Privacy Policy
On this page
This Privacy Policy describes how Lumaa Voice AI Developing Services ("Lumaa", "we", "us") collects, uses, stores, and shares personal data. It is written to comply with UAE Federal Decree-Law No. 45 of 2021 on the Protection of Personal Data ("PDPL"), the UAE Telecommunications and Digital Government Regulatory Authority ("TDRA") consumer protection regulations, and applicable Dubai free-zone data-protection rules.
It applies to (a) visitors to lumaa.ai, (b) Clients who sign up to the Lumaa Service, and (c) end-users (call recipients) whose data Clients process via the Service.
1. Personal data we process
From Clients (account holders)
- Identity: name, role, company, trade licence number.
- Contact: email, phone.
- Authentication: email + scrypt-hashed password, optional PIN, session token.
- Billing: billing contact, payment method tokens (we never store full card numbers — those go to our payment processor), invoices.
From end-users (call recipients) — processed on behalf of the Client
- Phone number (E.164).
- Voice audio of calls placed by the Client's AI.
- Speech-to-text transcripts of those calls.
- Outcome / status fields the Client's AI infers from the call ("Interested", "Not interested", "Call back").
- Lead metadata the Client uploads (name, custom fields).
2. Why we process it (lawful bases)
| Purpose | Legal basis (UAE PDPL Art. 4) |
|---|---|
| Authenticating you and providing the Service | Contract performance |
| Billing and tax records | Legal obligation (UAE FTA) |
| Detecting abuse, fraud, AUP violations | Legitimate interests |
| Aggregate, anonymised analytics for product improvement | Legitimate interests |
| Calling and messaging you back after you ask for a demo or quote | Your request (UAE PDPL Art. 4: steps you asked us to take before a contract); you can ask us to stop at any time |
| Sending product updates / marketing | Consent; opt-out anytime |
3. How long we keep it
| Data class | Retention |
|---|---|
| Account credentials (active client) | Lifetime of the account |
| Account credentials (after termination) | 30 days, then hard-deleted |
| Audit log | 7 years (UAE consumer-protection record-keeping) |
| Call recordings | 90 days default, configurable per Client |
| Call transcripts | 90 days default, configurable per Client |
| Backups | 60 days rolling |
| Billing invoices | 5 years (UAE Federal Tax Authority compliance) |
4. Who we share it with
We share the personal data we process only with:
- Sub-processors listed in our Sub-processor List (AWS, OpenAI, Deepgram, ElevenLabs, payment processor, optional Twilio; for website enquiries also Telegram, which alerts our team, and WhatsApp (Meta), which we reply on). Each is contractually bound under a DPA.
- Authorities when compelled by a UAE court order, regulatory subpoena, or where disclosure is required by UAE law. We will notify the Client first unless legally prohibited.
- Successor entities in the event of a merger, acquisition, or asset sale — clients receive 30 days' notice.
We do not sell personal data to anyone, ever.
5. International transfers
Where your data is stored. Lumaa is a UAE company and hosts personal data in the UAE by default. Since the disruption to AWS's UAE infrastructure, our website, its database and the calling platform have run in the European Union (AWS Frankfurt, Germany) instead, where your data is protected by EU data-protection law (GDPR) as well as by this policy; we will move back to UAE hosting once it is available again. Some AI processing takes place with US-based providers, lead alerts reach our team through Telegram, and we reply over WhatsApp — all operated outside the UAE. We rely on Standard Contractual Clauses (or equivalent UAE PDPL adequate-protection mechanisms) with each non-UAE sub-processor, and each one is bound by a data-processing agreement. Clients who need a UAE-only deployment can ask for one, subject to availability.
6. Your rights under UAE PDPL
Under UAE PDPL Articles 13–22 (and analogous GDPR rights for EU subjects), you can:
- Access the personal data we hold about you.
- Rectify inaccuracies.
- Erase ("right to be forgotten") — subject to exceptions like legal-retention obligations.
- Restrict processing pending a dispute.
- Object to processing based on legitimate interests.
- Data portability — receive your data in a machine-readable format.
- Withdraw consent at any time where processing is consent-based.
- Lodge a complaint with the UAE Data Office or your local data-protection authority.
To exercise any right, leave your name and number on our contact form. We come back on WhatsApp and take the request there, and respond within 30 days.
7. Security
- Credentials hashed with scrypt (N=32768, salt per record).
- Local store at-rest encrypted with AES-256-GCM.
- TLS 1.2+ in transit; HSTS enforced.
- Production access scoped to named engineers via SSH keys; no shared accounts; quarterly access review.
- Annual penetration test; quarterly automated dependency scan.
- Incident response: data breach notification to clients within 72 hours of confirmed scope, per PDPL Art. 9.
8. Cookies
We use a minimal set of cookies. The CRM session cookie (lumaa_crm_session) is HttpOnly, Secure, SameSite=Lax, and used solely for authentication. We do not use third-party tracking cookies. Full details in our Cookie Policy.
9. Children
The Service is not directed at individuals under 18. We do not knowingly process data of minors. If you believe we have, leave your details on our contact form and we will take the detail on WhatsApp and delete the data immediately.
10. Changes
Material changes are notified to active Clients 30 days before they take effect. The "Effective" date at the top reflects the latest revision.
11. Contact
Data protection and general enquiries: the contact form on lumaa.ai — we reply on WhatsApp
Postal: Lumaa Voice AI Developing Services, Dubai, United Arab Emirates