This policy explains what personal information Lumios collects, why, and who else processes it. The responsible party under POPIA is Ellac Thendo Motloung, 3 Sea Cottage, Milnerton, Cape Town, 7441, South Africa. The information officer is Ellac Thendo Motloung (motlounget123@gmail.com).
What we collect
- Account — your email address and name, from the identity provider you sign in with.
- Your projects — what you describe, the plans and code generated, and the files in your workspace.
- Credentials you connect — your Claude, GitHub and Expo tokens. These are encrypted at rest and are used only to run your own builds.
- Billing — your subscription status, payment dates and amounts. We do not receive or store card numbers.
- Usage — when you were last active, and resource usage per project, so we can keep the platform running.
Who else processes it (operators)
- Auth0 (Okta) — sign-in. They hold your login credentials; we never see your password.
- PayFast (Payfast (Pty) Ltd) — payments. We send them your name, email address, the amount and our own payment reference, and nothing else. Your card details are entered on their site and never reach us.
- Anthropic — the coding agent runs on the Claude account you connect, under your own agreement with Anthropic.
- GitHub — only if you connect it, to push your generated repositories.
Your project content, prompts and generated code are never sent to PayFast, and are not sold or shared with anyone for advertising.
How long we keep it
Account and project data are kept while your account exists. Payment records are kept for five years after the transaction, because South African tax law requires it — see deletion below.
Your rights
You may ask what we hold about you, correct it, or ask us to delete your account. Write to motlounget123@gmail.com.
On deletion we cancel your subscription, delete your account, projects, workspaces and connected credentials. We keep the payment records — amount, date and reference — with your account identifier removed, because we are legally required to retain financial records. We would rather say that plainly than promise a deletion we cannot lawfully perform.
You may also complain to the Information Regulator of South Africa.
Security
Traffic is served over HTTPS. Connected tokens are encrypted at rest with a key held separately from the database. Each user's builds run in their own isolated containers. No system is perfect; if we ever discover a breach affecting your personal information, we will notify you and the Regulator as POPIA requires.
Contact
Ellac Thendo Motloung, 3 Sea Cottage, Milnerton, Cape Town, 7441, South Africa. motlounget123@gmail.com · +27 79 621 0954.