Privacy Notice

Effective 11 July 2026

This Privacy Notice explains how Lumen handles personal information. Lumen is a study platform for International Baccalaureate students, operated from Australia. We handle personal information in line with the Australian Privacy Act 1988 (Cth) and the Australian Privacy Principles.

Information we handle

Lumen handles the personal information you provide directly and the records created through your use of the service. This may include account and authentication details, profile information, settings and preferences, study content you create or upload, communications within the service, transaction records, device and browser information, usage events, and security and diagnostic logs.

How we use information

Lumen uses personal information to provide and administer the service, authenticate users, deliver requested features, generate AI-assisted study tools, process transactions, maintain reliability and security, investigate misuse, develop and improve product functionality, communicate service-related updates, and satisfy legal, regulatory, and recordkeeping requirements.

Lumen's data handling practices are limited to the purposes described in this notice and to closely related operational purposes that support the service. Lumen does not sell your personal information and does not use it for third-party advertising.

AI processing and overseas transfer

Lumen's AI-assisted features rely on specialist third-party providers, currently Anthropic and OpenAI. When you use an AI feature, Lumen transmits the content relevant to your request, such as prompts, selected study materials, assessment drafts, or related context, to the selected provider so the requested output can be generated. These providers may process information on infrastructure located outside Australia, including in the United States. Lumen seeks provider settings and contractual arrangements that align processing with service delivery, privacy protection, and responsible handling of submitted content. By using AI-assisted features, you acknowledge and consent to this processing and the associated overseas disclosure.

Payment and billing information

Lumen uses Stripe as its payment provider to process subscription payments, cancellations, refunds, and payment disputes. When you purchase or manage a paid plan, payment card details are collected and handled directly by Stripe under its own terms and privacy practices. Lumen receives the limited billing records required for account administration, such as a customer reference, subscription status, transaction identifiers, refund records, dispute status and reason, and applicable evidence deadlines. If a payment is disputed, Lumen may preserve a content-free summary of service activity associated with the paid period, such as feature names, event counts, token counts, and timestamps, so a person can assess the matter. This summary does not include message text, study content, or payment-card details. Lumen retains these records for financial administration, taxation, dispute management, security, and legal compliance. Stripe may process this information on infrastructure located outside Australia. Refund and dispute handling is described in the Refund Policy.

Cookies and sessions

Lumen uses an essential session cookie to maintain authenticated access, preserve session integrity, and support account security. Session technologies are also used for core service functionality, fraud prevention, and operational reliability.

Children and students

Lumen is designed for secondary and pre-university students, including users under 18 years of age. Where the law in a user's location requires parental, guardian, or school involvement, use of Lumen should occur on that basis. Lumen applies the same privacy standards described in this notice to information relating to minors. Parents and guardians may contact Lumen regarding access, correction, or deletion requests concerning a minor's personal information, subject to applicable law and appropriate verification.

Service providers and disclosure

Lumen engages service providers for infrastructure hosting, database services, analytics related to product operations, payment processing, communications delivery, customer support functions, and AI-assisted features. Lumen's core application and database are hosted with infrastructure providers whose servers are located outside Australia, including in the United States, which means your account details and study content are stored on that overseas infrastructure. Personal information may also be disclosed where reasonably appropriate for legal compliance, regulatory engagement, enforcement of terms, protection of rights or safety, corporate transactions, or preservation of the integrity and security of the platform.

Retention

Lumen retains personal information for the period reasonably necessary to provide the service and for additional periods that support account continuity, dispute management, security review, financial administration, legal compliance, and recordkeeping. When an account is closed, Lumen will delete or de-identify personal information within a reasonable period, except where continued retention is appropriate under law, contract, security requirements, or legitimate operational needs described in this notice.

Security and data breaches

Lumen applies administrative, technical, and organisational safeguards designed to protect personal information against unauthorised access, misuse, alteration, loss, and other security risks. Security measures are developed with regard to the nature of the information handled and the operational context of the service. Where a data breach gives rise to obligations under the Notifiable Data Breaches scheme in the Privacy Act, Lumen will assess and respond in accordance with that framework.

Your rights

You may review and update many account details through Settings. You can also permanently delete your account and its associated study content at any time from Settings; on deletion this content is removed from Lumen's database, while limited financial records may be retained where law requires. You may also request access to personal information held by Lumen and seek correction of information that is inaccurate, incomplete, or out of date by contacting Lumen using the details below. Privacy concerns or complaints may be raised directly with Lumen in the first instance. If you remain dissatisfied after that process, you may contact the Office of the Australian Information Commissioner through oaic.gov.au.

Updates

Lumen may update this notice from time to time to reflect legal, operational, technical, or product developments. The effective date above identifies the current version, and material updates may be communicated through the service or by other appropriate means.

Contact

Privacy enquiries may be directed to privacy@lumenib.com.

To report a suspected security vulnerability or data breach, please email security@lumenib.com so we can investigate and respond promptly.

This notice works together with our Terms & Conditions and Refund Policy.