Privacy notice

1. Who we are

This website is run by Lumina Frontier AG, c/o Stiftung Technopark Zürich, Technoparkstrasse 1, 8005 Zürich, Switzerland, entered in the commercial register of the Canton of Zurich under the number CHE-292.281.776. Under Swiss data protection law, and the GDPR where it applies, we are the controller of website personal data. For a hotel's connected Google data, we act on that hotel's instructions as described in section 10.

For anything on this page, write to marco.dicesare@luminafrontier.ai.

2. What this covers

This notice is about this website: the pages you are reading, the walkthrough form, and the Grand Concierge demonstration.

It also covers Lumina when you use it inside an AI assistant such as ChatGPT or Claude: see section 9.

This notice also covers Google Ads, Google Search Console and Google Analytics account connections in the Lumina application: see section 10. Other processing of a hotel's material in the Lumina product is covered by the hotel's signed agreement and its data processing terms. The hotel is the controller and we act on its instructions.

3. What we collect

If you ask for a walkthrough

The work email address and the hotel or group you type into the form, and a note of which part of the site you asked from. Those three fields are all the form sends.

If you use the Grand Concierge demonstration

What you type or say to it, the answers it gives you, and any public web address you give it to read. If you speak, the audio is sent for transcription and not kept. We keep the conversation, your messages and its answers, in our own database, so that we can read what hotels ask and make the answers better. A copy also lives in your browser's session storage and is gone when you close the tab.

Automatically, when you load a page

We count visits ourselves, on our own server. No other company is involved in that count. Statistics and advertising cookies are separate, and load only if you accept them in the cookie banner.

For each visit we record which pages you opened, how far down you read, which buttons you pressed, which country you are in, and whether you are on a phone or a computer. If you use one of the free tools, we also record which hotel website you gave it and how long the work took. What you type into the Concierge, and what it answers, we do record: see above.

The country comes from our host, which reads it from your connection. We do not look your address up anywhere, and we do not keep it. Our host also records ordinary server logs, and we hold your address briefly in memory to stop one visitor running up a bill on the endpoints that cost us money.

We keep one small file in your browser so we can tell how many people come back. There is no name in it and no data: it is a random string, this site is the only one that can read it, and it lasts thirteen months without renewing itself. It lets us say “a third of visitors return”. It can never say who they were.

If you buy a report

Stripe collects the payment on its hosted checkout. We receive your name, email address, the report and language selected, the payment status and the order reference so that we can deliver your PDF and help with the purchase. Your card details go directly to Stripe; our website does not receive them. Buying a report does not subscribe you to a newsletter.

A necessary, signed cookie links your browser to the checkout for up to 24 hours. It allows us to verify payment when you return and show the download. It contains an order reference, the report and language, not your name, email or card details.

If you ask what people ask ChatGPT about your hotel

We keep your work email, the hotel and whether your address is on its domain. We use them to send the private page you requested and reply to any factual correction you submit. A correction includes your text and the link you provide as evidence. Resend delivers the email.

DataForSEO supplies questions from its ChatGPT corpus. Questions to the guide’s Concierge appear only as counts by topic once there are at least three in a group, without a visitor’s words.

If you give us your email

If you request a Hotel Ads notification, we use your email to send a link when that image is ready. The field is optional. The notification request and private result link expire after 24 hours; the contact follows the retention period for requests below.

From that moment we know it was you, and the visit you are in gets your name on it. Earlier visits do not. They stay anonymous, and there is no way for us to go back and claim them.

