What we store, why, and what we never do.

What the product holds about you

LumiWright Agent Factory is an invitation-only service. To operate your workspace we hold the e-mail address you were invited with, a password hash or passkey credential you chose, the content you create inside your workspace (drafts, projects, uploaded sources) and the audit records of what the system did on your behalf. Server logs record request paths and outcomes; they never record credentials, tokens or the words a provider returned.

Connected accounts

When you connect your own Google, LinkedIn or other account, the provider's access token is encrypted with a key that belongs to your workspace alone and stored in a slot only your workspace can read. The operator of this service cannot use it: the product reads from your account only when you open the page that shows that account, shows you the result, and does not copy provider data into any other store. Nothing is ever posted, sent or published from a connected account without an explicit, per-item approval from you - in this release no customer send or publish exists at all.

Use of information received from Google APIs adheres to the Google API Services User Data Policy, including the Limited Use requirements. Google data is used only to display your own Gmail messages or YouTube channel to you; it is not sold, not used for advertising, and not read by humans except with your consent for support or as required by law.

What we do not do

No trackers, no cookies beyond the session that signs you in, no analytics beacons, no sale or sharing of personal data, no training of models on your content. Model calls made on your behalf go to the provider lane you or the operator selected, under a stated cost mode, with a receipt.

Retention and deletion

Disconnecting an account deletes its token immediately. Deleting your workspace, or asking [email protected] to delete it, removes your content and credentials within 30 days; audit records that prove what the system did are kept for the period the law requires and contain no content. See Delete your data.

Where it runs

The service runs on Amazon Web Services in the United States (us-east-1) behind Cloudflare, with encrypted storage and encrypted transport end to end. Changes to this policy are posted here with a new effective date.