Privacy statement

Lumo is a CRM for B2B teams, delivered as SaaS by Sales-Surge B.V. The app runs at https://app.lumoheaven.com and is also reachable via crm.sales-surge.io. Workspaces are set up by Sales Surge. There is no self sign-up.

Sales-Surge B.V., Professor W.H. Keesomlaan 12, 1183 DJ Amstelveen, the Netherlands.

• Chamber of Commerce (KvK): 99261758
• VAT: NL868907509B01
• Email: info@sales-surge.nl
• Phone: +31 6 5350 9843

In this statement, "we" and "Sales Surge" always mean Sales-Surge B.V.

For some data we decide ourselves why and how it is processed. We are then the controller under the GDPR. That applies to:

• visitors of lumoheaven.com
• people who fill in the form on lumoheaven.com, and other leads
• the account data of users of the app

For the data a customer puts in its own workspace, the customer is the controller. Think of that customer's contacts, deals, mail and tickets. Sales Surge is then a processor under Article 28 GDPR and processes that data only on the customer's instructions. The arrangements are set out in the data processing agreement.

Is your data in the workspace of one of our customers, for example because you are a client or supplier of a company that uses Lumo? Then that company is your first point of contact and its privacy statement applies. Section 10 explains what we do if you contact us anyway.

Visiting lumoheaven.com

The website sets no cookies and loads no analytics or third-party scripts. So we do not track you across pages or sites. To deliver the pages, our hosting provider Netlify processes technical data such as your IP address. More in the cookie statement.

The form on lumoheaven.com

When you request a demo, a trial workspace or contact, we send this data to Sales Surge:

• your name, work email address, company and job title
• your phone number and your message, if you fill them in
• the number of users you select and the language of the page
• the address of the page where you filled in the form, and the page you came from (the referrer)

That data arrives as a lead in Lumo and, through a Sales Surge connection of our own, in Pipedrive, the CRM of Sales Surge. That connection also notifies our team of the request.

Booking a demo

When you book a demo in the calendar on the site, you use the booking page of Lumo itself. Your name, email address, company, your note and your time zone then arrive as a person and a lead in the Sales Surge workspace in Lumo, and the meeting is added to the Google Calendar of the colleague you meet. You get a confirmation by email with a link to move or cancel the meeting.

Users of the app

For every Lumo user we process account data: name, email address, the workspace and role, two-step verification settings and data about active sessions, such as the device and when it was last active. What you do in the app is recorded in the workspace's audit log. If you connect your own Gmail, Google Calendar, Outlook or Microsoft 365 calendar, Lumo processes the mail and events that belong to that connection. See section 8 and the Google integration page.

Contact by email or phone

When you email or call us, we process your name, your contact details and the content of the conversation to answer your question.

We only process data for a clear purpose and with a legal basis from Article 6 GDPR.

• Following up your request. When you fill in the form, we contact you about a demo, a trial workspace or your question. We do so to take steps at your request before a contract exists (Article 6(1)(b)), and out of our legitimate interest in following up business enquiries properly (point f).
• Providing the app. We need account data to let you sign in, apply your role and secure the workspace. That is necessary for the contract with the customer you work for, and it is our legitimate interest to deliver Lumo securely (points b and f).
• Security and abuse prevention. We use sessions, the audit log and technical data to detect and stop intrusion and abuse (point f).
• Legal obligations. Data we must keep for our accounts, we keep because the law requires it (point c).

We do not sell personal data and we do not use it for other parties' advertising.

For the site and the app we work with a small number of service providers. They process data only for the purpose we engage them for. The full list, with purpose, location and safeguard per provider, is on the sub-processors page.

For our own processing, these are the main ones:

• Netlify for hosting the website and the app
• Supabase for the app's database and file storage
• Pipedrive, our own CRM, where leads from the form arrive
• Mailgun for mail the app sends, in the Mailgun EU region

Lumo loads no third-party fonts or scripts. The Satoshi typeface is on our own servers.

Apart from that, we only disclose data when the law requires it, for example on a lawful request from a supervisory authority.

Lumo's database and file storage are at Supabase in London, United Kingdom (AWS region eu-west-2). The app and its serverless functions are hosted by Netlify, with the functions in London. Static files are delivered through Netlify's global network (CDN).

The United Kingdom is outside the EU but has an adequacy decision from the European Commission of June 2021. Data may therefore flow to the United Kingdom without additional contractual safeguards.

Some services run outside the EU and the United Kingdom, mainly in the United States, such as the AI features (section 7). Where data goes to the US, this happens under the EU-US Data Privacy Framework or the European Commission's standard contractual clauses. The safeguard per provider is listed on the sub-processors page.

Lumo has an AI assistant. It is off by default. An admin switches it on per workspace. An action that changes or sends something only runs once the user explicitly approves that action. The user can see what the assistant did.

Lumo's code allows only two AI providers: Anthropic's Claude API and Google's paid Gemini API. The app refuses any other provider, a custom address or a free key; the AI feature then stays off. Sales Surge chooses one of the two as the assistant's model. The "report from a sentence" feature always uses the Claude API, and only sends the sentence you type and the list of fields of the workspace, no records.

