Privacy Policy

1. Who we are

Lumai is an education practice platform for Indian K–12 students and parents. For privacy questions, email support@lumai.in.

2. Information we collect

Depending on how you use the Service, we may process:

• Account data — name, username, email, password (stored hashed), role (student or parent), and optional school, board, grade, and instruction medium.
• Parent mobile — Indian mobile number for parent signup and SMS verification when that flow is enabled.
• Family links — parent–child relationships, invitations, and verification status.
• Learning activity — worksheets you create or attempt, answers, scores, retakes, insights, credits, and achievement progress (XP, streaks, badges).
• Uploads — handwritten answer images when you use handwriting capture.
• Chat and feedback — AI chat messages, issue reports, and in-app feedback.
• Billing — plan, coupons, and payment references from Razorpay (we do not store full card numbers).
• Device and session — session cookies, native-app client cookie, and push device tokens if you enable notifications.
• Usage analytics — page views and product events when Google Analytics or Microsoft Clarity is configured (not on Lighthouse or student account pages).

Anonymous marketing pages may be cached without setting a session cookie. Signed-in use and the native app require a session.

3. How we use information

We use personal data to:

• create and secure accounts, including email or mobile verification
• provide worksheets, grading, insights, credits, and family features
• process subscriptions and credit purchases
• send transactional email or SMS (verification codes, parent-link notices, similar)
• operate AI features (grading, hints, explanations, handwriting extraction, chat)
• show public usernames and scores on Top scorers of the day when a student completes a worksheet that day
• diagnose issues, prevent abuse, and improve the product
• comply with law and enforce our Terms

4. Children and family accounts

Lumai is aimed at school-age learners. Students can register independently. Parents can create child accounts or link existing students. We collect only what those features need (profile, school/grade, attempts, and family links).

Parents should supervise younger children’s use. If you believe we hold a child’s data without an appropriate family relationship, contact support@lumai.in and we will review it.

5. Who we share data with

We share data with processors only as needed to run the Service:

• Payments — Razorpay, to checkout and confirm subscriptions.
• AI providers — third-party models (for example via OpenRouter or other configured providers) to grade answers, extract handwriting, or power chat. Prompts may include question text, student answers, or images you upload for that feature.
• Email and SMS — transactional mail (for example Brevo) and SMS OTP providers when configured.
• Hosting and files — infrastructure and object storage used to run the app and store uploads.
• Analytics — Google Analytics 4 and Microsoft Clarity when those IDs are configured on public and student/parent surfaces.
• Push — device tokens sent to FCM so we can deliver notifications you have allowed.

We do not sell personal data. We may disclose information if required by law or to protect the Service, users, or others.

6. Cookies and similar technologies

We use:

• Essential cookies — signed-in session, authenticity (CSRF), and native-app detection (lumai_client).
• Preferences — theme choice stored in the browser (lumai-appearance).
• Analytics cookies / scripts — Google Analytics and Microsoft Clarity when enabled, to understand how the site is used.

You can block non-essential cookies in your browser. The Service needs essential cookies to stay signed in.

7. Retention and security

We keep account and learning records while the account is active. OTP codes and similar verification data are short-lived. Device tokens are removed when you sign out, when the token is invalid, or when an account deletion is completed.

We use access controls, hashed passwords, encrypted secrets where configured, and HTTPS. No method of transmission or storage is perfectly secure.

8. Account deletion

Parents and students can request deletion from Profile → Delete account, including in the Android and iOS apps. Anyone can also start a request at lumai.in/account-deletion without signing in. That page sends a verification code to the email or mobile number on the account before the request is accepted. The account is not deleted when the request is submitted. Lumai reviews it first, then deletes or anonymizes the account. A parent request does not delete linked student accounts.

Deleted or anonymized when a request is completed:

• Profile and sign-in data: name, username, email, mobile number, date of birth, and school, board, and grade.
• Password and active sessions.
• Family links for the deleted account. Linked student accounts are not deleted with a parent account.
• Worksheet attempts, answers, scores, AI grading and feedback, and handwriting images.
• AI chat messages, in-app notifications, OTP codes, and push device tokens.
• Parent-approval and billing-request messages that contain a mobile number.
• Copies of AI prompts and answers stored in Lumai's API logs for that account.

Retained, with the account anonymized where it is still referenced:

• Payment and subscription records, including payment-provider references, for up to eight years for tax and accounting.
• Credit ledger entries that support those payment records.
• Worksheets that were published or used by someone else, with the creator removed.
• Lumai's API logs, for 90 days. Logs tied to an account are also removed when that deletion is completed.
• Server backups and copies held by payment, email, SMS, or AI processors. Those are not edited in place and expire on the backup and processor schedules.

To ask about a deletion request, email support@lumai.in. Signed-in users can also send Feedback or Report an issue.

9. Your rights

Under applicable Indian law, including the Digital Personal Data Protection Act, 2023, you may request access, correction, or erasure of personal data we hold, or withdraw consent where processing is consent-based, subject to legal exceptions (for example billing records we must keep).

Use the deletion steps above for erasure. For access or correction, email support@lumai.in.

10. Storage and transfers

We operate for users in India. Processors (payments, AI, email, analytics, hosting) may handle data on servers in India or other countries. We use them only to provide the Service.

11. Changes

We may update this policy. The “Last updated” date will change. Continued use after an update means you accept the revised policy. Material changes may also be noted in the product or by email.

12. Contact

Privacy requests: support@lumai.in. See also Terms and Conditions and About us.