Privacy Policy

1. Introduction & Statutory Framework

LumiLore Technologies ("LumiLore", "we", "us", or "our") designs, engineers, and operates high-performance cloud infrastructure and autonomous multi-agent artificial intelligence systems. We are committed to safeguarding personal information collected through our website (lumilore.ca), interactive client portals, client intake funnels, and autonomous conversational systems.

This Privacy Policy governs our collection, use, retention, disclosure, and protection of personal data in strict compliance with Canada's Personal Information Protection and Electronic Documents Act (PIPEDA), applicable provincial privacy legislation (including Ontario), and globally accepted principles of fair information practices.

2. Categories of Information We Collect

We restrict collection exclusively to information necessary to fulfill your technical inquiries, schedule consultations, provision software, and maintain secure infrastructure:

• Consultation & Client Intake Data: When you submit an inquiry or schedule a consultation via our contact portal, we collect your full name, business email address, phone number, company name, service requirements, and scheduling preferences.
• Instant AI Visibility Audit Data: When utilizing our AI Search & Visibility scanner, we process the target public domain name or URL submitted to generate automated visibility and entity citations.
• LumiBot Ephemeral Interaction Data: Text queries submitted to the LumiBot Solutions Architect terminal during your session are processed to provide contextual technical guidance. These interactions are not linked to advertising identifiers.
• Technical Infrastructure Telemetry: Anonymized server logs, IP addresses, edge request timestamps, HTTP user-agent headers, and security event telemetry collected to detect DDoS attacks and safeguard our API Gateway endpoints.

3. Legal Bases & Purposes for Data Processing

Under PIPEDA and fair information principles, LumiLore processes personal and technical data for explicit, documented business purposes:

1. Fulfilling Contractual & Professional Inquiries: Reviewing client system requirements, providing architectural assessments, and preparing service proposals.
2. Automated Appointment Booking: Synchronizing calendar slots with our AWS backend and Google Calendar availability pipelines.
3. Transactional Notifications: Transmitting booking confirmations, intake receipts, and project deliverables via verified Amazon SES infrastructure.
4. Zero-Trust Security & API Protection: Enforcing rate-limiting, preventing automated bot abuse, and verifying HTTPS edge integrity.

4. Data Residency & Cryptographic Security Architecture

We treat data security as an intrinsic architectural property rather than an administrative afterthought:

• Canadian Sovereign Data Residency: All operational databases, DynamoDB table clusters, Lambda compute runtimes, and Amazon SES configurations reside primarily within the AWS Canada Central (ca-central-1) geographic region.
• Encryption at Rest: All stored records in Amazon DynamoDB are encrypted using AWS Key Management Service (AWS KMS) utilizing 256-bit Advanced Encryption Standard (AES-256 GCM).
• Encryption in Transit: All communications between your client device and our edge servers require TLS 1.3 or TLS 1.2 with strict cipher suites. Unencrypted HTTP traffic is permanently redirected to HTTPS with HSTS headers.
• Point-in-Time Recovery: Our intake data tables maintain continuous automated continuous backup and Point-In-Time Recovery (PITR) to prevent accidental data loss.

5. Cookies, Local Storage & Audience Lens Preferences

LumiLore does not deploy third-party advertising cookies, invasive tracking pixels (such as Meta Pixel or TikTok tracking), or cross-site tracking scripts. Our browser storage usage is strictly functional:

Storage Key	Storage Mechanism	Purpose	Duration
lumilore_master_lens	localStorage	Saves your preferred audience experience (Corporate vs. Mechanical Trades) to eliminate visual layout flash (FOUC).	Persistent (1 Year)
lumilore_cookie_consent	localStorage	Stores your explicit privacy preferences ("all" or "essential").	Persistent (1 Year)
_cfuvid / AWS Edge	Session Cookie	Zero-trust edge routing and rate limiting to prevent denial-of-service floods.	Session (Ephemeral)

You can adjust your preferences at any time using the Cookie Preferences link located in the global footer.

6. Third-Party Infrastructure Subprocessors

To deliver enterprise-grade availability, LumiLore engages carefully audited cloud subprocessors bound by strict data processing agreements:

• Amazon Web Services (AWS): Cloud compute, API Gateway, DynamoDB, SES, and KMS encryption services hosted in ca-central-1.
• Google Workspace & Calendar API: Enterprise calendar synchronization for direct technical consultations.
• Payment Processors: Enterprise retainers and software invoices are processed through compliant third-party payment gateways with Level 1 PCI-DSS compliance. LumiLore never stores raw credit card numbers.

7. Data Retention & Deletion Protocols

We retain personal data only for as long as necessary to fulfill the purposes for which it was gathered, including satisfying legal, accounting, and contractual reporting obligations:

• Prospective Inquiries: Unconverted intake submissions are securely purged or anonymized within twelve (12) months.
• Active Client Data: Maintained throughout the duration of the commercial engagement plus required statutory tax/accounting retention periods under Canadian federal law.
• Right to Erasure: You may request complete deletion of your personal records at any time, subject to statutory retention obligations.

8. Your Statutory Rights Under PIPEDA

As an individual interacting with LumiLore, you retain comprehensive statutory rights under Canadian privacy legislation:

• Right to Access: You may request a complete copy of all personal information LumiLore holds regarding your identity.
• Right to Rectification: You may challenge the accuracy of any personal information and have it corrected or updated.
• Right to Withdraw Consent: You may revoke consent for optional processing or communications at any time.
• Right to Redress: If you believe our data practices do not conform with Canadian statutory obligations, you retain the right to lodge a formal inquiry with the Office of the Privacy Commissioner of Canada (OPC).

9. Policy Updates & Material Modifications

We reserve the right to revise this Privacy Policy periodically to reflect technological advancements, architectural changes, or evolving Canadian statutory requirements. When updates occur, the "Effective Date" at the top of this document will be amended accordingly.

10. Designated Privacy Officer & Inquiries

For inquiries regarding our data protection standards, to exercise statutory privacy rights, or to submit formal compliance notices, please contact our designated Privacy Officer: