This Privacy Policy describes how Lumendra Labs S.L. ("we", "Lumendra") collects, uses and protects your personal information when you use IndexSOS ("the Service"). We comply with the EU GDPR, the California Consumer Privacy Act (CCPA/CPRA)and Spanish law (LOPDGDD).
1. Data Controller
Lumendra Labs, S.L. · Tax ID (NIF) B88772140
Registered address: 11520 Rota, Cádiz, España
Registered with the Spanish Commercial Registry — Protocol 2026/2435, Entry 2026/3442, Sheet CA-69390 (20/05/2026).
Privacy contact: support@lumendralabs.com
2. Data we collect
- Account: email, name, profile picture (if you sign in with Google).
- Product usage: projects, domains, keywords, generated articles, settings.
- Billing: Stripe processes payments; we store customer and subscription identifiers.
- Telemetry: technical logs, truncated IP, user-agent, page events.
- Integrations: OAuth tokens for Google Search Console and WordPress that you authorize.
3. Legal bases (GDPR Art. 6)
- Contract performance — to provide the Service.
- Legitimate interest — security, fraud prevention, product improvement.
- Consent — non-essential cookies and marketing.
- Legal obligation — invoicing and tax.
4. How we use data
- Operate the SEO engine, generate AI articles and publish to WordPress.
- Manage your account, subscription and support.
- Detect abuse and protect the platform.
- Send service notices (no marketing without explicit consent).
5. Sub-processors
- Supabase (database & auth) — EU.
- Cloudflare (hosting & CDN) — global.
- Stripe (payments) — US/EU.
- Google (Gemini) and OpenAI (AI models) — US.
- Resend (transactional email) — US.
International transfers rely on the EU Commission's Standard Contractual Clauses (SCCs)and, where applicable, the EU–US Data Privacy Framework.
6. Retention
We keep your data while your account is active and up to 24 months after deletion to meet legal obligations.
7. Your rights
EU/EEA: access, rectification, erasure, restriction, objection, portability and not to be subject to automated decisions. You can lodge a complaint with your supervisory authority.
California (CCPA/CPRA): right to know, delete, correct, opt-out of sale/sharing and non-discrimination. We do not sell personal data.
To exercise any right, email support@lumendralabs.com.
8. Security
TLS 1.2+ in transit, encryption at rest, Row-Level Security, least-privilege access and audit logs.
9. Children
The Service is not directed to children under 16.
10. Changes
We will notify material changes by email or in-product at least 7 days in advance.