What we do not collect

• One third-party measurement tool works outside the cookie banner: DataFast. It sets a first-party cookie holding a random identifier for your browser, so that a visit today and a signature in three months count as one person. If you give us your email, DataFast is told that identifier and nothing else, never your address, your name or your hotel. Only our own database can say who it belongs to. A second one, Seline, counts the same visits without cookies: it keeps nothing in your browser and recognises a returning browser for one day only, by a code it changes every day. It receives the random number of your visit on this site and, if you give us your email, the same identifier DataFast receives, never your address, your name, your hotel or anything you type. PostHog, on its servers in the European Union, records how the pages are used, the replay of a visit included, without cookies and without your IP address: it keeps one random number for the open tab, gone when you close it, and everything you type is masked before it leaves your browser.
• No advertising cookie and no Google Analytics cookie without your consent. Google Analytics loads only if you accept statistics in the cookie banner. LinkedIn Insight Tag loads only if you accept marketing. The OpenAI Ads pixel loads only if you accept marketing. The Meta pixel loads only if you accept marketing. Google Ads loads before you choose too, but without cookies or advertising identifiers until you accept marketing. You can change your choices from “Cookie preferences” at the foot of every page.
• No newsletter list you did not ask to be on.

The guide’s Concierge uses your question, the hotel page and the occasion you are reading to answer from Lumina’s saved hotel data. It does not search the web. CONCIERGE_GUIDE_ROUTES selects the guide’s model suppliers named here; when absent the guide uses LLM API. When CONCIERGE_TRANSCRIPTS is 1, we keep your question, its answer, the hotel slug and occasion for twenty five months to improve answers and understand questions about each hotel. When it is off, we keep the question, hotel slug and occasion with the cost receipt, without the answer. Signed x-gc-lab tests and visits marked lumina_test=1 are excluded from these traveller records. The Concierge keeps the conversation in the open page’s memory. Choosing to keep an answer stores its question, answer, date and sources on this device until you clear local storage; sharing happens only when you choose it. Avoid personal details in questions.

When you choose to share a Concierge answer, the link carries that question, the complete answer, its date and the sources that fit. It does not add your email, name or conversation identifier. Anyone with the link can read the shared text. Creating or opening this link does not store a separate copy on our server. The hotel page removes the shared text from the address before visit measurement; keeping it on a phone or requesting an email remains a separate choice.

We use your email to send a private link to your choices and answers. No newsletter. The link lasts 90 days. Choices kept on this phone stay in local storage until you clear them. For email delivery, Resend receives your address and the encrypted link. We retain the request under the retention period for contacts below. Your consent is the basis for the requested email; you can request deletion using the contact below.

4. Why, and on what basis

• To answer you. If you send the form, we use your email to write back about a walkthrough. Our basis is your request and our legitimate interest in replying to it.
• To run the demonstration, and to improve it. What you type is used to produce an answer. We also read the conversations, to see what hotels ask and to make the answers better. Our basis is our legitimate interest in a demonstration that works.
• To keep the site up. Logs and a short rate limit keep the site available and stop the API keys being drained. Our basis is our legitimate interest in a working website.
• To understand how the site is used, if you accept statistics. Google Analytics tells us, in aggregate, which pages are read, for how long and where visitors come from. Our basis is your consent, which you can withdraw at any time from Cookie preferences.
• To measure our advertising, if you accept marketing. Meta, Google Ads and LinkedIn tell us which of our ads brought a hotel to this site, and let us show our ads to people who have visited it. Our basis is your consent, which you can withdraw at any time from Cookie preferences.
• To estimate what our ads achieve, without cookies. Before you answer, and if you reject, Google Ads receives signals without cookies or advertising identifiers. They tell Google that a page was viewed or that a request was sent, along with the technical details any web request carries. Google uses them in aggregate to estimate the results of our ads. Our basis is our legitimate interest in knowing whether our advertising works.
• To count visits. We use the numbers to see which pages work and which do not. The law lets us do this without asking you first, as long as we only produce anonymous figures about our own site and never join them to a person. That is exactly the line we hold, and we hold it in the way the data is stored, not only as a promise.

We do not sell personal data, and we do not make automated decisions about you that have legal effects. We share data for advertising only as described under Cookies, and only if you accept.

5. Suppliers who see it

We use the suppliers below to run this website. Each one receives only the part it needs to do its job, under a data processing agreement.

