Privacy policy

Who takes care of the data

• Controller: Lumelar, which decides how the platform processes data.
• Processors: contracted companies that process data only on our instructions: AI provider (OpenAI), voice transcription (AssemblyAI, in the European Union), email (Resend) and hosting.
• You and your home: decide who else sees your children's data. No one outside the home sees anything without your invitation.

What data and why

• Account: name, email and language, so you can sign in and get notices.
• Children: name and date of birth, only with a parent's specific consent (art. 14), to organize their care.
• Health (vaccines, appointments, medications): sensitive data, handled only with your consent, to remind and organize.
• Finances: entries and goals you add or import.
• Documents: stored encrypted and never sent to AI without an explicit request.

Sign in with Google

If you choose to sign in with Google, we receive from Google only your name, email address and profile picture.

• Purpose: to create and identify your Lumelar account and show your name and photo to the people in your family. We do not use this data for any other purpose.
• What we don't do: we do not access Gmail, Calendar, Drive, contacts or any other data in your Google account; we do not sell it, use it for advertising, or use Google data to train AI models.
• Sharing: this data is not shared with third parties, except our hosting provider, which stores it under our instructions.
• Deletion: when you delete your account in Settings → Privacy, we delete this data. You can also remove Lumelar's access at myaccount.google.com/permissions.
• Lumelar's use of information received from Google APIs adheres to the Google API Services User Data Policy, including the Limited Use requirements.

Children's photos

• We only keep children's photos with a parent's specific permission, asked on the first photo.
• Photos are resized on your device (no location), stored encrypted and never sent to AI.
• People who see photos on screen can't download the originals. Screenshots can't be prevented: invite only people you trust.
• You can delete any photo anytime. When the family is deleted, photos become unreadable forever, backups included.

People with limited access

Besides the adults of the home, you can invite people from outside, always choosing the children and what each one sees:

• Co-parent (the father or mother in another home): sees, per child, health, schedule and custody, the child's documents and moments, as allowed. Under shared custody, both parents are entitled to information about the children's health and school. Never sees finances, tasks, conversations or the home's adults' data.
• Relative (grandparents, aunts, uncles and others): sees only the photos and moments marked Family of the chosen grandchildren, and can send hearts and comments. Sharing with relatives requires its own permission from whoever invites.
• Moments marked “Just the home” never show up for anyone outside.
• Every invitation, access change and revocation is recorded in the family's history.

How to revoke or leave

• The home's adults revoke anyone's access in Settings › People with access. Access ends right away, on every device.
• In case of a protective order or court decision, revoke right away: it is recorded.
• People with limited access can leave on their own in Settings. What they wrote (comments, notes, recorded doses) stays with the family; a relative's export has only their own data, never the children's photos.
• Consents (children's data, health, photos, sharing with relatives, AI memory) are revoked in Settings › Privacy and data.

Who we share with

Only with the processors above, under contract. This may involve international transfer (art. 33). We don't sell data and we don't use children's photos for anything other than showing them to the people you chose.

Your rights

• See, correct, export and delete your data and your family's.
• See and delete everything the AI partner remembers.
• Revoke consents anytime in Settings.

Contact

Data protection officer (DPO, Brazil's LGPD art. 41): Alexandre Garcia Torres, at [email protected]. Write to him to exercise your data subject rights or ask about your data. Recording audio is deleted after transcription, and photos imported for reading are deleted afterwards, unless you choose to keep them.

Payments

• Stripe: processes Family+ payments as a processor. Card details go straight to Stripe; Lumelar only keeps the customer identifier, the status and the subscription dates.
• Malvo (Open Finance): if you connect a bank, Malvo receives the authorization you give in your bank's app and sends us accounts, balances and transactions (date, amount and description). It's read-only: nobody can pay or transfer. Disconnect any time in Finances, and the authorization is revoked at the bank. Credit top-ups for extra banks are paid through Stripe.