Trust Center
Security, privacy & data protection at Luma
Luma is built privacy-first. Guest data is handled on the hotel's behalf and under its instruction — never for our own purposes, never sold, and never used to train AI models. Here is how we protect it.
Privacy & GDPR
The hotel is the data controller; Luma is the processor, handling guest data only on the hotel's documented instructions.
- Never sold, rented, or used for advertising
- Never used to train AI models
- Guest rights — access, correction, deletion — supported within GDPR deadlines
Encryption
Data is encrypted in transit and at rest, with a second layer of our own encryption on top of the platform's.
- Names, emails and phone numbers encrypted field-by-field with AES-256-GCM
- Conversation text encrypted under its own separate key
- Keys held only in protected server config, never in the database
Access control
Every request is checked against the signed-in person's hotel, role and team before any data is read.
- Row-level security enabled on every database table
- Two-factor authentication required for staff and management accounts
- One hotel can never reach another hotel's data
EU hosting
Luma's database and application server both run in the European Union, in Ireland.
- Database on Supabase (EU); server on Railway (EU)
- A standalone product with its own database and secrets
- AI processing can be kept in an EU region on request
Conversations stay private
No one at the hotel, and no one at Luma, reads what a guest says to the assistant.
- No staff or admin screen shows conversation text
- Voice audio is never recorded or stored
- Staff see only structured outcomes: requests, orders and bookings
Retention & deletion
We keep personal data only as long as it is needed, and delete it on request.
- Conversation text deleted automatically after 7 days
- Guest profiles deleted 12 months after the last stay
- Full deletion within 30 days when a hotel leaves
What we never touch
Some data simply never enters Luma, by design.
- No payment-card data — charges post to the hotel bill
- No passports or identity documents
- Wi-Fi passwords and safe codes shown on the guest's screen only, never sent to the AI
Incident response
If a security incident affects a hotel's guest data, we move fast and tell the hotel what we know.
- Affected hotel notified within 12–24 hours of confirmation
- Nature, scope and categories of data affected
- Updates as the investigation progresses
Subprocessors
The specialist providers we use to run the service, and what each one handles.
| Provider | Purpose | Location |
|---|---|---|
| Supabase | Database, sign-in, file storage | EU (Ireland) |
| Railway | Application hosting (stores no data) | EU |
| Netlify | Web app delivery | Global CDN |
| Anthropic (Claude) / Amazon Bedrock | AI language model — not used for training | US, or EU region on request |
| ElevenLabs | Voice (speech-to-text, text-to-speech) | Audio not stored |
| Google Places | Local recommendations and map location | US |
| Resend | Transactional email, from the hotel's own domain | US |
| Twilio / Meta (WhatsApp add-on) | WhatsApp alerts to staff and opted-in guests | US |
| Trybe (optional) | Spa and activity bookings | Only if the hotel uses it |
| ROLZO (optional) | Private car transfers | Only if the hotel uses it |
Viator is not a subprocessor — guests book directly on Viator's own website, and Luma sends no guest data. The hotel's reservation system (such as Mews or OPERA Cloud) is the hotel's own system, not a Luma subprocessor. We notify hotels at least 30 days before adding or replacing a subprocessor.