Privacy Policy

This Privacy Policy explains how Lumio Agency LLC ("Lumio", "we") collects, uses and protects information in the Lumio platform at lumioagency.work, an internal tool our team uses to deliver marketing services to our business clients.

1. Who uses this platform

The platform is used by Lumio staff. Our clients receive reports, quotes and contracts through private links we send them.

2. Information we collect

• Staff account information (name, email) used to sign in.
• Client business information provided to us for marketing work (business name, contact name, phone, email, address, services and prices).
• Data from Google services that a Lumio administrator explicitly connects with Google Sign-In: Google Ads (accounts, campaigns, ads, keywords, conversion actions and performance metrics), and — only if separately authorized — Google Analytics, Google Tag Manager and Google Business Profile data for client accounts we manage.

3. How we use Google user data

• To show campaign and tracking data to Lumio staff, prepare reports for the client who owns the account, and recommend improvements.
• To create or change Google Ads campaigns, tags or conversion settings only after a Lumio staff member reviews and approves each change. New campaigns are created paused.
• We do not sell Google user data, do not use it for advertising to individuals, and do not use it to train generalized AI models.
• Lumio's use and transfer of information received from Google APIs adheres to the Google API Services User Data Policy, including the Limited Use requirements.

4. AI processing

Some features send aggregated, non-personal business data (for example campaign settings, services and prices) to an AI provider to draft campaign plans or report narratives. We do not send end-customer personal data to AI providers.

5. Storage and security

• Data is stored in our database hosted by Supabase and served through Vercel.
• Google OAuth refresh tokens are encrypted (AES-256-GCM) and are never shown in the browser or written to logs.
• Access is limited by role; changes to Google accounts are recorded in an audit log.

6. Sharing

We share data only with the client who owns it, with service providers needed to run the platform, or when required by law.

7. Retention and deletion

We keep data while we provide services to the client. An administrator can disconnect Google at any time, which revokes the token. You can also revoke access at myaccount.google.com/permissions. To request deletion of your data, email Support@lumioagency.com.

8. Contact

Questions about this policy: Support@lumioagency.com.