Enterprise Search / Productivity · luminance.comLuminance
Graded against 804 verified platforms, from its own policy text. Automated assessment against a published rubric — not legal advice.
“The retention of results, learning and tagging data from the usage of our tools and/or products for the purposes of improving the tools and/ product, provided no Personal Data is contained in the retained data”
Watch: Data retention
Start here. These are the highest-risk verified clauses AIRIN found in the platform's own policy text.
The absence of a defined retention period for job applicant data, combined with a default of indefinite retention unless opted out, raises compliance concerns under GDPR storage limitation principles and may be risky for applicants unaware of this default.
A no-notice amendment clause for a privacy policy is high-risk for users. Data previously provided under different terms could become subject to materially different uses without affirmative user consent or even notification, potentially undermining GDPR-style consent and transparency requirements.
This clause restricts the user's ability to disable cookies by warning that doing so will prevent access to certain service features, creating a practical limitation on the user's data control rights while also describing the consequence of exercising browser-level data management.
Scores derived from 54 enriched findings — same verbatim citations as below. AI-generated, not legal advice.
- Luminance's training terms are conditional — check the tier, opt-out, and enterprise exceptions before relying on protection.
- Data handling is conditional — 1 privacy or retention clause warrant review before using Luminance at scale.
Derived from AI-enriched analysis of the verified findings below — informational only, not legal advice.
How to read this page: Overall risk rates what Luminance's own policy terms mean for your prompts, outputs, and data. The benchmark bands below grade those same verified terms relative to peers — a platform in a risky-by-default category can rate HIGH risk and still grade STRONG against its peer set. Both trace to the cited findings.
Policy benchmark
rubric v1.0 — how this is scoredBased on 202 verified, verbatim-cited findings below — read the citations.
Based on 221 verified, verbatim-cited findings below — read the citations.
Automated assessment against a published rubric — not legal advice.
Fully verified — complete core corpus captured and read in full.
- Privacy PolicyVerified - read in full - 124 citationsstaticLast captured 2026-07-27
- Terms of ServiceVerified - read in full - 0 citationsstaticLast captured 2026-08-28
Only citation-backed plan differences are shown here; absent cells mean AIRIN has not verified a tier-specific claim.
Establishes legitimate interests including running the business, IT services, network security, fraud prevention, and business reorganization as lawful bases for processing personal data in site administration.
" (a) Necessary for our legitimate interests (for running our business, provision of administration and IT services, network security, to prevent fraud and in the context of a business reorganisation or group restructuring exercise)"
Establishes legitimate interests in defining customer types, keeping the site updated, developing the business, and informing marketing strategy as the lawful basis for data analytics processing.
" Necessary for our legitimate interests (to define types of customers for our products and services, to keep our Site updated and relevant, to develop our business and to inform our marketing strategy) "
Defines the 'Identity Data' category, specifying personal information such as email addresses and phone numbers collected via the Customer Portal or other means, scoping this data category for subsequent processing provisions.
" Contact Data. Information that you provide by filling in forms out on our Site, providing details by registration or other means (e.g., giving business cards) at a marketing event, or when setting up administrator accounts in our product o..."
Permits the controller to process personal data for the purpose of administering and protecting the business and site, including troubleshooting, data analysis, testing, maintenance, support, and hosting.
" To administer and protect our business and this Site (including troubleshooting, data analysis, testing, system maintenance, support, reporting and hosting of data) "
Defines the scope of individuals covered by the policy and carves out existing business customers whose processing relationship is governed by separate contracts, establishing which legal instrument controls the data relationship for different categories of data subjects.
" Any individual whose personal data may be processed by us as further detailed in this policy. If you are an existing business customer of Luminance, the relevant contract between you and us (or your employer and us if you are acting in a b..."
Affirms data subjects' right to lodge complaints with the UK Information Commissioner's Office while expressing a preference that concerns be raised with Luminance first, conferring an enforceable regulatory complaint right on data subjects.
"Our privacy team is responsible for overseeing questions in relation to this privacy policy. If you have any questions about this privacy policy, please contact the team at [email protected] ."
Defines 'Legitimate Interest' as a lawful basis for processing personal data, describing the balancing test applied and the limits on its use, which directly governs when and how personal data may be processed.
" Legitimate Interest means the interest of our business in conducting and managing our business to enable us to give you the best service/product and the best and most secure experience. We make sure we consider and balance any potential im..."
This segment permits disclosure of personal data to prospective buyers or sellers in the context of a business or asset sale or purchase, authorizing data sharing for due diligence and transactional purposes.
" If we sell or buy any business or assets, we may disclose your personal data to the prospective seller or buyer of such business or assets."
Evidence appendix
Showing priority citations first. The full appendix is available for audit trails; not every citation is a severe risk.
