Privacy Policy

1. Who we are

Luminous is an initiative focused on self-development and well-being, and a trade name of Beemsterboer NZ Beheer B.V. (Chamber of Commerce / KvK 83222537, de Veken 226b, 1716 KJ Opmeer). That entity is also the controller within the meaning of the General Data Protection Regulation (GDPR / AVG). For privacy matters, contact: privacy@lu-minous.app.

2. What data we collect

Depending on what you do with us, we collect:

• When you enroll in a course: name, email address, and an optional message. We also record that you agreed to the terms and to immediate delivery.
• When you pay: payment is handled through Mollie. We receive from Mollie a payment status and a reference. We ourselves store no card or bank account details.
• In some programs with a personal intake, additional data may be requested; we process those only with your knowledge and solely for that program.
• When accessing course material: one technical token in a secure cookie, solely to remember your access. No tracking.
• Course progress (which lessons you have completed) is stored only locally in your own browser. This data does not reach us.
• When you talk to the guide: the guide is a digital companion, not a human. We store what you write to it, its replies, and your daily check-in — your mood and energy on a scale of 1 to 10, and the sentence you add. From those conversations a language model writes short summaries and a profile sketch of a few sentences, so the guide still knows you next time. We use this only to make that guide work — not to judge you, not to target advertising.
• For the free week (7 Days of Frequency): your name (if you give one), your email address, your language and where you are in the week. Plus the same guide memory as above.
• If you take the test “The Distance”: your answers to the statements, the four scores that follow from them, and how many minutes a day you intend to practise. Nothing more: no IP address, no device data, no cookies to track you. The test asks for no email address. Your reading is anonymous — we do not know who made it.
• If you ask for your reading by email: only then is your email address added, with your first name if you give one. That address is linked to your reading so we can send you the analysis. The analysis is written by a language model from your answers, at a provider that does not keep the input and does not train AI on it — the same arrangement as with the guide.

2a. About health and heavy subjects

In a conversation with the guide you may share things about your health or your safety. Your daily mood says something about how you feel, too — and so do your answers in the test “The Distance”, which are about how your days feel, how much energy you have and how you deal with setbacks. That is particularly sensitive information, and the law requires your explicit consent for it. By talking to the guide, checking in or taking the test, you give that consent; you can withdraw it at any moment by erasing your memory — one button on the guide page.

Share no more than you want to. And in an acute crisis: call your local emergency number, or in the Netherlands 113 (or 0800-0113). That is not what the guide is for — it will refer you straight away.

2b. If you share your reading

At the bottom of your reading there is a share button. It creates a link with a random, unguessable code in it. Whoever has that link sees your two dots on the map and the name of your place — not your scores, not your individual answers, and not your email address. The page is also kept out of search engines.

So you share only what you decide to share, and only with whoever you send the link to. Want to withdraw it? Email us and we erase the reading, after which the link no longer works.

3. What we use it for

• To process your enrollment and grant you access
• To handle payment
• To stay in touch with you about your course
• To fulfill accounting and tax obligations

We do not use your data for marketing profiling, we do not sell it, and we do not link it to other services without your explicit consent.

There is one link we do make, and only on your own initiative: if you buy the course after the free week through your personal completion link, what the guide remembered about you during that week moves along to your course environment — you don't have to start over. If you prefer a clean slate, erase your memory before you order.

Legal basis. For the free week, the test “The Distance” and everything you tell the guide about how you feel: your consent, which you can always withdraw. For the course and the guide within it: performance of our agreement. For the free week and everything you tell the guide about how you feel: your consent, which you can withdraw at any time. For our accounts: a legal obligation.

