Privacy Policy

Data you provide directly:

• Email address — when you join the waitlist or create an account

• Password — encrypted, never stored in plain text

• Name — optional, only if you choose to provide it

• Payment information — processed directly by our payment provider. Lumaway never sees or stores your full card number.

Search data:

• Destination, origin, travel dates, number of travelers

• Budget and preferences

• Trip type and quality preferences

How AI uses your data:

When you search, your search parameters are sent to our AI ranking system to generate recommendations. The AI sees your destination, dates, budget, and preferences — and the travel options we found. It never receives your name, email, payment details, or anything that identifies you personally.

Automatically collected data:

• IP address — for security and approximate location only

• Browser type and device — for compatibility

• Pages visited — anonymized usage analytics

• Session data — to keep you logged in

Cookies:

We use session cookies to keep you logged in and preference cookies to remember your settings. We do not use advertising or tracking cookies. We do not track you across other websites.

We never:

• Sell your personal data

• Share your data with advertisers

• Use your searches to show you targeted ads

• Use your data to train AI models without explicit consent

• Share your travel preferences with airlines, hotels, or car companies

Service providers:

We work with trusted third-party service providers to operate Lumaway. These include providers for authentication and account management, payment processing, database hosting, website and API hosting, email delivery, and AI-powered ranking. All providers are bound by data processing agreements and are prohibited from using your data for their own purposes.

Travel data providers:

To fetch real-time flight, hotel, and car prices, your search parameters — destination, dates, and number of travelers — are sent to travel data providers. These providers receive search parameters only. They never receive your name, email, or account information.

Payment processing:

Payment information is handled by our payment processor directly. Lumaway never sees or stores your full card number, CVV, or complete payment details.

Affiliate partners:

When you click a booking button, you are redirected to a partner booking platform. The partner receives your search parameters pre-populated and an anonymous tracking ID. They do not receive your Lumaway account information or personal identity.

Legal requirements:

We may disclose your data if required by law or court order. We will notify you when legally permitted.

All users:

• **Access** — request a copy of your data

• **Correction** — request correction of inaccurate data

• **Deletion** — request deletion of your account and data

• **Portability** — request your data in a readable format

• **Opt-out** — unsubscribe from marketing emails at any time

EU and UK users (GDPR):

• Right to object to processing

• Right to restrict how we use your data

• Right to withdraw consent at any time

• Right to lodge a complaint with your local data protection authority

California users (CCPA):

• Right to know what data we collect

• Right to delete your data

• Right to opt-out of sale — we do not sell personal information

• Right to non-discrimination for exercising your rights