Privacy Policy

1. Who we are

Lumai is an education practice platform for Indian K–12 students and parents. For privacy questions, email admin@lumai.com.

2. Information we collect

Depending on how you use the Service, we may process:

• Account data — name, username, email, password (stored hashed), role (student or parent), and optional school, board, grade, and instruction medium.
• Parent mobile — Indian mobile number for parent signup and SMS verification when that flow is enabled.
• Family links — parent–child relationships, invitations, and verification status.
• Learning activity — worksheets you create or attempt, answers, scores, retakes, insights, credits, and achievement progress (XP, streaks, badges).
• Uploads — handwritten answer images when you use handwriting capture.
• Chat and feedback — AI chat messages, issue reports, and in-app feedback.
• Billing — plan, coupons, and payment references from Razorpay (we do not store full card numbers).
• Device and session — session cookies, native-app client cookie, and push device tokens if you enable notifications.
• Usage analytics — page views and product events when Google Analytics or Microsoft Clarity is configured (not on Lighthouse).

Anonymous marketing pages may be cached without setting a session cookie. Signed-in use and the native app require a session.

3. How we use information

We use personal data to:

• create and secure accounts, including email or mobile verification
• provide worksheets, grading, insights, credits, and family features
• process subscriptions and credit purchases
• send transactional email or SMS (verification codes, parent-link notices, similar)
• operate AI features (grading, hints, explanations, handwriting extraction, chat)
• show public usernames and scores on Top scorers of the day when a student completes a worksheet that day
• diagnose issues, prevent abuse, and improve the product
• comply with law and enforce our Terms

4. Children and family accounts

Lumai is aimed at school-age learners. Students can register independently. Parents can create child accounts or link existing students. We collect only what those features need (profile, school/grade, attempts, and family links).

Parents should supervise younger children’s use. If you believe we hold a child’s data without an appropriate family relationship, contact admin@lumai.com and we will review it.

5. Who we share data with

We share data with processors only as needed to run the Service:

• Payments — Razorpay, to checkout and confirm subscriptions.
• AI providers — third-party models (for example via OpenRouter or other configured providers) to grade answers, extract handwriting, or power chat. Prompts may include question text, student answers, or images you upload for that feature.
• Email and SMS — transactional mail (for example Brevo) and SMS OTP providers when configured.
• Hosting and files — infrastructure and object storage used to run the app and store uploads.
• Analytics — Google Analytics 4 and Microsoft Clarity when those IDs are configured on public and student/parent surfaces.
• Push — device tokens sent to FCM so we can deliver notifications you have allowed.

We do not sell personal data. We may disclose information if required by law or to protect the Service, users, or others.

6. Cookies and similar technologies

We use:

• Essential cookies — signed-in session, authenticity (CSRF), and native-app detection (lumai_client).
• Preferences — theme choice stored in the browser (lumai-theme).
• Analytics cookies / scripts — Google Analytics and Microsoft Clarity when enabled, to understand how the site is used.

You can block non-essential cookies in your browser. The Service needs essential cookies to stay signed in.

7. Retention and security

We keep account and learning records while the account is active and for a reasonable period afterwards for support, billing, and legal purposes. OTP codes and similar verification data are short-lived. Device tokens are deactivated when you sign out or the token is invalid.

We use access controls, hashed passwords, encrypted secrets where configured, and HTTPS. No method of transmission or storage is perfectly secure.

8. Your rights

Under applicable Indian law, including the Digital Personal Data Protection Act, 2023, you may request access, correction, or erasure of personal data we hold, or withdraw consent where processing is consent-based, subject to legal exceptions (for example billing records).

There is no in-app account deletion button yet. Email admin@lumai.com from the address on your account (parents should write from the parent address for a child they created). Signed-in users can also send Feedback or Report an issue.

9. Storage and transfers

We operate for users in India. Processors (payments, AI, email, analytics, hosting) may handle data on servers in India or other countries. We use them only to provide the Service.

10. Changes

We may update this policy. The “Last updated” date will change. Continued use after an update means you accept the revised policy. Material changes may also be noted in the product or by email.

11. Contact

Privacy requests: admin@lumai.com. See also Terms and Conditions and About us.