4. How long we retain it

• Enrollments and administration: 7 years (tax retention required for financial records).
• Access tokens: for as long as your access to the course you purchased remains (six months), or until you actively have them revoked.
• Local progress: remains in your browser until you clear it yourself; we store none of it.
• Your individual test answers: automatically erased after six months. Your reading and the analysis remain, so a shared link keeps working and you can find it back yourself.
• Your test reading: without an email address it disappears entirely after six months — there is nobody left who could ask for it. If you asked for your reading by email, we keep it for two years. Erasing it sooner is always possible: email us and it is gone the same day.
• Conversations with the guide: the literal messages are erased automatically after 14 days.
• Summaries and profile sketch: these remain for as long as your course access lasts — that is the guide's memory. You can erase them yourself at any time.
• Check-ins: for as long as you take part, so you can look back at your own line over the months.
• Free week: we keep your registration and your memory until one year after you start, or shorter if you erase them yourself. Every email contains a link that stops the week and erases everything in one click. After that they disappear automatically.
• Back-ups: we make a daily copy of the server that is kept for 30 days. If you erase something it is gone from the live environment immediately, and disappears from those copies within 30 days.

5. Who we share it with

We share your data only with the following parties, and only where necessary (processors within the EU/EEA or with appropriate safeguards):

• Hosting provider (Hetzner, Germany). To make the site technically available.
• Mollie (Netherlands). To process payments securely.
• Our email service (Hostnet, Netherlands). To send confirmation, access and daily emails. Should it be temporarily unavailable, we use Resend (United States) as a fallback, on the basis of the European Commission's standard contractual clauses.
• Our accountant and the Dutch Tax Authority (Belastingdienst). For legally required processing of invoices.
• The language model behind the guide (Claude by Anthropic, via OpenRouter). See below — this deserves more than one line.

5a. What exactly happens when the guide answers

The guide runs on Claude, a language model by Anthropic. We access it through OpenRouter: an intermediary that forwards our request to whichever party is running the model at that moment — Anthropic itself, or a cloud platform such as Amazon Bedrock or Google Cloud.

What we send: your message, the recent conversation history and the summary the guide keeps about you. What we do not send: your name and your email address. The model does not know who you are; it only sees what you write.

We have no separate contract with these parties — a one-person business is too small for that, and we are not going to pretend otherwise. What we do have is this: every request carries the technical instruction that it may only be handled by providers that do not retain the input and do not use it to train models. If no such provider is available at that moment, the guide gets no answer and you see an error. We would rather have an outage than quietly leave your conversation somewhere.

This processing takes place partly outside the EU. The providers involved rely on the European Commission's standard contractual clauses for that; we cannot guarantee their compliance — only what we ourselves send and configure.

If you would rather avoid this entirely: don't use the guide. The course works without it — all lessons, practices and worksheets stand on their own, and you can check in without ever typing a word.

6. Your rights

You have the right to:

• Request access to the data we hold about you
• Request correction of inaccurate data
• Request deletion (unless a statutory retention period applies)
• Withdraw your consent at any time
• Lodge a complaint with the Dutch Data Protection Authority / Autoriteit Persoonsgegevens (autoriteitpersoonsgegevens.nl)

For what the guide remembers about you, you don't need to ask us: on the guide page there is a button that shows you everything and erases it in one go. Participants in the free week find the same button in their portal, and a link in every email that stops the week and erases everything.

For any of these rights: send an email to privacy@lu-minous.app. We respond within 30 days.

7. Security

We take security seriously. Concrete measures:

• Data stored in European data centers (Hetzner, Germany)
• HTTPS for all web transactions
• Session tokens with limited validity
• No password storage — passwordless magic-link system
• Minimal data collection (only what is strictly necessary)

8. Cookies and local storage

We use three functional cookies: cursus_token remembers that you have access to your course material, challenge_token remembers where you are in the free week, and taal remembers whether you want the site in Dutch or English. No tracking cookies, no marketing cookies, no third-party cookies.

In addition, the course stores your progress (which lessons you have completed) in the local storage of your own browser. That information stays on your device and is not sent to us. You can clear it at any time via your browser settings.

9. Changes

We reserve the right to amend this policy. In the event of substantial changes, we will inform active participants by email. The date at the top of this page indicates the latest version.

Questions? Email privacy@lu-minous.app or use the contact page.