• VercelHosts the website and its endpoints. Receives request metadata and the form fields in transit.
• ResendDelivers the walkthrough request to us as email. Receives the work email and the hotel you typed.
• LLM APIRoutes the Grand Concierge, the site’s live chat and the guide’s Concierge to a model. Receives the conversation and the material needed for the answer.
• DiscordReceives the messages you write in the site’s live chat, and the work email and phone number you leave there, so the team can read and answer them.
• TypeSafeDecides how the Grand Concierge should treat a message: whether it names a hotel, and which prepared answer fits. Receives the message you typed and, to check it, the answer. United States.
• Exa and FirecrawlFind and read public pages when the Grand Concierge needs them. Receive the search it runs, which is built from what you asked, and the public address it reads.
• GoogleWhen you ask the Concierge where to stay, turns your question into a form our hotel guide can be searched with. Also writes the guide’s Concierge answers through LLM API. Receives the question and, for these answers, the conversation and the hotel material needed to answer.
• DataForSEOSupplies questions people ask ChatGPT about a hotel. Receives the hotel’s name and no information about the person requesting them.
• SupabaseHosts our database, in Zurich. Holds what this notice says we keep.
• SelineCounts visits and clicks on this site, without cookies. Receives the address of the page, technical details of your browser and connection, the random number of your visit and, if you give us your email, the random identifier our database holds for you. If you buy a report, it reads that payment from Stripe with read-only access, to show which visit and channel led to it.
• StripeProcesses report payments and keeps the order record. Receives the details you enter on its checkout.
• Cal.comBooks the call when you pick a time. Receives your name, your email and your hotel.

Every account we hold with them is in the European Union, and we are moving data residency to Switzerland. Some of them still process in the United States. For recipients certified under the Swiss–US Data Privacy Framework, the Swiss Federal Council recognised the country as adequate on 15 September 2024. Where a supplier is not certified we use the standard contractual clauses of the European Commission with the amendments Switzerland requires, and a transfer assessment. Ask and we will tell you which route applies to each supplier today.

If you accept marketing cookies, two more companies receive data from your browser: Meta Platforms Ireland and Google Ireland. They receive the address of the page, technical details of your browser and connection, and the identifiers in their own cookies. When you send the form on one of our ad pages, they also receive the fact that a request was made. They never receive your name, your email or your hotel from us. For collecting and passing on that data we are joint controllers with each of them; what they do with it afterwards is governed by their own privacy policies. Google Ads also receives the signals without cookies described above, whether or not you accept. Both may process data in the United States, and both are certified under the Data Privacy Framework.

When you start a new Ad Generator, Newsletter, Articles, Replies or Music job in the Lumina app, Google Ads receives a Run Started conversion. We send the tool name, a general tool address and a hashed event identifier, without the hotel you entered, your email, account details or the private job link. Your marketing choice controls advertising cookies; without permission, Google receives a cookieless signal as described above. Returning to an existing job does not send another start conversion.

When Cal confirms a new call booked on this site, Meta receives a Lead event for the confirmed call only if you have accepted marketing. It contains the landing-page variant and a hashed event identifier to avoid counting the same booking twice. We do not send your name, email, hotel, meeting time or booking link to Meta. Opening the calendar or selecting a time does not send this conversion.

When you start a new Replies or Music job in the Lumina app, Meta receives a RunStarted event only if you have accepted marketing. It receives which tool you started, a hashed event identifier and the technical browser and cookie information described above. It does not receive your hotel input, email, account details or the private link to your job. Returning to an existing job does not send a new start event.

The OpenAI Ads pixel loads only after you accept marketing. It measures page views, report checkouts and purchases, and confirmed requests for free reports, materials or a walkthrough. We also send confirmed leads and report checkout and purchase events through OpenAI’s Conversions API, using the same event identifier to avoid counting them twice. Paid report events include the report, language, amount and currency. Meta receives the corresponding checkout and purchase events with the report and value. We share the page address without query parameters and, when available, OpenAI’s ad-click and browser references. Our server integration does not send your name, email address, hotel, role or internal lead identifier. The pixel’s attribution cookie lasts up to 30 days and its browser-reference cookie up to 365 days. Withdrawing marketing consent stops new events and removes both cookies.

