Privacy Notice — Lumi (LUMORA)

Last updated: 23 May 2026

Joint data controllers / providers:

• LAMKO Co., Ltd. (Republic of Korea)
• Dyotechlife Pvt Ltd (India), trading as LUMORA

Together, "Lumora," "we," "us." We jointly decide why and how your personal data is processed and are jointly responsible for it.

Privacy contact: privacy@lumorachemicals.com Korea — Privacy Officer (개인정보 보호책임자): Yogesh Kisan Gawale, privacy@lumorachemicals.com India — Grievance / Data Protection Officer: Yogesh Kisan Gawale, privacy@lumorachemicals.com

> Important: This notice is written to meet the substance of Korea's PIPA, > the EU/UK GDPR, and India's DPDP Act 2023. Items in [square brackets] must be > completed by us, and the points under "Notes for counsel" should be confirmed > by a qualified lawyer before public launch.

1. Who we are

Lumi is the AI research assistant for LUMORA. We supply high-purity materials for OLED and organic-electronics research to academic and industrial customers worldwide. This notice covers the chatbot at lumora-chatbot.onrender.com and the embeddable widget on lumorachemicals.com and lamko.co.kr.

It explains what personal data we collect, why, the legal basis, who it is shared with, where it goes, how long we keep it, and the rights you have.

2. What data we collect

We collect only what is necessary. Itemised below (as required by Korea's PIPA and India's DPDP).

(a) When you use Lumi anonymously

• A signed session cookie (lumi_session) holding an unguessable conversation

ID — no personal data.

• Your chat messages and any files you attach, stored against that ID.
• A truncated IP address (last octet zeroed) for abuse-prevention, kept 30 days.

(b) When you sign up / sign in (magic link) — collected with your consent:

• Email (required — to send the sign-in link and your quotation).
• Name, Position / role, Department, Institution / organisation.
• Address — *purpose:* to determine delivery feasibility and prepare an

accurate quotation. *(Optional at sign-up; you may provide it later at quotation stage.)*

• "Tell us about your research" free-text you choose to enter — to

understand your needs and assess access.

• Consent record — the date/time you consented and the version of this

notice you agreed to.

• Email-verification timestamp and last sign-in time, for security/audit.

(c) When you submit a Quotation Request

• The cart items you selected (material, purity grade, package size, packs, notes).
• Your contact details (name, email, institution, country) as provided.
• A lead record stored in our database and emailed to the Lumora sales team.

We never collect: payment-card numbers, government identifiers, passwords, full IP addresses, biometric or sensitive data, browser fingerprints, or behavioural advertising data. Lumi shows no prices in chat by design; pricing is delivered only by human email after a quotation request.

3. Purposes & legal basis

| Purpose | Korea (PIPA) | EU/UK (GDPR) | India (DPDP) | |---|---|---|---| | Answer your chat queries; prepare a personalised quotation | Consent + performance of the requested service | Performance of a contract / steps before a contract | Consent for the specified purpose | | Maintain your chat history so you can return to it | Consent | Legitimate interest | Consent | | Detect and prevent abuse; keep the service secure | Legitimate/permitted | Legitimate interest | Legitimate use / consent | | Optional marketing email | Separate opt-in consent | Consent | Separate consent |

We do not currently send marketing email, and we do not make automated decisions that produce legal or similarly significant effects about you.

4. Consent (Korea PIPA & India DPDP)

At sign-up you give clear, informed consent via an unticked checkbox linking to this notice. You are told the items collected, the purpose, the retention period, and your right to refuse. You may refuse non-essential collection; the only consequence is that features needing that data (e.g. preparing a quotation that requires your email) will be unavailable. You may withdraw consent at any time (see Section 8) — withdrawal does not affect processing already carried out lawfully.

5. Who processes data on our behalf

Each processor is contractually bound to handle your data only on our instructions, with appropriate security.

• Anthropic, PBC (USA) — the Claude model that generates Lumi's responses;

chat content is sent for inference; Anthropic does not train on it.

• Render, Inc. (USA) — hosts the service and the Postgres database.
• Amazon Web Services (Ireland / Singapore) — stores uploaded files in a

private bucket, accessed only via short-lived presigned URLs.

