the signature image, the date and time, the IP address, the browser user agent, the consents given, and a cryptographic hash of the signed document. This is evidence of the transaction and is retained as described in section 8.

Information collected automatically. We and our providers may collect technical information such as IP address, browser and device type, pages viewed, referring URL, and general usage data, including through cookies and similar technologies.

Cookies and similar technologies. We use a small number of cookies that are necessary to operate the Services, keep you signed in to the administration area, remember preferences, and protect against spam and abuse. We do not use advertising or cross-site tracking cookies on our own site. You can control cookies through your browser, though some features will not work without them.

Property listing data. Listing records displayed on client sites come from the client's licensed MLS feed. That data describes properties, not you, though it may include the name and contact details of the listing agent and office where the MLS requires that attribution.

3. How we use information

• To respond to your enquiry and route it to the agent or brokerage you contacted;
• To operate, maintain, secure, monitor, and improve the Services;
• To power AI features such as the Luma assistant and to draft website content;
• To send transactional messages: lead notifications, saved-search alerts you asked for, service agreements, invoices, receipts, and account notices;
• To take payment, issue invoices, and keep accounting and tax records;
• To keep an audit trail of AI conversations and electronic signatures, which some MLS rules and electronic-signature laws require;
• To detect, prevent, and address fraud, abuse, security, and technical problems; and
• To comply with legal obligations and enforce our agreements.

Where the law requires a legal basis, we rely on: performance of a contract (providing the Services and taking payment); legitimate interests (securing and improving the Services, preventing fraud, and marketing to businesses); consent (optional communications, which you may withdraw at any time); and legal obligation (tax, accounting, and responding to lawful requests).

4. Artificial intelligence

Our Services use third-party AI providers to power the Luma assistant and to draft website content. When you interact with an AI feature, the relevant content is transmitted to and processed by that provider to generate a response.

• We do not use your personal information to train third-party AI models, and our agreements instruct providers to process data only to deliver the Services.
• Assistant conversations are logged, with the question, the answer, and the listings referenced. The log lets an agent or their MLS audit what the assistant said. Do not enter sensitive personal information into the chat.
• Where an MLS restricts AI use with its data, the assistant is configured to answer only from the licensed feed rather than to generate property facts.

5. How we share information

We do not sell your personal information, and we do not share it for cross-context behavioural advertising. We share it only as follows:

• With the real estate client you contacted. If you submit a lead on an agent's site, your information goes to that agent or brokerage so they can respond.
• With service providers (sub-processors) who perform functions on our behalf, listed in section 6.
• With an MLS or data provider where their rules require us to produce compliance or audit records about how their data was displayed or used.
• For legal and safety reasons, when required by law or legal process, or to protect the rights, property, or safety of LumaRealtyAI, our clients, or others.
• In a business transfer, such as a merger, acquisition, financing, or sale of assets, subject to this Policy.

6. Our sub-processors

These providers process data on our behalf. The list may change; we will keep it current here.

• Supabase (United States): database, authentication, and file storage.
• Sevalla (United States): application hosting.
• Cloudflare (United States): DNS, content delivery, and security.
• Anthropic (United States): AI processing for the assistant and content tools.
• Stripe (United States): payment processing and card storage.
• Resend (United States): transactional email delivery.
• Google reCAPTCHA (United States): spam and abuse protection on forms.
• CoreLogic / Cotality Trestle (United States): MLS listing data distribution.
• OpenFreeMap: map tiles for the map search.

7. Google reCAPTCHA

We use Google reCAPTCHA to protect our forms from spam and abuse. reCAPTCHA collects hardware and software information and sends it to Google for analysis. Its use is subject to the Google Privacy Policy and Terms of Service.

8. How long we keep information

We keep personal information for as long as needed for the purposes in this Policy, then delete or de-identify it. In practice:

• Leads and enquiries: for as long as the client's subscription is active, and for 30 days after it ends, unless the client exports or deletes them sooner.
• AI conversation logs: retained while the subscription is active so the client and their MLS can audit them.
• Signed agreements, invoices, and payment records: at least seven years, for tax, accounting, and evidentiary purposes. Electronic signature records must remain retrievable under the E-SIGN Act.
• Server and security logs: a short rolling window, typically under 90 days.
• We may keep de-identified or aggregated information indefinitely.

9. Security

We use administrative, technical, and physical safeguards designed to protect information, including encryption in transit, encryption at rest with our database provider, role-scoped access so a client administrator can reach only their own site's data, server-side isolation of privileged keys, and row-level security on our data stores. Card data is handled entirely by Stripe, a PCI-DSS Level 1 service provider, and never reaches our servers. No method of transmission or storage is completely secure, and we cannot guarantee absolute security. If a breach affects your personal information, we will notify you and any regulator as the law requires.

10. Your rights and choices

Depending on where you live, you may have the right to know what personal information we hold, to access a copy, to correct it, to delete it, to limit or opt out of certain uses, to appeal a refusal, and not to be discriminated against for exercising these rights. Residents of California, Colorado, Connecticut, Virginia, Texas, and other states with privacy statutes have these rights under their own law, and residents of the European Economic Area and the United Kingdom have rights of access, rectification, erasure, restriction, portability, and objection.

We do not sell personal information and we do not share it for cross-context behavioural advertising, so there is nothing to opt out of in that respect. We do not use personal information for automated decisions producing legal or similarly significant effects.

To exercise a right, email [email protected] with enough detail to locate your records. We will verify your identity before acting and respond within the period the applicable law sets. You may use an authorized agent where the law allows. If your request concerns information collected on a client's website, we will forward it to that client, who is the controller.

You can unsubscribe from marketing or saved-search alerts using the link in any such email. Transactional messages about an active account, such as invoices and service notices, are not marketing and cannot be opted out of while the account is open.

11. Children's privacy

The Services are not directed to children under 16, and we do not knowingly collect personal information from children. If you believe a child has provided us information, contact us and we will delete it.

12. International transfers

We are based in the United States and our providers process data in the United States. If you access the Services from outside the United States, you understand that your information will be transferred to and processed there, where data protection law may differ from your own. Where required, we rely on appropriate safeguards such as the European Commission's standard contractual clauses.

13. Third-party links

The Services contain links to third-party websites we do not control, including MLS sites, brokerage sites, and mapping providers. This Policy does not apply to them, and we encourage you to read their policies.

14. Changes to this Policy

We may update this Policy from time to time. When we do, we will revise the “Last updated” date above, and for material changes we will give notice by email to account holders. Your continued use of the Services after changes take effect is acceptance of the updated Policy.

15. Contact us

Questions, or a request about your information? Contact [email protected] or visit luxandgrand.com. LumaRealtyAI is a product of Lux & Grand LLC.