Privacy Policy

1. Scope

This policy applies to the Extension and related services (the "Services"). It covers data processed when you use the Extension to inject extra knowledge into chatbots (e.g., ChatGPT, Claude, Gemini) and when you save or manage conversation messages via the Extension.

2. Data we collect

2.1 Conversation content you provide

• Messages you write and responses shown in the chatbot UI that you choose to save with the Extension.
• Titles, timestamps, and chat URL, model name, provider.
• Optional notes, tags, or attachments you add.

2.2 Usage & device metadata

• Basic technical data needed to operate the Extension: browser version, Extension version, and error/crash logs enable/disable.
• Configuration preferences (e.g., knowledge sources connected, hotkeys).

2.3 Connected knowledge sources (optional)

• When you connect external sources (e.g., files, URLs, notes, knowledge bases), we process the content you choose to index for injection into chatbot prompts.
• If OAuth is used: tokens are stored on our servers and are encrypted at rest. We request only the scopes required.

2.4 Data we do not intentionally collect

• Sensitive categories (e.g., health, biometric, precise location) unless you explicitly include them in a message or uploaded content.
• Advertising identifiers for cross‑site tracking.

3. How we use data

• To operate the Extension: inject your selected knowledge into chatbot prompts you initiate and save messages you choose to store.
• To provide features you request: search, tagging, export, synchronization across devices if enabled.
• To maintain and improve: debugging, analytics on feature usage aggregated or anonymized where possible.
• No advertising / We do not use your data for targeted advertising.

4. Legal bases (GDPR)

• Performance of a contract — to provide the Services you install and use.
• Legitimate interests — to keep the Services secure and improve them in ways that do not override your rights and expectations.
• Consent — for optional features (e.g., connecting third‑party sources, analytics, or telemetry where required).

For California residents, we do not "sell" or "share" personal information as defined by the CCPA/CPRA.

5. Sharing & processors

We do not sell your personal information. We share data only with service providers who process it on our behalf for the purposes above, under contracts that require appropriate safeguards.

Examples of processors we may use

• Hosting & databases: Neo4j, MongoDB, Pinecone
• LLM providers (for AI features you invoke): Microsoft
• Search/index: Pinecone, Neo4j
• Payment: Stripe

We may disclose information if required by law or to protect our rights, users, or the public.

6. Storage, location & retention

• Where: In the servers located in the United States
• Retention: Conversation data is kept until you delete it
• Backups: Yes regular backups for disaster recovery with retention 30 days
• Encryption: In transit via HTTPS; at rest AES‑256

7. Security

We use technical and organizational measures to protect your information, including access controls, encryption in transit, and regular dependency updates. No method of transmission or storage is 100% secure, but we continuously work to improve our safeguards.

8. Your choices & rights

Controls

• Revoke connected sources and OAuth tokens at any time.

GDPR rights

Depending on your region, you may have the right to access, correct, delete, restrict, or object to processing of your data, and to data portability and withdrawal of consent. To exercise these rights, contact us at hello@lumen-labs.ai. We may ask you to verify your identity.

California privacy

We do not sell or share your personal information as defined by the CCPA/CPRA. If that changes, we will provide a “Do Not Sell or Share” link and honor your choices.

9. Chrome permissions & disclosures

The Extension requests only the permissions necessary to function:

• activeTab: to read chatbot page content only when you use the Extension.
• scripting: to inject knowledge you select into the chatbot interface.
• storage: to save your settings and conversation data.

Data accessed from the page is processed locally or transmitted to our processors only to fulfill the features you request. We do not collect it in the background without your action.

10. Children’s privacy

The Services are not directed to children under 13 and we do not knowingly collect personal information from them. If you believe a child has provided us personal information, contact us to request deletion.

11. International transfers

If we transfer personal data across borders, we rely on appropriate safeguards such as Standard Contractual Clauses and additional protections where required.

12. Changes to this policy

We may update this policy from time to time. We will revise the “Effective date” above and, if changes are material, we will provide additional notice via the Extension or by email.

13. Contact us

For questions or requests about this policy or your data, contact: