Privacy notice

1. Who we are

This website is run by Lumina Frontier AG, registered in Zurich, Switzerland. Under Swiss data protection law, and the GDPR where it applies, we are the controller of the personal data described here.

For anything on this page, write to hello@1lumina.ai.

2. What this covers

This notice is about this website: the pages you are reading, the walkthrough form, and the Grand Concierge demonstration.

It is not the notice for the Lumina product itself. When a hotel licenses Lumina, that hotel's material is covered by the signed agreement and its data processing terms. There the hotel is the controller and we act on its instructions.

3. What we collect

If you ask for a walkthrough

The work email address and the hotel or group you type into the form, and a note of which part of the site you asked from. Those three fields are all the form sends.

If you use the Grand Concierge demonstration

What you type or say to it, and any public web address you give it to read. If you speak, the audio is sent for transcription and not kept. The transcript lives in your browser's session storage: it stays on your device and is gone when you close the tab.

Automatically, when you load a page

We count visits ourselves, on our own server. No other company is involved, and nothing about your visit is shared with anyone.

For each visit we record which pages you opened, how far down you read, which buttons you pressed, which country you are in, and whether you are on a phone or a computer. If you use one of the free tools, we also record which hotel website you gave it and how long the work took. We never record what you type into the Concierge, or the words inside anything it writes for you.

The country comes from our host, which reads it from your connection. We do not look your address up anywhere, and we do not keep it. Our host also records ordinary server logs, and we hold your address briefly in memory to stop one visitor running up a bill on the endpoints that cost us money.

We keep one small file in your browser so we can tell how many people come back. There is no name in it and no data — it is a random string, this site is the only one that can read it, and it lasts thirteen months without renewing itself. It lets us say “a third of visitors return”. It can never say who they were.

If you give us your email

From that moment we know it was you, and the visit you are in gets your name on it. Earlier visits do not. They stay anonymous, and there is no way for us to go back and claim them.

What we do not collect

• One third-party measurement tool, DataFast. It sets a first-party cookie holding a random identifier for your browser, so that a visit today and a signature in three months count as one person. If you give us your email, DataFast is told that identifier and nothing else, never your address, your name or your hotel. Only our own database can say who it belongs to. There is no Google Analytics, no Plausible, and no advertising or social pixel.
• No advertising or social pixels, and no cross-site tracking.
• No newsletter list you did not ask to be on.

4. Why, and on what basis

• To answer you. If you send the form, we use your email to write back about a walkthrough. Our basis is your request and our legitimate interest in replying to it.
• To run the demonstration. What you type is used to produce an answer, and for nothing else.
• To keep the site up. Logs and a short rate limit keep the site available and stop the API keys being drained. Our basis is our legitimate interest in a working website.
• To count visits. We use the numbers to see which pages work and which do not. The law lets us do this without asking you first, as long as we only produce anonymous figures about our own site and never join them to a person. That is exactly the line we hold, and we hold it in the way the data is stored, not only as a promise.

We do not sell personal data, we do not share it for advertising, and we do not make automated decisions about you that have legal effects.

5. Suppliers who see it

We use five suppliers to run this website. Each one receives only the part it needs to do its job, under a data processing agreement.

• VercelHosts the website and its endpoints. Receives request metadata and the form fields in transit.
• ResendDelivers the walkthrough request to us as email. Receives the work email and the hotel you typed.
• fal.aiRoutes the Grand Concierge to a model and, if you speak to it, to transcription. Receives the question, the material for that piece of work, and the audio clip.
• Exa and FirecrawlRead a public page when the Concierge is asked to. Receive the public URL you gave it.
• Cal.comBooks the call when you pick a time. Receives your name, your email and your hotel.

Every account we hold with them is in the European Union, and we are moving data residency to Switzerland. Some of them still process in the United States. For recipients certified under the Swiss–US Data Privacy Framework, the Swiss Federal Council recognised the country as adequate on 15 September 2024. Where a supplier is not certified we use the standard contractual clauses of the European Commission with the amendments Switzerland requires, and a transfer assessment. Ask and we will tell you which route applies to each supplier today.

We do not share your details with anyone else.

Nothing on this site is compulsory. If you would rather not leave an email, write to us from wherever you like and nothing is lost.

6. How long we keep it

• A walkthrough request stays in our email while we are in touch and for up to twenty four months afterwards, so we can remember what we discussed.
• Concierge input is not stored by us beyond the answer it produced.
• The rate limit holds an address for ten minutes and then forgets it.
• Server logs follow our host's retention, which is short and measured in days.
• The file in your browser lasts thirteen months and does not renew itself.
• The visit numbers are deleted automatically after twenty five months.
• If you have written to us, your history with us lasts as long as we are in touch.

7. Your rights

You can ask us to:

• send you a copy of what we hold about you
• correct it, or delete it
• stop using it while a question is open
• hand it over in a portable file
• stop holding it at all

Write to hello@1lumina.ai and we will answer within thirty days, usually much sooner. We will only ask enough to be sure it is you.

If you think we have got it wrong, you can complain to the Swiss Federal Data Protection and Information Commissioner. In the EU or the UK you can go to your own supervisory authority instead. We would rather you told us first.

8. Cookies

This site sets one cookie of its own, and nothing else.

There is no name in it and no data: a random string, readable only by this site, that lasts thirteen months and never renews itself. It exists so that we can tell how many people come back. Those numbers are never joined to anyone's name — not because we promise not to, but because the two things are kept in separate places with no key between them.

There is no consent banner because the law does not require one for this use. If you would rather we did not count your visits, turn it off here and we will stop.

The Grand Concierge uses your browser's session storage, which is not a cookie, is never sent to us, and clears when you close the tab.

9. Changes

If this notice changes we update the date at the top. If a change affects someone who has already written to us, we email them as well.