Privacy Policy

Luma is the trade name of the business operated by Roee Shoshan, an Israeli Exempt Dealer (Osek Patur) registered under the number 213191786.

Address: 9 Hazav St., Bat Hefer, Israel
Email: luma.assistant.il@gmail.com

In this policy, "Luma", "we", "us", and "our" refer to the business above. "Service" refers to the Luma application available at helloluma.co.il and all associated APIs.

Luma acts as a Data Processor on behalf of the clinic owners who use the Service. Those clinic owners are the Data Controllers for data they collect about their own customers. For data we collect directly about clinic owners themselves, Luma is the Data Controller.

A. Clinic owners (Luma subscribers)

When you register and use the Service, we collect:

• Account details: email address, full name, password. Passwords are hashed by Supabase Auth and are never accessible to us.
• Business profile: clinic name, business type, address, phone number, Instagram handle — as entered in Settings.
• Luma Brain configuration:service catalog, pricing, opening hours, cancellation policy, FAQs, VIP settings, and sensitive topics — entered voluntarily and used solely to train Luma's automated responses for your clinic.
• WhatsApp access token: the API credential that allows Luma to send and receive messages on your behalf. Stored encrypted with AES-256-GCM; never stored as plaintext at any point.
• Billing data:subscription status, billing dates, and Stripe customer ID. Credit card details are handled exclusively by Stripe and never pass through Luma's systems.
• Usage data: message volume, conversation counts, and AI action counts — for cost monitoring and service improvement.
• Audit log: every automated action Luma takes on your behalf (sending a reminder, proposing an appointment, auto-replying) is recorded and visible to you in the dashboard.

B. End-customers (WhatsApp contacts of connected businesses)

When a customer sends a message to a business's WhatsApp number connected to Luma, we receive and store:

• Phone number and WhatsApp ID — received automatically with the first message.
• Display name — as provided by WhatsApp.
• Message content — all inbound and outbound messages in the conversation with the business.
• Appointment history: service, date, status (confirmed, cancelled, completed), and notes.
• AI-generated client profile: over time Luma builds a behavioural profile including preferred communication style, booking reliability, churn risk score, loyalty score, and accumulated notes. This profile is visible to the business owner only and is used to improve personalized service.
• Business owner's note: the business owner may add a private note to a client card, visible only to them.

Clinic owner data

• Delivering the Service: operating the AI assistant, inbox, calendar, and client cards.
• Processing payments and managing subscriptions.
• Sending operational messages (signup confirmation, critical service updates).
• Identifying and fixing errors — see Section 4 (Sentry).
• Monitoring AI usage costs and improving the Service.

End-customer data

• Identifying the sender and matching them to an existing client record.
• Displaying the conversation to the business owner in the inbox.
• Sending message content to Anthropic (Claude AI) to generate reply suggestions for the business owner.
• Sending automated appointment reminders and follow-ups — only when the business owner has enabled this feature.
• Building a client profile to help the business owner deliver personalized service.

Luma uses the following service providers to operate the Service. Each provider receives only the minimum data required for its function and is contractually prohibited from using it for any other purpose.

• Luma connects to the WhatsApp Business Cloud API using the business owner's own WABA (WhatsApp Business Account). Each clinic independently authorizes and controls their own connection.
• When a customer sends a message to a connected business's WhatsApp number, we receive: the sender's phone number, their WhatsApp display name, and the message content.
• This data is stored in Luma's database and displayed to the business owner in their inbox.
• Message content is sent to Anthropic's Claude AI solely to generate reply suggestions for the business owner (see Section 4). The business owner decides what to send.
• Outbound messages are sent on behalf of the business via the Meta Cloud API.
• We do notread WhatsApp conversations for any purpose other than operating the business's messaging service.
• We do not use WhatsApp data for advertising, targeted marketing, or sale to third parties.
• We do not share WhatsApp data with any party not listed in Section 4.
• Access tokens (WhatsApp API credentials) are encrypted with AES-256-GCM before storage. They are accessed only by server-side API routes using a service-role database client and are never sent to the browser or included in logs.

End-customers who do not wish their messages to be processed by AI may contact the business directly to request this, or contact us at luma.assistant.il@gmail.com to request full data deletion (see Section 9).