OpenAI handles advertising measurement data under its own privacy policy. If automatic advanced matching is enabled in Ads Manager, its pixel can detect supported contact information and send browser-generated SHA-256 hashes with conversion events. OpenAI privacy policy.

LinkedIn Insight Tag loads only if you accept marketing. LinkedIn Ireland receives page visits and conversion events after a confirmed founding hotel application or report request. With advertising consent, we may save LinkedIn’s advertising identifier with your request and, after verifying the hotel and your role, send a separate qualified-lead event through LinkedIn’s Conversions API. We check that advertising consent is still in force before sending; withdrawing it from Cookie preferences stops future qualified-lead sends for requests linked to the same advertising identifier. We do not send your name, email address, hotel, role or our internal lead identifier. This supports advertising attribution, campaign optimisation and website audiences. LinkedIn uses cookies and a first-party advertising identifier; see LinkedIn’s cookie policy for their lifetimes and LinkedIn’s privacy policy for processing and transfers.

If you accept statistics, Google Ireland also receives data through Google Analytics. It receives the pages you view and how you move between them, technical details of your browser and device, and the identifier in its own cookie. Google Analytics does not store IP addresses. For this Google acts on our behalf, under its data processing terms, and may process the data in the United States under the Data Privacy Framework.

Stripe handles checkout and payment data under its own privacy policy. Resend receives the buyer’s email address and delivers the report link.

We do not share your details with anyone else.

Nothing on this site is compulsory. If you would rather not leave an email, write to us from wherever you like and nothing is lost.

6. How long we keep it

• A walkthrough request stays in our email while we are in touch and for up to twenty four months afterwards, so we can remember what we discussed.
• The private page about your hotel expires after thirty days. Your request and factual corrections are kept for up to twenty four months.
• Concierge conversations, your messages and its answers, are deleted automatically after twenty five months.
• What an AI assistant sends to Lumina is not stored at all (section 9).
• The rate limit holds an address for ten minutes and then forgets it.
• Server logs follow our host's retention, which is short and measured in days.
• The file in your browser lasts thirteen months and does not renew itself.
• The visit numbers are deleted automatically after twenty five months.
• Your answer in the cookie banner stays in your browser for six months, and then we ask again. The record of each answer on our server is deleted after twenty five months.
• Meta’s and Google’s advertising cookies, if you accept marketing, last up to ninety days. Google Analytics’ cookies, if you accept statistics, last thirteen months, and Google Analytics keeps the data for fourteen months.
• If you have written to us, your history with us lasts as long as we are in touch.

7. Your rights

You can ask us to:

• send you a copy of what we hold about you
• correct it, or delete it
• stop using it while a question is open
• hand it over in a portable file
• stop holding it at all

Write to marco.dicesare@luminafrontier.ai and we will answer within thirty days, usually much sooner. We will only ask enough to be sure it is you.

If you think we have got it wrong, you can complain to the Swiss Federal Data Protection and Information Commissioner. In the EU or the UK you can go to your own supervisory authority instead. We would rather you told us first.

8. Cookies

Lumina’s own anonymous audience count sets one cookie of its own. Third-party measurement is described above.

There is no name in it and no data: a random string, readable only by this site, that lasts thirteen months and never renews itself. It exists so that we can tell how many people come back. Those numbers are never joined to anyone's name, not because we promise not to, but because the two things are kept in separate places with no key between them.

If you would rather we did not include your visits in Lumina’s anonymous audience count, turn it off here and we will stop.

Statistics and advertising cookies, only if you accept

On your first visit a banner asks about two purposes separately: statistics (Google Analytics) and marketing (Meta, Google Ads, LinkedIn and OpenAI Ads). Accept agrees to both, Reject to neither, and Customise lets you choose. Until you answer, and if you reject, nothing from Meta, LinkedIn, OpenAI Ads or Google Analytics loads and Google Ads works without cookies or advertising identifiers. If you accept marketing, Meta and Google Ads set their own cookies (_fbp from Meta, _gcl_au from Google, each for up to ninety days). They tell us which of our ads brought a hotel here. If you accept statistics, Google Analytics sets _ga and _ga_… for thirteen months.

