Privacy policy

Last updated: 11 October 2026

This policy explains how LumiLeads ("we") handles personal data in the LumiLeads Studio, our internal tool for creating, reviewing and publishing marketing videos, and on this website. We process personal data under India's Digital Personal Data Protection Act, 2023 and other applicable law. The Studio software is developed by Finrius Technologies Pvt. Ltd..

Data we collect

• Account data: username, e-mail address, a salted password hash (never the password), role, sign-up and approval dates.
• Security data: a session cookie, sign-in times, the IP address and browser of sign-ins and failed attempts, and an audit log of approvals and other actions.
• Contact form: your name, e-mail, topic and message.
• Content: scripts, captions, images and videos created in the Studio, and the consent records of anyone whose face or voice is used.
• Channel data: when an admin connects YouTube or Facebook, encrypted access tokens and the channel or page name; public post statistics (views, likes, comments) of our own posts.

Why we use it

• to create and secure your account and let an administrator approve it;
• to record who approved what, so nothing is published without a responsible person;
• to publish approved posts to our own channels and measure them;
• to answer your messages.

We do not sell personal data, we do not use it for advertising profiles, and we do not use tracking or analytics cookies on these pages. The only cookie is the session cookie that keeps you signed in.

Google and YouTube data

The Studio uses YouTube API Services to upload approved videos to our own channel and read its basic channel details. By using that feature you also agree to the YouTube Terms of Service, and Google's handling is described in the Google Privacy Policy. LumiLeads' use and transfer of information received from Google APIs adheres to the Google API Services User Data Policy, including the Limited Use requirements. You can revoke the Studio's access at any time at myaccount.google.com/permissions.

Meta (Facebook and Instagram) data

When connected, the Studio uses Meta's APIs only to publish approved posts to our own Facebook Page and Instagram professional account and read their public statistics. Access can be removed in Facebook settings under Business integrations.

Sharing

We share data only with the services that run the Studio for us (our server and e-mail providers) and with the platforms you ask us to publish to. We disclose data when the law requires it.

Storage and security

Data is stored on our own server. Passwords are hashed (PBKDF2-SHA256), channel tokens are encrypted, connections use HTTPS, sign-in attempts are rate-limited and every decision is audited.

Retention

Account data is kept while the account exists and deleted within 30 days of a deletion request. Rejected sign-ups are deleted at once. Contact messages are kept for up to 24 months. Audit records of approvals and publications are kept as long as the related posts are public, plus 12 months.

Your rights

You can ask to access, correct or erase your personal data, withdraw consent, or nominate someone to act for you, and you can raise a grievance. Write to [email protected]. We reply within 30 days. If you are not satisfied, you may approach the Data Protection Board of India.

Data deletion

To delete your account, your contact messages or data received from Google or Meta, send a request to [email protected] from your registered e-mail address. We confirm when it is done.

Grievance officer

Grievance Officer, LumiLeads, Nashik, Maharashtra, India. Contact: [email protected].

Children

The Studio is for business use by adults and is not meant for anyone under 18.

Changes

We will post any change on this page with a new date.