The question and the data needed for the answer go to that provider, outside the United Kingdom and the EU. Under its Commercial Terms, Anthropic does not train models on customer content and deletes API inputs and outputs within 30 days. On the paid Gemini API, Google does not use prompts and responses to improve its products. The location and safeguard per provider are on the sub-processors page.

Lumo makes no automated decisions with legal or similarly significant effects on people within the meaning of Article 22 GDPR. Lead scores, health scores and duplicate detection are suggestions. A person decides what happens with them.

The chat widget a customer can place on its own site uses no AI. Answers come from people, or are fixed messages the customer sets up. More about the assistant on the AI assistant page.

When you connect your Gmail, Google Calendar or, as an admin, Google Analytics to Lumo, Lumo receives data from Google. What we do with it is described in detail on the Google integration page. In short:

• Which data. Mail you exchange with people who are already in your workspace, the events with those people, when you are busy, the list of your calendars and your Google address. For Analytics only the visitor figures of the chosen property.
• What for. Only for the features you use in Lumo yourself: filing mail and events on the right customer, sending mail from your own address, adding meetings to your calendar, letting your scheduling page show when you are free, and website visit reports.
• Not. We do not sell data from Google, do not use it for advertising and do not train AI models with it. Sales Surge staff only read it with your explicit consent, for security, or when the law requires it.
• Keeping and deleting. Google's keys are stored encrypted and deleted as soon as you disconnect. You then choose whether stored mail stays or is deleted.

Limited Use: Lumo's use and transfer to any other app of information received from Google APIs will adhere to the Google API Services User Data Policy, including the Limited Use requirements.

When you connect your Outlook mailbox and your Microsoft 365 calendar to Lumo, Lumo receives data from Microsoft. What we do with it is described in detail on the Microsoft 365 integration page. In short:

• Which data. Mail you exchange with people who are already in your workspace, the events with those people, the list of your calendars, the times you are busy and your Microsoft address. To see whether an email belongs to a known contact, Lumo first reads the header data. For mail with unknown people, Lumo stores no headers and no content.
• What for. Only for the features you use in Lumo yourself: filing mail and events on the right customer, sending mail from your own address, adding meetings to your calendar and letting your scheduling page show when you are free.
• Role and legal basis. The stored mail and events are kept in the customer's workspace. For that data the customer is the controller and Sales Surge is the processor (section 2). Microsoft is the source of the data and not a sub-processor.
• Not. We do not sell data from Microsoft, do not use it for advertising or marketing and do not train AI models with it. Sales Surge staff only read it with your explicit consent, for security, or when the law requires it. The AI assistant cannot read stored mail. When it is on, it can send events that are activities in Lumo to the AI provider (section 7).
• Keeping and deleting. Microsoft's keys are stored encrypted and deleted at once when you disconnect. You then choose whether stored mail stays or is deleted at once. Deleted data then stays in the daily backup for up to 7 days.
• Withdrawing consent. You can do this at any time. Disconnect Outlook in Lumo and also revoke Lumo's access at Microsoft, because Microsoft does not let Lumo withdraw the consent itself. For a work account you do that at myapps.microsoft.com. For a personal account you do that at account.live.com/consent/Manage.

Lumo complies with the Microsoft APIs Terms of Use.

We keep data no longer than needed for the purpose we hold it for.

• Leads from the form are kept as long as there is or may be contact. If you ask us to delete your data, we do so, unless we must keep it for a running contract or a legal obligation.
• Account data is kept as long as the account exists. After that we keep it no longer than needed to wind up the contract and meet legal obligations.
• Accounting records are kept as long as the law requires.
• In a workspace, retention periods apply to form answers, closed conversations, mail not linked to a contact and unlinked files. The default period is 2 years (730 days). The customer can change it per type. The audit log is append-only and is kept.
• Sessions in the app last at most 14 days and end after 7 days without activity. See the cookie statement.

The database is backed up every day. There is no point-in-time recovery. Backups are retained according to the database provider's schedule. Erased data can therefore remain in a backup until that backup rotates out.

Under the GDPR you have these rights:

• access to the data we hold about you
• rectification of data that is wrong
• erasure of your data
• restriction of processing
• portability of your data in a common format
• objection to processing based on legitimate interest
• withdrawal of consent, where we rely on consent

To use any of these rights, email info@sales-surge.nl. We may ask you to show that the data is yours. We respond within the period the GDPR sets, as a rule within one month.

If your request concerns data in a customer's workspace, that customer is responsible. We then forward your request to the customer and help them handle it. The app has its own tools to export and erase data for this.

If you disagree with how we handle your data, please tell us first. You can also lodge a complaint with the Dutch supervisory authority, the Autoriteit Persoonsgegevens.

We protect data with technical and organisational measures. Connections are encrypted. Workspaces are separated per row in the database. There are roles, two-step verification and an audit log. An overview is on the security and privacy page, which also explains how to report a vulnerability.

We update this statement when our processing changes. The date of the latest version is at the top.

Send privacy questions to info@sales-surge.nl or call +31 6 5350 9843. See also the terms of use and the cookie statement.