1. Who we are
Lumen Global Sourcing is operated by Lumenus LLC, doing business as “Lumen Global Sourcing” (“Lumen Global Sourcing”, “we”, “us” or “our”). Our postal address is [Registered address to be added]. You can reach us about anything in this policy at hello@lumenglobalsourcing.com.
This policy covers our marketing website and the Lumen Global Sourcing web application (together, the “service”).
2. Our two roles: controller and processor
We handle personal data in two different capacities, and it matters which one applies.
- Documents our customers submit. When a customer uploads a document to the application, or forwards it by email, we process any personal data in that document, and the data we extract from it, on the customer's behalf and under its instructions. For this data we act as a processor (under GDPR and UK GDPR) or service provider (under US state privacy laws). The customer is the controller or business responsible for it. If your personal data appears in a document a company sent to Lumen Global Sourcing, please contact that company first; we will help them respond. Our commitments for this data are set out in our Data Processing Addendum.
- Account, billing and website data. For information about the people who use or pay for the service, and for messages sent to us through our website, Lumenus LLC acts as the controller (or business) and decides how that data is used.
3. Information we collect
Account information
When you sign up or are invited to a company account, we collect your name, work email address, company name, your role in the account (for example, admin or operator) and your login details. We also keep records of the teammates and seats on each account.
Billing information
Payments are handled by Stripe. Your card details are entered with and handled by Stripe; Lumen Global Sourcing does not store them. We receive and keep information about your plan, billing period, subscription status and whether payments have succeeded or failed, so we can manage your account.
Documents and extracted data
Customers submit documents in PDF, JPG or PNG format by uploading them in the web application. We handle logistics documents: commercial invoices, packing lists and bills of lading. Depending on what a customer submits, these documents and the data we extract from them can contain personal data such as:
- names and contact details (for example, email addresses, phone numbers and postal addresses);
- taxpayer identification numbers, including Social Security numbers;
- bank account details;
- other information that appears in the document, such as employment, insurance or shipment details.
We also store the corrections, approvals and notes that people at the customer make while reviewing documents, and any emails the product drafts to a customer's suppliers, vendors or other counterparties.
Usage and log data
When you use the service, our systems record technical and activity information, such as requests made to the app and API, timestamps, and the device and browser information your browser sends. We also keep an audit log that records approvals, entitlement changes and integration changes, and changes our staff make to account access.
Contact, demo, trial and waitlist submissions
If you contact us, ask for a demo or a free trial, or join a waitlist through our website, we collect what you give us, such as your name, email address, company, role, the pack you are interested in, roughly how many documents you handle, and your message.
4. How we use information
We use the information described above to:
- provide the service, including reading text from documents, extracting fields, verifying them, and storing the results so people at the customer can review, correct, approve, export and send them;
- create and manage accounts, seats and roles, and authenticate users;
- process subscriptions and payments, apply plan limits, and manage failed payments;
- send service emails, such as account and billing notices, and outbound emails to a customer's counterparties that a person at the customer has approved;
- keep the service secure, prevent abuse, and investigate problems;
- respond to questions, support requests, and contact, demo, trial and waitlist submissions;
- comply with legal, tax and accounting obligations, and enforce our terms.
We process documents customers submit only to provide the service to that customer. We do not use customer documents to train AI models.
How documents are read
An uploaded document is sent over an encrypted connection to Anthropic's commercial API, which returns the fields it read. We store the document and the returned fields against the customer's account. Anthropic is a subprocessor and is listed below, and under its commercial terms it does not train its models on data sent through its API.
Automated reading can be wrong, so every field comes back with a confidence score, doubtful values are flagged, and a person at the customer reviews and approves the data before anything is created from it.
Emails to people outside your company
When information is missing from a document, the product can draft a request to the customer's supplier, vendor or other counterparty. No email is sent to anyone outside the customer's company unless a person at the customer approves that specific email. Requests to a customer's own teammates are shown as notifications inside the app.
Legal bases (EU and UK)
Where GDPR or UK GDPR applies to data we control, we rely on: performance of a contract (to provide the service you signed up for); our legitimate interests (for example, securing the service, preventing abuse, and responding to enquiries), balanced against your rights; compliance with legal obligations (for example, tax and accounting records); and your consent where we ask for it, which you can withdraw at any time.
5. How we share information
We do not sell personal information, and we do not share it for cross-context behavioral advertising. We share information only as described here.