Your answer is kept in your browser’s local storage for six months, with a random identifier. A cookie shares only your marketing choice, its date and wording version with the Lumina app, so the tools respect the same choice. We also record the answer on our server, with the date and the version of the wording you saw, so that we can show it was given. That record holds no name and is not joined to your visits.

You can change your answer at any time: open Cookie preferences, or use “Cookie preferences” at the foot of every page. If you withdraw, we remove their cookies from this site.

The Grand Concierge uses your browser's session storage, which is not a cookie and clears when you close the tab.

Separately, if you press Add to preferred sources on Google, in the footer or at the end of a study, Google records that choice in your own Google account, under Google's privacy policy.

9. Lumina in ChatGPT, Claude and other assistants

Lumina can be added to an AI assistant, such as ChatGPT or Claude, to help you choose a hotel. This section covers what Lumina receives there. The conversation itself is governed by the assistant you use and its own privacy policy.

What Lumina receives

Only what the assistant sends when it calls Lumina, and only to answer that request. That means the trip as you described it, such as the destination, the dates or the month, the number of nights, how many adults and the ages of any children. It can also include a budget, how you want to arrive, what matters to you, a diet, the hotels you named or ruled out, and your language. Sometimes the assistant also sends your request in your own words.

The assistant may add technical details of its own to each request, such as an approximate location or your language setting. Lumina does not use them.

Lumina does not receive your name, your email address, your account with the assistant or the rest of your conversation. Requests come from the assistant’s servers, not from your device, so a request does not carry your internet address.

Why

To answer that one request: to choose the hotels that fit your trip and show you the proof. We use it for nothing else: no profile, no advertising, no training of AI models.

Lumina’s answer repeats the trip details it used, such as the dates, who is travelling and the budget, so you can check what it understood. It goes back only to the assistant that asked.

Who sees it

• VercelRuns the server that answers. Receives the request in transit.
• Google (Gemini API)Receives the words a request asks Lumina to search for, such as your description of the trip or a question about a hotel. Turns them into numbers, so Lumina can find the matching passage.
• DataForSEOSupplies questions people ask ChatGPT about a hotel. Receives the hotel’s name and no information about the person requesting them.
• SupabaseHolds Lumina’s hotel guide. Receives the search as numbers, with the destination and the hotels concerned and, when prices are read, the dates and who is travelling (adults and children’s ages); never your words.
• ParallelWhen Lumina’s guide does not hold the answer to a question about a hotel, searches that hotel’s own website for it, from the United States. Receives the hotel’s name and the question and, for a family trip, the children’s ages; nothing that says who you are.

When the assistant shows Lumina’s view, your browser loads it like any page on the web. It loads the photos from our website or from our storage at Supabase, the map from OpenFreeMap and Esri (ArcGIS), and the stills of video scenes from YouTube. A video opens on YouTube only if you choose to watch it. Those sites, ours included, receive an ordinary web request from your browser, with its internet address; we do not link it to the trip. A link that leaves the view carries a label saying the visit came from Lumina; the label says nothing about you.

How long we keep it

We keep none of it. The request is used to work out the answer and then it is gone: it is not stored, not linked to any other request and not linked to you. Our host records that a request was made, with its time, its status and the address of the assistant’s server that sent it, and deletes that record within thirty days at most.

Your choices

• You decide what you tell the assistant. Lumina works without your name or your contact details.
• You can remove Lumina from your assistant at any time, in the assistant’s settings.
• Because we keep nothing from these requests, there is nothing of yours for us to delete. For any question, or to use the rights in section 7, write to marco.dicesare@luminafrontier.ai.

Lumina is meant for adults planning a trip. Children’s ages are used only to check a hotel’s rules on age, whether a room fits the party and which collected prices apply to it.

