Privacy Policy

Luma ("Luma," "we," "us"), operated by Engage AI LLC, provides an AI-assisted legal work platform for law firms ("the Service"). This policy explains what information we handle, how we use it, and the choices you have. Questions: dev@luma.legal.

1. Information we collect

• Account information — your name, email address, role, and the firm you belong to.
• Firm content — matters, documents, notes, and generated drafts your firm uploads to or creates in the Service. This content belongs to your firm.
• Usage and log data — actions taken in the Service (for security auditing and support), and technical data such as browser type.
• Google user data — only if you choose to connect your Google account, as described in Section 3.

2. How we use information

We use information solely to provide, secure, and improve the Service for your firm: processing documents you upload, generating drafts you request, and operating features you invoke. We do not sell personal information, and we do not use your firm's content for advertising.

3. Google user data

If you connect your Gmail account, Luma requests these permissions and uses each only as described:

• Read Gmail messages (gmail.readonly) — used only when you ask Luma to find, read, or summarize email (for example, "did the client send the medical records?"). Luma never reads your mailbox in the background.
• Send email (gmail.send) — used only to send a message you have composed or reviewed and explicitly approved with a click. Luma never sends email on its own.
• Create drafts (gmail.compose) — used only when you ask Luma to save a message into your Gmail Drafts instead of sending it.
• Google Drive file picker (drive.file) — used only when you click "Drive" while adding documents to a matter. Luma can access exactly the files you select in Google's picker — nothing else in your Drive — and imports copies of them into Luma like any other upload. Luma never browses, lists, or modifies your Drive.

Your Google OAuth tokens are stored encrypted (AES-256-GCM) and are accessible only to the Service acting on your behalf. Email content retrieved at your request is processed to answer that request; it is not copied into a standing database of your mailbox. We do not use Google user data for advertising, we do not sell it, and no human reads it except with your explicit consent, or where necessary for security investigation or legal compliance. Disconnecting Gmail in Luma (or revoking access at myaccount.google.com/permissions) deletes our stored tokens.

Luma's use and transfer to any other app of information received from Google APIs will adhere to the Google API Services User Data Policy, including the Limited Use requirements.

4. AI processing

Luma uses third-party AI providers (Anthropic and OpenAI) to process content you submit — for example to extract text, generate drafts, or transcribe dictation. These providers process data under API terms that do not permit them to use it to train their models. We do not train models on your firm's content.

5. Service providers

We use a small set of subprocessors to operate the Service: Supabase (database and file storage), Vercel (application hosting), Anthropic and OpenAI (AI processing), Resend (transactional email delivery), Monday.com (our internal issue tracker: when you send an IT Support ticket, its text, any screenshots you attach, your firm's name, your username and, if you tie the ticket to a matter, a short reference code for that matter (never the matter's name) are copied there for our development team; screenshots and other files attached to a ticket are removed from Monday.com 90 days after the ticket is reported), and Google (APIs, only when you connect your account). Each processes data only to provide its function.

6. Security

All data is encrypted in transit (TLS). Integration credentials are encrypted at rest. Access is scoped to your firm — one firm can never read another firm's data — and administrative actions are logged.

7. Retention and deletion

Your firm controls its content and may delete matters, documents, and drafts at any time. When an account or workspace is closed, we delete its content within a commercially reasonable period, except where retention is required by law.

8. Your rights

Depending on where you live, you may have rights to access, correct, delete, or export your personal information. Contact dev@luma.legal and we will respond within the time required by applicable law.

9. Changes

If we make material changes to this policy, we will notify account administrators by email and update the effective date above.