Privacy Policy

1. Who we are

Lume is operated by ReDigital Online Optimization Inc, a corporation incorporated under the laws of Ontario, Canada (“we”, “us”). This policy explains how we handle personal information under Canada’s Personal Information Protection and Electronic Documents Act (PIPEDA), Quebec’s Act respecting the protection of personal information in the private sector (as amended by Law 25), the EU and UK General Data Protection Regulation (GDPR), and US state privacy laws.

Our Privacy Officer is responsible for our compliance with this policy and is the person in charge of the protection of personal information. Contact the Privacy Officer at hello@lumetraffic.com.

2. Two roles

• We are the controller for information about our customers and their users (“account holders”), and about people who visit lumetraffic.com.
• We are a processor (service provider) for the traffic data our customers send us about visitors to their websites. Each customer is the controller of that data and decides why it is collected. Our Data Processing Addendum governs that processing. If you visited a customer’s site and have a question about your data, contact that site; we will help them respond.

3. Information about account holders

• Account and sign-in: your name, email address, organization name and membership, and sign-in and session data. Authentication is provided by Clerk.
• Billing: billing contact, billing address, a tax ID if you provide one, plan and invoice history. Payments are processed by Stripe; we never see or store your full card number.
• Configuration: the projects and domains you set up, saved segments and chart notes, and the user ID of the person who created them. Ingest and API tokens are stored only as a one-way hash. If you connect Cloudflare, the API token you give us is stored encrypted (AES-256-GCM) so we can use it to fetch your analytics.
• Support and email: what you send us, and the emails we send you about your account.

4. Visitor data we process for customers

Customers send us request metadata from their own websites, through our SDK, REST API, edge integrations or log forwarding. For each request we store:

• the request method, host and path, with the query string removed;
• the referring URL, with its query string removed;
• the utm_source value, which is the one query parameter we keep;
• the user-agent string and a hash of it, and the Accept-Language header;
• the response status code and response time;
• the country, network (ASN), network operator and a data-center flag, derived from the IP address;
• a truncated network prefix of the IP address (see below);
• our classification and verification result (for example, which crawler or AI agent made the request, and whether it was verified);
• optional protocol metadata a customer chooses to send for agent requests, such as an MCP method name or an agent-commerce response body.

IP addresses are truncated before storage. We use the full IP address only while processing a request: to look up country and network, and to verify a claimed crawler (reverse DNS and published IP ranges). For verification, the full IP waits in a short-lived processing queue and is deleted as soon as the check completes or finally fails. What we store is only the network prefix: IPv4 truncated to a /24 and IPv6 to a /48. We never persist a full IP address.

What we do not collect: full query strings, URL fragments, cookies, form contents and request or response bodies (apart from the optional agent-protocol metadata above). We do not set cookies on our customers’ visitors and we do not build cross-site profiles.

Traffic during a pause is not recorded. When a project reaches its plan limit and tracking pauses, we do not store those requests. We keep only a daily count of how many arrived.

5. Visitors to lumetraffic.com

First-party, server-side analytics. Our own website is measured with Lume. A server-side function reports each request to our ingest service with the same fields as in section 4, including the truncated IP prefix. It runs on the server, sets no cookies and stores nothing in your browser. We rely on our legitimate interest in understanding how our site is used and which automated agents visit it.

Google Tag Manager and Google Analytics load only if you accept cookies in our cookie banner. If you reject, or make no choice, they do not load. See our Cookie Policy to change your choice.

6. How we use information, and our legal bases

Under PIPEDA and Quebec law, we collect only what we need for these purposes and rely on your consent, which is implied by your use of the Service for the purposes above, or express where the law requires it. We do not use personal information for automated decisions that have legal or similarly significant effects on you.

7. Email and CASL

We send service messages that you cannot opt out of while you have an account: account and security notices, usage and plan-limit alerts, and billing messages. These are transactional messages under Canada’s Anti-Spam Legislation (CASL). We send marketing or product-news email only with your consent, and every such email includes a working unsubscribe link, which we honour within 10 business days.

8. Who we share information with

We share personal information only with the service providers that run the Service (Tinybird, Railway, Vercel, Cloudflare, Clerk, Stripe, Better Stack, Resend), each bound by a contract to use it only for us. The full list, with what each one does and where, is on our Subprocessors page. We may also disclose information when the law requires it, or to a successor in a merger or acquisition.

We do not sell personal information, and we do not share it for cross-context behavioural advertising.

9. Where data is stored: the United States

Lume is hosted in the United States, in multiple US regions. Your information is stored and processed in the US by us and our service providers, and requests pass through Cloudflare’s global network on their way to us. Information stored in the US is subject to US law and may be accessible to US courts, law-enforcement and national-security authorities.

For personal data from the European Economic Area, the UK or Switzerland, we rely on the European Commission’s Standard Contractual Clauses (with the UK Addendum) or on the recipient’s certification under the EU-US Data Privacy Framework and its UK and Swiss extensions.

10. How long we keep it

• Traffic data (events, verification results and daily rollups) is deleted automatically 395 days after the request.
• Account and configuration data is kept while your organization is active.
• After deletion, your organization is deactivated at once (its tokens stop working and any subscription is canceled) and its account data is permanently deleted 30 days later. We keep a minimal record of the deleted project identifiers so that we can finish deleting their traffic data. Traffic data already recorded is no longer accessible through the Service and is deleted when its 395-day retention period ends.
• Billing records are kept for as long as tax and accounting law requires.

11. Deleting your account

To delete your organization or your user account, email hello@lumetraffic.com from the address on the account. We confirm that you are authorized to act for the organization, then deactivate it as described above; account data is deleted 30 days later. If you only want to stop paying, you can cancel your plan in Settings → Billing instead.

12. Your rights

Depending on where you live, you have some or all of these rights:

• Everyone: to ask what personal information we hold about you, to get a copy, and to have it corrected; to withdraw consent; and to complain to us first.
• Canada (PIPEDA): access and correction, withdrawal of consent, and the right to complain to the Office of the Privacy Commissioner of Canada (priv.gc.ca).
• Quebec (Law 25): access, rectification, data portability, to be informed when a decision about you is based only on automated processing, and to complain to the Commission d’accès à l’information du Québec (cai.gouv.qc.ca).
• EEA, UK and Switzerland (GDPR): access, rectification, erasure, restriction, portability, to object to processing based on legitimate interests, and to complain to your data-protection authority.
• US states with privacy laws, such as California: to know, access, correct and delete personal information, and not to be discriminated against for using these rights. We do not sell or share personal information, so there is nothing to opt out of.

Email hello@lumetraffic.com to make a request. We may need to verify your identity, and we respond within 30 days. If your request is about data a customer sent us, we pass it to that customer.

13. Security and breaches

We protect information with encryption in transit, one-way hashing of our own tokens, encryption of stored third-party credentials, strict separation between customers, and the IP truncation described above. If a breach of security safeguards creates a real risk of significant harm, we notify affected people and customers, and report it to the Office of the Privacy Commissioner of Canada, the Commission d’accès à l’information and other authorities as the law requires. We keep a record of every such breach.

14. Children

Lume is a business service for people aged 18 and over. It is not directed at children, and we do not knowingly collect personal information from anyone under 16.

15. Changes

We will update the “last updated” date above when this policy changes, and tell account holders by email or in the dashboard before a material change takes effect.

16. Contact

Privacy Officer, ReDigital Online Optimization Inc: hello@lumetraffic.com.