Privacy notice
Luma Analytics (Pty) Ltd trading as Luma Automations. Version 1.3, 12 October 2026.
This notice says what personal information Luma Automations collects, why, and what you can do about it. The legal entity is Luma Analytics (Pty) Ltd. It is written to be read, not filed. If anything in it is unclear, write to the address at the end and you will get an answer from a person.
Who we are
| Company | Luma Analytics (Pty) Ltd, registration number 2026/428485/07, trading as Luma Automations |
|---|---|
| Address | Ballito, KwaZulu-Natal, South Africa (online business; contact via email or WhatsApp below) |
| Website | askluma.co.za |
| Information Officer | Terence, [email protected], 083 436 9104 |
This website
This website collects nothing. It has no contact form, sets no cookies, and runs no analytics or tracking. The typefaces are loaded from Google Fonts, which means your browser requests two font files from Google when the page opens; that request carries your IP address, as any web request does, and nothing else. If you would rather it did not, your browser will fall back to a system typeface if you block that domain.
When you email or WhatsApp us from a link on the site, you are using your own email or WhatsApp account and their terms apply to that message in transit. What you send us is then held as described below.
The one exception is the client connect page (/connect), which a business uses to link its WhatsApp number and, if it chooses, its Google Calendar to our assistant. What that page handles is described in the Google user data section below.
What we hold, and why
| Enquiries | Your name, contact details and what you wrote, from an email or WhatsApp message you sent us. Held so we can reply and, if you become a client, so we can do the work. Kept for as long as the conversation or the engagement is live, and for three years after for our own records, then deleted. |
|---|---|
| Clients | Business contact details, the agreement between us, invoices and payment records. Held to perform the contract and because tax law requires invoices to be kept for five years. |
| Client staff who use a tool we host | Work email addresses on an access list, and a record of sign-in events. Held so that only the people the client has named can sign in. Removed on the client's instruction or when the engagement ends. |
We do not buy, sell or rent personal information, and we do not use it for marketing you did not ask for.
Google user data (calendar connection)
Businesses that use our WhatsApp assistant can choose to connect their Google Calendar, so the assistant can book appointments for their customers. This section covers what happens when a business owner does that. Connecting is optional; without it, the assistant passes booking requests to the business owner instead.
| What we access | Two things only, on your primary Google Calendar: the free/busy times (when you are busy, not what the events are), and the events our assistant creates for bookings it makes. We cannot see the titles, descriptions, attendees or locations of your other events, and we do not access any other calendar, your email, contacts or files. |
|---|---|
| Why | To offer your customers only times when you are free, to check again that the time is still free just before booking, and to add, change or cancel the booking on your calendar. We use it for nothing else. |
| How it is stored | Google gives us a sign-in token for your calendar. We store it encrypted (AES-256) and keyed to your business account. Free/busy times are fetched when needed and not kept. We keep a short record of the bookings the assistant made (date, time, customer name and number, and the Google event ID) so we can show them to you and manage changes. |
| How long | Until you disconnect the calendar or your engagement with us ends. When you disconnect, we revoke the token with Google and delete it straight away. Booking records are deleted within 30 days unless you ask us to keep them for your own records. Events already on your calendar stay there, because they are yours. |
| How to disconnect | Use the disconnect option on your Luma connect page, ask us at [email protected], or remove "Luma Automations" from your Google Account at myaccount.google.com/permissions. Any of these stops our access immediately. |
We do not use Google user data for advertising, we do not sell it, and we do not use it to train AI models. No person at Luma reads it, except where you ask us to for support and give your consent, where it is needed for security (for example, investigating abuse), or where the law requires it. We do not transfer it to anyone else, except the hosting providers that run our service.
Luma Automations' use and transfer of information received from Google APIs to any other app will adhere to the Google API Services User Data Policy, including the Limited Use requirements.
Documents our clients process through tools we build
Some clients use software we host to process their own documents, which can contain personal information about their customers. For that processing Luma Analytics (Pty) Ltd is an operator under the Protection of Personal Information Act: we act only on the client's instruction, under a written agreement with them, and the client remains responsible for the information and for answering its own customers about it. Our tools are built so that we keep no copy of any such document: it is processed and discarded. If you are a customer of one of our clients and want to know what is held about you, please ask that client; we will help them answer you.
Who else sees it
Email and calendar for the company run on ordinary hosted services, and code and business records are kept on GitHub. Where a client's tool sends documents to a third party for processing, that party is named in the client's agreement with us and is bound by its own data processing terms. Some of these providers are outside South Africa, chiefly in the United States. Section 72 of the Act allows that where the recipient is bound by terms that give substantially similar protection, and each of ours is. We do not send personal information anywhere else.
Your rights
- To ask what we hold about you, and to have it corrected or deleted where we have no lawful reason to keep it.
- To object to processing, and to withdraw consent where consent is the basis for it.
- To complain to the Information Regulator, whose details are at inforegulator.org.za, if you are not satisfied with our answer.
To exercise any of these, email the Information Officer. We will respond within a reasonable time and in any event within 30 days. The Promotion of Access to Information Act manual, which sets out the formal request procedure, is at /paia.
Requests from public authorities
If a public authority asks for personal information, Luma reviews the request for legality. We challenge requests that are unlawful or overly broad. Where something must be disclosed, we disclose only the minimum data needed, and we document every request.
Changes
If this notice changes, the version and date at the top change with it, and the previous version is kept in our records.