How we handle your data.

Where is your data stored?

Lumicast runs on servers, storage and backups from Hetzner and DigitalOcean in Europe.

For a few parts we work with other providers, such as for email, video conversion, error reports and Lumi. Some of them may process data outside the EEA. That is only allowed with a valid GDPR transfer mechanism, such as standard contractual clauses. Which providers these are and what they process is listed in annex 3 of the data processing agreement. We announce a new provider at least 30 days in advance, and you can object.

Who can access it?

You decide who can do what. Lumicast checks access per organisation and workspace. With Team, colleagues get their own roles and permissions. On every plan, you can require two-step verification per workspace.

At Lumicast, only authorised founders and developers can access customer data, protected with multi-factor authentication. They only look when a task requires it, such as a support request. We handle support ourselves, without an external ticket system.

Credentials for your integrations are stored encrypted. Refresh tokens are stored hashed and replaced when used.

What does Lumi do with your content?

Lumi, our AI designer, sends your request and the content it needs to AI providers, including OpenAI. That processing may take place outside the EU. Normal use of Lumi gives no one permission to use your content to train AI models.

Lumi is optional: it stays off until an owner turns it on, and owners and administrators can switch it off for the whole organisation. With Lumi off, nothing from your pages or prompts goes to AI providers; setting up a brand kit from your own website only uses that site’s public data. What AI providers may keep is listed in annex 3 of the data processing agreement.

Integrations such as Zermelo

The Zermelo partner integration retrieves only the timetable fields the school allows: times, subjects, teacher codes, groups, rooms and changes. It does not retrieve pupil or teacher names. Annex 1 of the data processing agreement explains how we process this data. Photos or names a school adds to a page itself are separate customer content.

We keep the latest data and overwrite it with each update. Deleting the data source also removes the retrieved data. Lumi only works on a user’s instruction, but can then look up and read the content that user can access in the workspace, including rows from connected data sources. When Lumi is disabled, no data from your data sources is sent to Lumi’s AI providers.

Microsoft Power BI

Connect a Microsoft account, then choose a semantic model and a DAX query. Lumicast requests read access to Power BI workspaces and models and runs the query on behalf of that account. The result is stored as a data source in Lumicast. The connection does not modify your Power BI model. Use an account with access to the data you need and choose carefully what to put on the page: anything you show is visible to everyone who can see the display.

If something goes wrong

If a security incident affects your personal data, we report it without undue delay, also outside office hours. You get the known facts, the likely consequences and what we are doing about it, followed by updates.

We are not ISO certified. The measures we do take are listed in appendix 2 of the data processing agreement.

When you cancel

Cancelling doesn't delete your account and content automatically. Up to 30 days after your subscription ends, you can request an export. After that, we delete active customer content within 30 days.

Single sign-on and audit log overview

Single sign-on (SAML) and an audit log overview for the whole organisation come with Enterprise, an extension of Team with no minimum display count. Actions taken by a connected AI assistant are logged on every plan.

Read the full agreements

The data processing agreement is published online, you don't need to request it. New customers agree to it when they sign up and are covered from that moment. For existing customers it applies once an owner agrees in Lumicast, and at the latest from the effective date shown on the data processing agreement page. Your IT department can find the network requirements for the players in our documentation, and the REST API in the API documentation.

Does your organisation use its own data processing agreement, such as the model agreement from the Dutch education privacy covenant (Privacyconvenant Onderwijs)? Send it to [email protected]. We'll go through it with you and sign it once we agree on its content.

• Data processing agreement
• Privacy notice
• Lumi and AI
• Network requirements
• API documentation