Privacy Policy

Last updated: October 9, 2026

1. Introduction

Lumis by Luminous Metrics ("Lumis", "we", "us", or "our") is a marketing analytics and campaign management platform that helps businesses connect their Google Ads, Google Analytics 4, Google Search Console and Meta (Facebook and Instagram) ad accounts, and other marketing platforms, to view performance data in a unified dashboard, receive AI-generated insights, and, only with their explicit approval, apply changes to their ad campaigns. This Privacy Policy explains how we collect, use, and protect your information.

2. Information We Collect

Account Information

When you create an account, we collect your name, email address, company name, industry, and company size.

Google API Data

When you connect your Google accounts, we access your marketing data through Google APIs with your explicit consent. This includes:

Google Analytics 4: Website traffic, user behavior, and conversion data (read-only access via analytics.readonly scope)
Google Search Console: Search performance, keyword rankings, and indexing data (read-only access via webmasters.readonly scope)
Google Ads: Campaign performance, spend, and conversion data, and the ability to apply campaign changes (such as pausing a campaign or adjusting a budget) only when you approve that specific change in Lumis (optional, via adwords scope)
Google Drive (optional, exports only): When you click Create Google Sheet or Create Google Doc on a report, Lumis creates that file in your Google Drive. It can see and change only the files it created for you, never your other files (drive.file scope, requested separately and only when you first export)
Google Tag Manager (read-only) (optional): Lumis reads the published version of the container you choose, so it can check your tracking setup (for example a missing Conversion Linker or duplicate GA4 events) and explain what to fix. Read-only: Lumis cannot create, change, publish or delete anything in Tag Manager, and never manages users or accounts. (tagmanager.readonly scope, requested separately and only when an owner or admin connects Google Tag Manager for a brand)

Meta (Facebook and Instagram) Data

When you connect Meta, we access the ad accounts, Facebook Pages and Instagram accounts you choose through Meta's Marketing API and Graph API with your explicit consent. Section 5 lists exactly what Lumis reads and changes with each Meta permission.

Usage Data

We collect standard web analytics data about how you use our platform, such as pages visited and features used.

3. How We Use Your Information

Display your marketing data in our dashboard
Generate AI-powered insights and recommendations
Apply campaign changes that you have explicitly approved
Create performance reports
Provide customer support
Improve our platform and services

4. Google API Services User Data Policy

Lumis's use and transfer of information received from Google APIs to any other app will adhere to the Google API Services User Data Policy, including the Limited Use requirements. For each Google permission Lumis requests, why it is needed and how to revoke it, see How Lumis uses Google data.

We only access the Google data necessary to provide our services to you
We do not sell your Google data to third parties
We do not use your Google data for advertising purposes
We do not use your Google data to develop, improve, or train generalized or non-personalized AI or machine-learning models
To generate the insights and recommendations you request, relevant Google data is processed by our AI service providers (Anthropic and Google Gemini) under terms that do not allow them to use it to train their models
We change your Google Ads campaigns only when you approve that specific change in Lumis
We do not allow humans to read your Google data except with your consent, for security purposes, to comply with law, or for our internal operations
All Google API data is encrypted in transit (TLS) and at rest (AES-256-GCM)

5. Meta (Facebook and Instagram) Data

When an owner or admin of your Lumis workspace connects Meta, Facebook asks them to grant Lumis the permissions below. Lumis uses each permission only for the purpose listed, and only for the ad accounts, Pages and Instagram accounts that person chooses.