Service providers
We use the following providers to run the service. They process data for us under their own contractual obligations.
| Provider | What they do for us | Where |
|---|---|---|
| DigitalOcean | Hosting: the application servers, the database, uploaded documents and backups | United States (New York) |
| Anthropic | Reading uploaded documents, and the product’s other AI features, through its commercial API | United States |
| Resend | Sending email from the app, and receiving documents forwarded to your Lumen address | United States |
| Stripe | Subscriptions, invoices and payments. Card details are entered with Stripe, not with us | United States |
The same list, with how we tell customers before it changes, is in our Data Processing Addendum.
Destinations a customer chooses
A customer can export its data from the application. Once data leaves Lumen Global Sourcing that way, the customer and the receiving service are responsible for it.
Other situations
- Legal requirements. We may disclose information if we believe in good faith that the law, a court order or a valid government request requires it, or to protect the rights, safety or property of our customers, others or ourselves.
- Business changes. If Lumenus LLC is involved in a merger, acquisition, financing or sale of assets, information may be transferred as part of that transaction, subject to this policy.
6. International transfers
Our customers can be located anywhere, and we and our service providers may process information in countries other than the one where you live, including the United States. Those countries may have different data protection laws. Where the law requires it, we take steps to make sure transfers are covered by appropriate safeguards, such as standard contractual clauses.
7. How long we keep information
We keep account information, documents and extracted data while the customer's account is active. We keep some information for longer where we need it to meet legal, tax, accounting or billing obligations, to resolve disputes, or to enforce our agreements.
Customers can ask us to delete documents, a login or their whole account in the app, on our delete your account page, or by emailing hello@lumenglobalsourcing.com. We will delete the data, except for information we are required to keep for the reasons above.
8. Security
The measures we use to protect information include:
- HTTPS/TLS encryption in transit for the website and the application;
- isolation of each company's data, checked on every request;
- role-based access within each account (admins and operators);
- encryption in our database of integration tokens and staff two-factor secrets;
- an audit log of approvals, entitlement and integration changes, and staff access to account access.
No system is perfectly secure, and we cannot guarantee the security of information. Please keep your login details safe and tell us promptly if you think they have been compromised.
9. Cookies and local storage
Our marketing website does not set advertising or analytics cookies. The web app keeps your signed-in session in your browser's local storage. Signing out, or clearing your browser's site data, removes it.
10. Your privacy rights
Depending on where you live, you may have some or all of the rights below for personal data we control. For personal data in documents a customer submitted, please send your request to that customer; if you contact us, we will pass it on or help the customer respond.
European Economic Area and United Kingdom (GDPR and UK GDPR)
- access the personal data we hold about you and get a copy;
- correct inaccurate or incomplete data;
- have your data erased;
- restrict or object to certain processing, including processing based on legitimate interests;
- receive your data in a portable format;
- withdraw consent at any time, where we rely on consent;
- complain to your local data protection authority.
[EU and UK representative details, if required, to be confirmed]
California (CCPA as amended by the CPRA)
- know what personal information we collect, use and disclose, and access a copy;
- delete personal information;
- correct inaccurate personal information;
- opt out of the sale or sharing of personal information (we do not sell personal information or share it for cross-context behavioral advertising);
- limit the use of sensitive personal information where the law provides that right;
- not be discriminated against for exercising these rights.
You may use an authorized agent to make a request. We may ask for information to verify your identity, and the agent's authority, before acting on it. Residents of other US states with similar laws may have similar rights, and may appeal if we decline a request.
Canada (PIPEDA)
You can ask to access the personal information we hold about you, ask us to correct it, and withdraw consent to certain uses, subject to legal and contractual limits. You can also complain to the Office of the Privacy Commissioner of Canada.
Quebec (Law 25)
Quebec residents can ask to access and correct their personal information, ask for it in a structured, commonly used technological format, withdraw consent, and ask that information no longer be disseminated where the law allows. You can also complain to the Commission d'accès à l'information du Québec. The person in charge of the protection of personal information at Lumenus LLC is [Name or title of person in charge of the protection of personal information to be added], who can be reached at hello@lumenglobalsourcing.com.
How to exercise your rights
Email hello@lumenglobalsourcing.com and tell us what you are asking for and which account or email address it relates to. We may need to confirm your identity before we act. We will respond within the time required by the law that applies to you.
11. Children
Lumen Global Sourcing is a business service and is not directed to children. We do not knowingly collect personal data from children through our website or accounts.
12. Changes to this policy
We may update this policy as the service changes. When we do, we will change the “last updated” date at the top of this page, and where changes are significant we will take reasonable steps to let customers know.
13. Contact us
- Lumenus LLC, doing business as Lumen Global Sourcing
- [Registered address to be added]
- hello@lumenglobalsourcing.com