Privacy Policy

This Privacy Policy explains how Lum Technologies (ABN 33 702 184 739), trading as Lumvest (“Lumvest”, “we”, “us”, “our”), handles personal information when you use the Lumvest application at app.lumvest.com (the “Service”). We handle personal information in accordance with the Privacy Act 1988 (Cth) and the Australian Privacy Principles (“APPs”).

1. The information we collect

Information you give us when you use the Service:

• Contact and account details. Your name, email address, and firm name, including the email address provided through our payment provider at checkout.
• Portfolio and upload data. The file you upload for analysis and its contents, such as holdings, tickers, quantities, cost basis, acquisition and disposal dates, and proceeds.
• Analysis parameters. The jurisdiction, entity type, marginal tax rate, and screening criteria you set.

Information we collect automatically:

• Payment information. When you pay, our payment provider, Stripe, collects and processes your payment details. We receive confirmation of payment and limited transaction metadata. We do not receive or store your full card number.
• Usage and analytics data. Pages viewed, session activity, browser type, device, and operating system, collected through PostHog. Our analytics are configured not to capture your IP address and to respect the “Do Not Track” browser signal.
• Technical logs. Limited operational logs collected for security, debugging, and the reliable running of the Service.

2. Information about other people

If you are an adviser or professional user, the portfolio data you upload may relate to your clients or to other individuals. You are responsible for ensuring you are authorised to provide that data to us and to have it processed under this policy, and for meeting any notice or consent obligations you owe those individuals. We process that data only to provide the Service to you.

3. How we use your information

We use personal information to:

• Produce your tax-loss-harvesting estimate and screening report.
• Process your payment and give you access to the report you paid for.
• Deliver your report and related communications, including by email.
• Operate, secure, support, and improve the Service.
• Respond to your enquiries and, during the pilot, extend pilot invitations.
• Meet our legal and regulatory obligations.

We do not sell your personal information, and we do not use your portfolio data for advertising.

4. Who we share it with

We share personal information with the service providers we rely on to run the Service, only to the extent each needs it for its function:

• Stripe (payment processing).
• Railway (backend application and database hosting).
• Vercel (frontend application hosting).
• EODHD (market price and reference data).
• PostHog (product analytics, configured without IP capture).
• Resend (delivery of transactional email, such as your report).

We may also disclose personal information where required by law, to enforce our Terms, or to protect the rights, property, or safety of Lumvest, our users, or others. We do not otherwise disclose your information to third parties without your consent.

5. Overseas disclosure

Some of our service providers store or process data outside Australia, including in the United States and the European Union. Where we disclose personal information overseas, we take reasonable steps to ensure it is handled consistently with the APPs, including by using reputable providers that offer recognised data-protection safeguards.

6. How we protect your information

We take reasonable steps to protect personal information from misuse, loss, and unauthorised access. These include encryption of data in transit and at rest, hosting with providers that maintain recognised security certifications, access controls, and the use of opaque, non-guessable tokens for access to quotes and reports. No method of transmission or storage is completely secure, and we cannot guarantee absolute security.

7. How long we keep it

• Paid reports and quotes are retained for 90 days from the date of payment, so you can re-download your report, and are then deleted.
• Unpaid uploads and quotes are deleted after a short grace period of 7 days.
• Contact and account information is retained for as long as needed to support your use of the Service or to meet a legal obligation, and is then deleted or de-identified.
• Analytics data is retained according to our analytics provider’s standard retention settings.

We run an automated deletion process so that data is removed on this schedule.

8. Cookies and analytics

We use a small number of cookies and similar technologies that are necessary for the Service to function and to keep it secure, including those set by our payment provider during checkout. Our analytics are configured to operate without capturing your IP address and to respect the “Do Not Track” signal. You can control cookies through your browser settings, although disabling necessary cookies may affect how the Service works.

9. Your rights

Under the Australian Privacy Principles, you may:

• Access the personal information we hold about you.
• Correct information that is inaccurate, out of date, or incomplete.
• Request deletion of your personal information, subject to any legal obligation we have to retain it.

To exercise any of these rights, contact inquiries@lumvest.com. We will respond within a reasonable time and may need to verify your identity first. There is normally no charge for an access request.

10. Direct marketing

We do not use your information for third-party marketing. During the pilot we may contact you about your access to the Service or to extend a pilot invitation. You can opt out of non-essential communications at any time by contacting inquiries@lumvest.com.

11. Children

The Service is intended for professional use by adults and is not directed at anyone under 18. We do not knowingly collect personal information from children.

12. Changes to this policy

We may update this Privacy Policy from time to time. The “Effective” date at the top reflects the current version. Where a change is significant, we will take reasonable steps to bring it to your attention.

13. How to contact us, and how to complain

For any privacy question or request, or to make a complaint about how we have handled your personal information, contact inquiries@lumvest.com. We will acknowledge your complaint and aim to resolve it promptly.

If you are not satisfied with our response, you may contact the Office of the Australian Information Commissioner (OAIC) at oaic.gov.au.