Meta permissions requested by Lumis
Permission	What Lumis reads or changes
`ads_read`	Lists the ad accounts you can access so you can choose one, and reads the connected ad account: campaigns, ad sets, ads, their status and budgets, and performance insights (spend, impressions, reach, frequency, clicks, CPM, conversions and conversion value). Used for dashboards, reports, alerts, the Meta controls page and AI recommendations.
`ads_management`	Applies the changes an owner or admin approves in Lumis, or makes themselves in Lumis: pausing or turning on campaigns, ad sets and ads, changing daily budgets, creating campaigns, ad sets and ads (uploading the images and videos from the brand's Lumis creative library to the ad account), creating custom and lookalike audiences, and undoing those changes. Also reads the ad account's audiences, pixels and videos so proposals use what already exists.
`pages_show_list`	Lists the Facebook Pages the connected ad account can advertise for, so the ads Lumis proposes run as the brand's Page. The plan you approve names the Page.
`pages_read_engagement`	Reads the Page's published posts, the Instagram account linked to it and its instant forms, so Lumis can propose an ad that reuses an existing post or form, which you review before approving. Lumis does not read comments, messages or the people who engage with your Page.
`pages_manage_ads`	Creates the approved ads that run as your Facebook Page, including ads that promote an existing Page or Instagram post or use an instant form, and audiences of people who engaged with your Page or forms.
`instagram_basic`	Reads the Instagram account linked to your Page (its id and username) and its posts, so Lumis can propose an ad that uses the account or reuses an existing Instagram post, which you review before approving. Lumis never posts to Instagram.

Changes need approval. Lumis changes nothing in your Meta accounts until an owner or admin approves that specific change in Lumis, or makes the change themselves in Lumis. AI agents only propose changes. Campaigns, ad sets and ads Lumis creates are created paused unless the approver chooses to start delivery, and approved changes can be undone from Lumis.
Lumis never deletes campaigns, ad sets, ads or audiences it did not create (undoing something Lumis created pauses it, and removes only Lumis-created objects that never delivered, or the audience Lumis created), never changes billing, payment methods or who has access to your Meta accounts, never publishes posts to your Page or Instagram account, and never reads the people who submit your instant forms (leads).
We do not sell Meta data, share it with data brokers, or use it for advertising, profiling or any purpose other than providing the Lumis features you use.
We do not use Meta data to develop, improve or train generalized or non-personalized AI or machine-learning models. To produce the insights and recommendations you ask for, relevant Meta data is processed by our AI service providers (Anthropic and Google Gemini) under terms that do not allow them to train their models on it.
Meta access tokens are encrypted at rest (AES-256-GCM) and all Meta data is encrypted in transit (TLS). Customer lists you upload for a Meta audience are hashed (SHA-256) before they are stored or sent to Meta, and the hashes are deleted after the audience is created or after 72 hours.
Retention. We keep Meta data while the Meta connection is active. Disconnecting Meta in Lumis immediately deletes the stored Meta access token. If you remove Lumis from your Facebook account and send us a deletion request from Facebook, Lumis automatically deletes, within a few minutes, the stored tokens and the Meta reporting data copied for every connection made with that Facebook account. If you email us to delete your data or account, we do so within 30 days. Details, and how to check a request's status, are on How to delete your Lumis data.

6. Data Storage and Security

Your data is stored securely using Supabase (PostgreSQL) with row-level security policies. Google OAuth tokens, Meta access tokens and the credentials of every other connected platform are encrypted with AES-256-GCM before storage. We use HTTPS for all data transmission.

7. Data Sharing

We do not sell, rent, or trade your personal data, Google API data or Meta data. We may share data only:

With service providers that help operate our platform (e.g., hosting, email)
With our AI processing providers (Anthropic and Google), only to produce the insights and recommendations you request
When required by law or to protect our legal rights
With your explicit consent

8. Data Retention and Deletion

We retain your data for as long as your account is active. You can request deletion of your account and all associated data at any time by contacting us. Upon deletion, we remove all stored Google OAuth tokens, Meta access tokens and cached API data within 30 days. Disconnecting a channel in Lumis deletes its stored token immediately, and a deletion request sent from Facebook is processed automatically within a few minutes. See How to delete your Lumis data for every way to delete your data and what each one removes.

9. Your Rights

You have the right to:

Access the personal data we hold about you
Request correction of inaccurate data
Request deletion of your data
Revoke Google account access at any time via Google Account Permissions
Remove Lumis from your Facebook account at any time (Facebook Settings & privacy > Settings > Business integrations, or Apps and websites) and ask us to delete your Meta data from there
Export your data

10. Cookies

We use essential cookies for authentication and session management. We do not use third-party tracking cookies.

11. Changes to This Policy

We may update this Privacy Policy from time to time. We will notify you of any material changes by posting the new policy on this page and updating the "Last updated" date.

12. Contact Us

If you have questions about this Privacy Policy or your data, contact us at support-team@luminousmetrics.io

Back to Lumis