10. Google account connections in Lumina

Connecting a Google account is optional. In Context → Integrations, you choose which service to connect and approve its permission on Google's consent screen. Each connection requests only its own permission. A connection belongs to the active hotel in Lumina; you must be authorised to share the selected account or property with that hotel's team.

What we access and save

• Google Ads: accessible advertiser accounts, account identifiers and names, campaign identifiers, names and status, and performance such as impressions, clicks, cost and conversions. You select the advertiser account and the campaigns to report on. We save that selection and its latest report. The connection uses the adwords permission because Google Ads provides no narrower read-only OAuth scope. This integration reads reports; it does not create, edit, publish or delete campaigns.
• Google Search Console: accessible sites, their identifiers and your access level, and search performance such as clicks, impressions, click-through rate and average position, with date, page and query breakdowns. You select the site. We save that selection and its latest report. The connection uses the webmasters.readonly permission and does not change your site or Search Console settings.
• Google Analytics 4: accessible Analytics accounts and properties, their identifiers and names, the selected property's timezone and currency, and aggregate active users, sessions, page and screen views, engagement rate and key events, with channel, page or screen, and daily breakdowns. You select one GA4 property. We save that selection and its latest report. The connection uses analytics.readonly; it does not change Analytics settings or install tracking, and does not request individual user identifiers or event logs.

Property and account discovery lets you make that choice; it does not automatically import every accessible account into the hotel. A selected GA4 property can contain several websites, apps or hotels. Its report covers the whole property, so select one this team is allowed to see.

Why we use it and who can see it

We use this data to display the selected service's performance in Lumina for the active hotel. Saved reports are available to authorised members of that hotel's team. Managing a connection, changing its selection, refreshing results or disconnecting requires the application's management permission and the identity of the person who connected the Google account.

Google supplies the data after you authorise access. Vercel processes requests for the application and Supabase stores connection information and saved reports on our behalf. OAuth access and refresh tokens are encrypted on the server and kept apart from report data. They are not sent to the browser or made available to hotel team members. People providing support access connected data only with your agreement or when necessary for security or legal obligations.

We do not sell connected Google data, use it to target or serve advertising, or send it to advertising measurement services. These connectors do not send Google account data or reports to AI models, and we do not use them to train AI models. The site's advertising tags and AI-assistant features described elsewhere in this notice do not receive these connectors' Google data.

Lumina's use and transfer to any other app of information received from Google APIs will adhere to the Google API Services User Data Policy, including the Limited Use requirements.

How we protect Google user data

We protect Google user data during transfer with HTTPS/TLS. Stored reports and connection records are encrypted at rest by Supabase’s infrastructure, as described in Supabase’s security information.

Before saving OAuth access and refresh tokens, Lumina additionally encrypts them with AES-256-GCM. The encryption key is kept in server-side configuration. This application-level encryption protects tokens; saved reports rely on Supabase’s infrastructure encryption.

Users must sign in to access Google reports. Access checks limit reports to authorised members of the relevant hotel. Connection management also checks management permissions and the identity of the user who connected the account.

Credentials are stored separately from saved reports. Only server-side services can access stored credentials.

Retention, disconnection and deletion

We retain the saved connection, its encrypted tokens and its latest report while it remains connected, until you disconnect it or request deletion. Refreshing replaces the saved report; the connector does not build a separate report history. Data may also be removed when the associated hotel or account is deleted.

The person who connected the account can choose Disconnect in Context → Integrations. This deletes the connection, its saved results and its stored tokens from active application storage for that hotel and service. It stops that connection from reading new data. It does not delete anything from Google, change tracking, disconnect other hotel connections or revoke the app's Google permission as a whole.

You can also revoke Lumina's permission in your Google Account connections. This prevents further access under that permission and may affect other Lumina connections using it. Revocation alone does not delete reports already saved in Lumina: use Disconnect or ask us to delete them.

For access, correction or deletion requests, use the contact in section 7. If you cannot disconnect a connection yourself, tell us which hotel and service it concerns so we can verify your authority and help remove it.

11. Changes

If this notice changes we update the date at the top. If a change affects someone who has already written to us, we email them as well.