• HTTPS only: all communication is TLS-encrypted. HSTS headers are enforced in production.
• Row-Level Security: every database table is protected — each business can only access its own data, with no exceptions.
• Token encryption: WhatsApp access tokens are encrypted with AES-256-GCM before storage. Without the encryption key — stored server-side only — tokens cannot be decrypted even with full database access.
• Authentication: login is managed by Supabase Auth with two-factor authentication support.
• Webhook verification: every inbound webhook from Meta is verified with an HMAC-SHA256 signature before any processing occurs.
• Error monitoring: Sentry monitors errors in real-time without exposing message content.
• EU hosting: the application is hosted on Vercel in the fra1 region (Frankfurt, Germany).
• Content Security Policy: CSP headers restrict loading of content from unauthorized sources.

Despite these measures, no digital system is fully immune to attack. We recommend not sending sensitive medical information via WhatsApp beyond what is strictly necessary for treatment purposes.

We retain data for as long as necessary to provide the Service, comply with legal obligations, and meet legitimate business needs:

• Conversations, messages, and clients: retained for the lifetime of the business account. After account closure — deleted within 30 days.
• Cancelled appointments / no-shows: soft-deleted from the UI after 90 days; not permanently erased.
• Usage and analytics data: retained for 24 months for cost monitoring and service improvement.
• Audit log: retained for 12 months.
• Billing records: retained for 7 years in accordance with Israeli accounting law requirements.
• Error reports (Sentry): 90 days, per Sentry's default policy.

Early deletion before the end of these periods can be requested — see Section 9.

Under the Israeli Privacy Protection Law (1981) and, where applicable, the EU General Data Protection Regulation (GDPR), you have the following rights:

• Right of access: request a copy of the data we hold about you.
• Right of rectification: request correction of inaccurate or incomplete data.
• Right of erasure: request deletion of your data, subject to legal retention obligations (see Sections 7 and 9).
• Right to restriction of processing: request that we stop actively processing your data in certain circumstances.
• Right to object to automated processing: request opt-out from automated messages and AI profiling.
• Right to data portability: request an export of your data in a readable format.

For business owners

Email us at luma.assistant.il@gmail.com with the subject line "Privacy Rights Request". We will respond within 30 days.

For end-customers of Luma-connected businesses

The business owner is your Data Controller — contact them directly regarding data collected in your conversations. You may also contact us at luma.assistant.il@gmail.com and we will help forward the request.

Business owners — account deletion

Send an email to luma.assistant.il@gmail.com with the subject "Luma Account Deletion Request". We will confirm the request and delete your account and all associated data within 30 days. Billing records required by law will be retained for 7 years.

End-customers — profile deletion

Contact the business you communicated with on WhatsApp; the business owner can delete your record from Luma. If you cannot reach the business, contact us at luma.assistant.il@gmail.com and we will handle the request.

Note: deletion from Luma's database does not affect data stored by Meta / WhatsApp directly. For deletion requests from Meta, contact them at Meta's data deletion portal.

• Session cookies (Supabase Auth): required for login. Created at sign-in and expire at sign-out. Not used for tracking or advertising.
• No advertising cookies: Luma does not use Google Analytics, Meta Pixel, or any other advertising or tracking tool at any point in the Service.
• Landing page: helloluma.co.il does not set cookies before login.

• AI message analysis: every inbound message is analyzed by Claude AI to generate reply suggestions for the business owner. This does not create automated decisions that directly affect the end-customer — the business owner decides what to send.
• Automated client profile: Luma builds a behavioural profile for each client (see Section 2B). This can be disabled on request through the business owner or directly through us.
• Automated sending: when the business owner enables automated features (appointment reminders, follow-up messages), Luma sends WhatsApp messages without manual approval for each message. The business owner can disable these features at any time in Settings.
• Client classification: Luma classifies clients by activity (new / loyal / lapsing) based on visit history. The business owner can change any classification manually.

End-customers may contact the business owner to opt out of automated processing, or contact us directly to request full data deletion.

We may update this policy from time to time. Material changes will be posted on this page and registered users will be notified by email at least 14 days before the changes take effect.

Continued use of the Service after changes are published constitutes acceptance of the updated policy. The "Last updated" date at the top of this page reflects the current version.

For any question, request, or inquiry regarding this privacy policy:

We aim to respond to general inquiries within 3 business days and to data rights requests within 30 days.