Privacy Policy

1. Overview and Purpose

Lume Cloud provides intelligent electricity verification, billing accountability, utility service monitoring, and campaign management analytics. This Privacy Policy details our practices regarding the collection, use, retention, and protection of personal data and data accessed through third-party integrations, specifically Google APIs (such as Google OAuth and the Google Ads API).

By using Lume Cloud or linking your Google account, you acknowledge and agree to the data collection and processing practices described in this document.

2. Google User Data and Google Ads API Data

When you authenticate with Google or connect your Google Ads account to Lume Cloud, we request access only to the minimum necessary scopes required to deliver our service:

3. Information Collected from Other Sources

In addition to Google user data, Lume Cloud processes:

• Telemetry and Meter Data: Voltage readings, energy consumption (kWh), and feeder telemetry submitted via secured API endpoints for service accountability.
• Account Credentials: Usernames, hashed credentials, and role authorizations (e.g., customer, operations, regulator).
• Audit Records: Tamper-evident, hash-chained logs of decisions, exports, and administrative actions for regulatory transparency.
• Technical Logs: IP addresses, browser user-agent strings, and diagnostic timestamps for security monitoring and rate limiting.

4. Data Storage, Retention, and Security

We implement comprehensive technical, administrative, and physical safeguards to ensure the confidentiality and integrity of your data:

• Encryption in Transit: All communications between your browser, our servers, and Google APIs are encrypted using modern Transport Layer Security (TLS 1.2 / TLS 1.3).
• Encryption at Rest: Sensitive authentication tokens and database records are encrypted at rest using AES-256 standard encryption.
• Access Control: OAuth access tokens and refresh tokens are stored in secured credential vaults with strict role-based access control (RBAC). Employees and automated processes cannot access raw Google credentials without authorized administrative clearance.
• Retention Policy: Google Ads reporting data and temporary session tokens are retained only for the duration required to provide active dashboard reporting and analysis. When an account or integration is disconnected, all associated OAuth tokens and cached metrics are permanently deleted within 30 days.

5. How We Share or Disclose Data

Lume Cloud does NOT sell, rent, monetize, or trade your personal data or Google user data.

We only disclose information under the following limited circumstances:

• Authorized Service Providers: Trusted infrastructure sub-processors (e.g., cloud hosting providers such as AWS and Vercel) bound by strict confidentiality and data protection agreements.
• Legal Compliance: When strictly required to comply with a valid court order, regulation, or mandatory government request under applicable law.
• With Your Consent: When you explicitly instruct or authorize us to share information with a third party.

6. Your Rights, Access Revocation, and Data Deletion

You retain full control over your personal data and third-party account authorizations:

7. Children's Privacy

Lume Cloud is a utility infrastructure, business analytics, and developer platform not directed at children under 18 years of age. We do not knowingly collect personal information from minors.

8. Changes to This Privacy Policy

We may update this Privacy Policy from time to time to reflect operational improvements, regulatory updates, or changes in third-party API requirements. The "Last updated" date at the top of this page indicates the effective date of the latest revisions.

9. Contact Information

If you have any questions, feedback, or data requests regarding this Privacy Policy or our compliance with Google API user data standards, please contact us: