Privacy policy

Last updated: 25 October 2026

1. Data controller

The controller of your personal data is Atlas Digital SRL (VAT BE 1033.770.471), Boulevard du Roi Albert II 4, 1000 Bruxelles, Belgium, reachable at contact@lumohub.eu.

2. Data collected

We process only the data necessary to operate the service:

  • Account: last name, first name, email, password (hashed), language, phone (optional).
  • Sign-in with Google or Microsoft (if you choose it): that provider authenticates you under its own privacy policy and sends us your name and e-mail address. We send it nothing.
  • Company: name, company number, VAT number, address, legal form, social insurance fund, bank details (IBAN, BIC).
  • Activity: invoices, expenses, contracts, clients, prospects, days worked, investments, documents you upload.
  • Lumohub billing: your subscription is handled by Stripe; we never store your payment card data.
  • Technical: server logs and your sign-in history (IP address, country, browser, timestamp) for security and diagnostic purposes.

The data of your own clients that you record in Lumohub is processed on your behalf: you remain the controller, and Lumohub acts as a processor within the meaning of the GDPR, under the data processing agreement annexed to the terms of service.

3. Purposes and legal bases

  • Provision of the service (performance of the contract): account management, invoicing, Peppol e-invoicing, tax calculations, exports.
  • Transactional emails (performance of the contract): account confirmation, due-date reminders, tax alerts.
  • Security and abuse prevention (legitimate interest): logs, rate limiting, two-factor authentication, network protection.
  • Lumohub's legal obligations as a seller: the bookkeeping of our own subscription invoices. The documents you create in Lumohub are not part of it: keeping them for the legal period remains your obligation (section 6).

4. Processors

We rely on strictly necessary providers, within the framework of the GDPR:

  • Scaleway — hosting and storage, data centres in the EU.
  • Cloudflare — in front of the website and the application: it receives every encrypted connection (TLS), filters it against attacks and passes it on to our host; it also resolves the domain names (DNS). It therefore sees every request, including your IP address, and tells us the country you connect from.
  • Stripe — subscription payment (PCI-DSS certified).
  • Brevo — sending of transactional emails.
  • Recommand — access point to the Peppol network for sending and receiving electronic invoices.
  • Scaleway — storage of our nightly backups, data centres in France. They are encrypted before they leave our deployment pipeline: Scaleway cannot read them.
  • GitHub (a Microsoft company) — our deployment pipeline, which also runs the nightly backup: while it is encrypted, the database passes through its servers.
  • Anthropic — artificial intelligence features. The help chat (every plan) receives your questions and the current conversation; personalised advice (from the Pro plan) receives your year's figures (revenue, expenses, net income), your country, your legal form and your insurances; document reading (Expert plan, and during the trial) receives the receipt, contract or invoice you drop in to fill the form. Anthropic processes this data on our behalf, under a data processing agreement, and does not use it to train its models.

5. Transfers outside the European Union

Your data is hosted in the European Union, and the sending of e-mails (Brevo) and the Peppol network (Recommand) stay there too. Four processors are American companies that may process data in the United States:

  • Cloudflare, through which every request to the website and the application passes, under the EU–U.S. Data Privacy Framework, supplemented by the standard contractual clauses adopted by the European Commission (Implementing Decision (EU) 2021/914);
  • Anthropic, for the artificial intelligence features described above, under those same standard contractual clauses;
  • Stripe, for the subscription payment, under the Data Privacy Framework, supplemented by those same standard contractual clauses;
  • GitHub, whose servers running the nightly backup may be in the United States, under the Data Privacy Framework, supplemented by those same standard contractual clauses.

6. Retention periods

  • Active account: for as long as the account exists.
  • Account deletion: permanent erasure of all your data after a 30-day withdrawal period. Nothing is kept beyond it.
  • Unfinished sign-up: the answers already given are kept 30 days so you can pick up where you left off, then erased. They are erased as soon as the sign-up is complete.
  • Inactive account: an account left without a subscription for more than 2 years is warned by email, then permanently erased in the same way.
  • Before any erasure you can export your invoices and documents (certified ZIP archive included in the Expert plan). Your own legal retention duty remains yours: its length depends on your country and the app states it for you.
  • Our own subscription invoices: kept in accordance with our accounting obligations as a seller. That means your billing details and the amounts paid — never the documents you created inside Lumohub.
  • Technical logs (sign-ins, errors, sent e-mails): 90 days.

7. Your rights

You have the rights of access, rectification, erasure, restriction, objection and portability. The application directly includes a full export of your data and the account deletion request (Settings → Account). For any other request: contact@lumohub.eu. You may lodge a complaint with the supervisory authority of your country of residence (in Belgium: the Data Protection Authority, autoriteprotectiondonnees.be).

8. Cookies and local storage

Lumohub uses only strictly necessary cookies — for your sign-in, for the security of the service or to remember a choice you made yourself:

  • .AspNetCore.Cookies — your sign-in session, secure and unreadable by the page's scripts; it disappears when you sign out or when the session ends.
  • .AspNetCore.Correlation.… — only during a sign-in with Google or Microsoft: it secures the round trip to that provider, then disappears.
  • .AspNetCore.Antiforgery.… — protects the application's forms against requests sent without your knowledge; it disappears when you close the browser.
  • .AspNetCore.Culture — the language you chose, kept for one year.
  • flh-theme — the light or dark theme you chose, kept for one year.
  • flh_country — the country chosen on the public website, to show its rates and amounts there, kept for one year.
  • ARRAffinity and ARRAffinitySameSite — set by our host to send your requests to the same server during your visit; they disappear when you close the browser.

During a payment, and only at that step, our payment provider Stripe sets its own fraud-prevention cookies on its pages, strictly necessary for the transaction. Cloudflare may set a security cookie (__cf_bm, or cf_clearance after a check) when it needs to tell a visitor from a robot.

The application also keeps a few settings in your browser's local storage: the language, the plan chosen at sign-up, the size of lists, the messages already read or dismissed. They stay on your device.

No advertising, audience-measurement or tracking cookie is used: visits to the public website are counted without a cookie or an IP address, as plain totals per day and per page. Since these cookies and settings are strictly necessary, they do not ask for your consent — which is why no consent banner is required.

9. Security

Encrypted connections (HTTPS), data encrypted at rest by the host, hashed passwords (bcrypt), two-factor authentication available for every account and mandatory for administration, strict per-user data isolation, hosting in the EU. See the Security page.