Luminel

Legal

Privacy Policy

Last updated: October 11, 2026

Overview

Luminel is a privacy-focused web analytics platform. We are committed to collecting only what is strictly necessary to provide the service: no personal data, no cookies, no cross-site tracking.

This policy covers two distinct contexts: (1) data collected from visitors of websites that use the Luminel analytics script, and (2) data collected from Luminel account holders who use our dashboard.

Data Collected from Website Visitors

When a website uses Luminel, our script records the following information for each pageview:

  • Page URL, page title and referrer
  • The browser's user-agent string, and the browser name and version read from it
  • Operating system
  • Device type (desktop, mobile, tablet)
  • Country, region, and city (derived from IP address)
  • Screen viewport size
  • Preferred language
  • Time zone, as reported by the browser
  • Connection type (for example "4g"), where the browser reports one
  • UTM campaign parameters (if present in the URL)
  • Whether the visit came from the site owner's own machine during development, when the owner has chosen to record those. Such visits are kept out of the site's statistics

A website can also choose to send custom events. For each one we store the event's name, the page it was sent from, the referrer, country, browser, operating system and device type, and any properties that website attaches to it.

A website can also report visits from automated crawlers (search engines and AI assistants) from its own server, because those crawlers do not run the script. For each one we store the page path, the hostname requested, the referrer if any, and the crawler's user-agent string. These are records of software, not of people: no IP address, location or session is stored with them, and a report whose user agent is not a known crawler is discarded.

We do not collect or store IP addresses. IP addresses are used only in-flight to derive geo information and to generate a deterministic, anonymous session ID, then immediately discarded.

Session and visit IDs are computed as cryptographic hashes of the website ID, a hashed IP, the user-agent string, and a time-based salt (monthly for sessions, hourly for visits). This means two pageviews from the same person are grouped together for analytics purposes without storing any persistent identifier. No cookies are set.

Data Collected from Account Holders

To use the Luminel dashboard, you sign in with Google OAuth. We store:

  • Your name and email address (from Google)
  • Your profile picture URL
  • A session token for keeping you logged in
  • The websites you add to your account
  • If you connect Google Search Console: an access token, stored encrypted, and the search queries, pages, clicks, impressions and positions Google reports for your site
  • If you import from Google Analytics: daily totals copied from your property. The access token is deleted as soon as the import finishes
  • If you use AI visibility tracking: the prompts, brand and competitor names you enter, and the answers AI assistants give to those prompts
  • Email addresses of people you invite to view a site
  • If you connect a payment provider for revenue tracking: the amount, currency and the provider's payment and customer IDs for each sale, and your webhook signing secret, stored encrypted. We never receive card details
  • If you buy a paid plan: which plan, its status and renewal date, and Polar's customer and subscription IDs. Card details and billing addresses stay with Polar
  • The number of pageviews your sites record each month, to compare with your plan. A total only, with nothing about any visitor
  • Which one-off plan emails we have sent you (such as a trial ending), so each is sent only once

We do not sell, share, or use this information for advertising purposes. It is used solely to authenticate you and associate your analytics data with your account.

Cookies

Luminel does not set any cookies on visitors of tracked websites. For dashboard users, a session cookie is set by BetterAuth to maintain your login state. This cookie is strictly necessary for the service to function and expires when your session ends or after 7 days.

Data Retention

Analytics data (pageviews, events) is retained for as long as your account is active, or for the shorter period you choose in a site's settings or your plan includes. If your plan would remove history you already have, you are emailed first and nothing is removed for 30 days. Daily totals imported from Google Analytics are kept regardless. Search Console rankings are kept for about 16 months and stored AI answers for 12 months. You may delete a website and all its associated data from the dashboard at any time.

You can delete your account yourself under Settings in the dashboard. Doing so immediately and permanently removes your account, every site you own, all analytics recorded for them, connected Google tokens, API keys and team access.

Data Storage & Security

All data is stored in a PostgreSQL database hosted on Neon, with encryption at rest and in transit (TLS). The Luminel application is hosted on Vercel. Both providers maintain SOC 2 compliance.

Third-Party Services

We use the following third-party services:

  • Google OAuth: for account authentication
  • Neon: serverless PostgreSQL database
  • Vercel: application hosting and edge infrastructure. It also measures how fast pages of luminel.app load, without cookies, from the page address and the browser and device type
  • Resend: sends the emails you receive from us (weekly summaries, alerts and invitations). It processes the recipient's email address and the message
  • Google Search Console and Google Analytics: only if you choose to connect them, to read data about your own site with read-only access
  • Stripe or LemonSqueezy: only if you connect one for revenue tracking. They send us notifications of your sales; we send them nothing
  • Polar: only if you buy a paid plan. Polar is the merchant of record: it takes the payment, handles sales tax and keeps the invoices. It receives your email address and Luminel account ID when you start a checkout
  • OpenRouter and the AI model providers it routes to (OpenAI, Anthropic, Google and Perplexity): only for AI visibility tracking. They receive the prompts you enter. No visitor data and no account details are sent

Each of these services has their own privacy policy and data processing agreements.

GDPR & Privacy Regulations

Because Luminel does not use cookies, does not track visitors across sites, and does not store personal data about website visitors, it is designed to be used without a cookie consent banner. However, compliance ultimately depends on your specific use case and jurisdiction. We recommend consulting a legal professional if you have specific compliance requirements.

Your Rights

As a Luminel account holder, you can export a site's data and delete your account from the dashboard at any time, and turn the weekly summary email off under Settings or with the unsubscribe link in each email. You may also request access to, correction of, or deletion of your personal data. To exercise these rights, contact us at hello@luminel.app.

Changes to This Policy

We may update this policy from time to time. If we make material changes, we will update the date at the top of this page. Continued use of Luminel after changes constitutes acceptance of the updated policy.

Contact

Questions about this policy? Reach us at hello@luminel.app.