• Brevo (Sendinblue) (France/EU) — delivers the sign-in and quotation emails.
• Voyage AI (USA) — embeds your queries to retrieve relevant reference text.

6. International transfers

Your data may be processed in: Korea and India (the joint controllers), the USA (Anthropic, Render, Voyage), and the EU/Singapore (AWS).

• Korea (PIPA): by consenting at sign-up you also consent to the overseas

transfer of your personal data to the recipients, countries, purposes, items, and retention periods described in this notice.

• EU/UK (GDPR): transfers outside the EEA/UK rely on Standard Contractual

Clauses (Art. 46) with each processor.

• India (DPDP): transfers are made except to any country restricted by the

Government of India.

7. How long we keep it

• Anonymous chat messages: up to 90 days, then anonymised/deleted (unless held

for a documented fraud-prevention reason).

• Signed-in profile + chats: for the life of your account; deleted within 30

days of an erasure request.

• Quotation lead records: 5 years (commercial record-keeping).
• Truncated IP / abuse logs: 30 days. Webhook audit rows: 1 year.
• Consent records: kept for the life of the account + a reasonable period after,

to evidence the consent given.

8. Your rights

You can exercise any of these via privacy@lumorachemicals.com or the in-product Settings (Download my data / Delete my account):

• Access — get a machine-readable copy of what we hold (Settings → Download).
• Correction / rectification — fix inaccurate data.
• Erasure / deletion — soft delete with a 30-day grace window, then permanent

purge; immediate hard delete on request.

• Withdraw consent — at any time.
• Suspension of processing (PIPA) / restriction & objection (GDPR).
• Portability (GDPR/UK; PIPA as available) — the export is structured JSON.
• Grievance redressal (India DPDP) — raise a grievance with our Grievance

Officer above; and you may nominate another person to exercise your rights.

• Complaint to a regulator: Korea — Personal Information Protection

Commission (PIPC); India — the Data Protection Board under the DPDP Act 2023; EU — your national DPA; UK — the ICO (ico.org.uk).

We aim to respond within the timeframes required by the applicable law (generally within 7–30 days).

9. Children

Lumi is intended for professional researchers and is not directed to children. Age thresholds differ by country, so to be safe we apply the strictest: we do not knowingly collect data from anyone under 18. In India (DPDP), processing a child's data requires verifiable parental/guardian consent and we do not knowingly do so; in Korea (PIPA) under-14s require a legal guardian's consent; in the EU the threshold is 13–16 depending on the country. If you believe a child's data has been collected, email privacy@lumorachemicals.com and we will delete it promptly.

10. Security

• All traffic uses TLS 1.2+.
• Session cookies are HMAC-signed (SameSite=Lax).
• Magic-link tokens are single-use and expire after 15 minutes.
• Uploaded files are in a private S3 bucket, reachable only via short-lived

presigned URLs.

• CRM webhook payloads are signed with HMAC-SHA256.
• In the event of a personal-data breach we will notify the relevant

authorities and affected users as required by PIPA, GDPR, and DPDP.

11. Changes

We may update this notice as the product evolves; the "Last updated" date reflects the latest change. Changes that materially affect your rights will be announced in chat the next time you sign in, and where required we will seek fresh consent.

12. Contact

privacy@lumorachemicals.com — Korea Privacy Officer and India Grievance Officer named above. We aim to respond within 7 business days.

Notes for counsel (remove before publishing)

A qualified lawyer should confirm, before public launch: 1. Named officers — Korea requires a designated Privacy Officer (CPO) and India a Grievance/Data Protection Officer; insert real names/titles. 2. PIPA overseas-transfer consent — confirm whether a *separate* consent checkbox (distinct from general consent) is required for the overseas transfers in §6, and whether a domestic Korean contact/representative is needed. 3. GDPR Article 27 EU representative — if you target EU data subjects with no EU establishment, you may need to appoint one. 4. Joint-controller arrangement (GDPR Art. 26) — a written allocation of responsibilities between LAMKO and Dyotechlife should exist; a summary may need to be made available. 5. DPDP rules — confirm against the final DPDP Rules (consent-manager registration, breach-notice timelines) once notified. 6. Retention periods — confirm the 5-year lead-record period against local commercial/tax law in Korea and India.