" The retention of results, learning and tagging data from the usage of our tools and/or products for the purposes of improving the tools and/ product, provided no Personal Data is contained in the retained data "
Permits the controller to retain results, learning, and tagging data derived from tool/product usage for the purpose of improving those tools and products, subject to the condition that no personal data is contained in the retained data, thereby establishing a conditional right to use derivative data for product improvement.
AI-generated interpretation, not legal advice.
" If at any time you wish to disable our cookies you may do so through the settings on your browser, but if you do so you will not be able to use certain important features of our service."
This clause restricts the user's ability to disable cookies by warning that doing so will prevent access to certain service features, creating a practical limitation on the user's data control rights while also describing the consequence of exercising browser-level data management.
AI-generated interpretation, not legal advice.
"Luminance reserves the right to amend this policy at any time, for any reason, without notice to you. You should check our Site to see the current policy that is in effect and any changes that may have been made to it."
A no-notice amendment clause for a privacy policy is high-risk for users. Data previously provided under different terms could become subject to materially different uses without affirmative user consent or even notification, potentially undermining GDPR-style consent and transparency requirements.
AI-generated interpretation, not legal advice.
"If you are making a job application or inquiry, you may provide us with a copy of your CV or other relevant information. We may use this information for the purpose of considering your application or inquiry. Except when you explicitly request otherwise, we may keep this information on file for future reference."
The absence of a defined retention period for job applicant data, combined with a default of indefinite retention unless opted out, raises compliance concerns under GDPR storage limitation principles and may be risky for applicants unaware of this default.
AI-generated interpretation, not legal advice.
" If you purchase or use our products or services, we may use your personal data for purposes which include but are not limited to:"
This clause grants the company a broad permission to use personal data for a non-exhaustive list of purposes when the user purchases or uses products or services, establishing the legal basis for downstream data processing activities.
AI-generated interpretation, not legal advice.
" Persistent cookies remain on your device between sessions and allow us to authenticate you and to remember your preferences."
Defines the distinction between first-party and third-party cookies based on the issuing website, providing the definitional taxonomy used to classify cookie types in the policy.
AI-generated interpretation, not legal advice.
" (a) Necessary for our legitimate interests (for running our business, provision of administration and IT services, network security, to prevent fraud and in the context of a business reorganisation or group restructuring exercise)"
Establishes legitimate interests including running the business, IT services, network security, fraud prevention, and business reorganization as lawful bases for processing personal data in site administration.
AI-generated interpretation, not legal advice.
" Necessary for our legitimate interests (to define types of customers for our products and services, to keep our Site updated and relevant, to develop our business and to inform our marketing strategy) "
Establishes legitimate interests in defining customer types, keeping the site updated, developing the business, and informing marketing strategy as the lawful basis for data analytics processing.
AI-generated interpretation, not legal advice.
" To use data analytics to improve our Site, products/services, marketing, customer relationships and experiences "
Permits the controller to process personal data for data analytics purposes aimed at improving the site, products/services, marketing, customer relationships, and experiences.
AI-generated interpretation, not legal advice.
" Cookies are small text files that websites save to your computer. These pieces of information are used to improve services for you through, for example:"
Permits Luminance to use cookies to remember user settings across pages, describing a specific data use purpose for persistent preference tracking.
AI-generated interpretation, not legal advice.
" To provide you with information, products or services that you request from us, or which we feel may interest you."
This clause permits the use of personal data to provide information, products, or services requested by the user or deemed of interest, establishing a lawful processing purpose grounded in legitimate interest or contract.
AI-generated interpretation, not legal advice.
" Profile Data. Details of your visits to our site including, but not limited to, traffic data, location data and other communication data, and the resources that you access."
Defines the 'Meta Data' category as data describing other data without revealing content, distinguishing it from content data for processing classification purposes.
AI-generated interpretation, not legal advice.
" Technical Data. Your Internet Protocol (“IP”) address, operating system and web browser used. If you contact us, Luminance may keep a record of that correspondence."
Defines the 'Profile Data' category comprising visit details, traffic data, location data, and resource access data, scoping the behavioral/profile personal data collected from Site visits.
AI-generated interpretation, not legal advice.
" We may disclose your personal information if we are under a duty to disclose or share your personal data in order to comply with any legal obligation, or in order to enforce or apply our terms of use and other agreements; or to protect the rights, property, or safety of Luminance, or others."
This segment permits disclosure of personal data to comply with legal obligations, enforce terms of use, or protect the rights, property, or safety of Luminance or others, authorizing compelled or protective disclosures.
AI-generated interpretation, not legal advice.
" Service providers acting as processors or joint controllers based who provide IT and system administration services."
Identifies external IT and system administration service providers acting as processors or joint controllers as a category of third parties receiving personal data, defining a subprocessor/data-sharing relationship.
AI-generated interpretation, not legal advice.
" We may share your personal data with the parties set out below for the purposes set out in the table above."
This segment states that personal data may be shared with specified parties for specified purposes, incorporating by reference the table of purposes and categories of recipients, establishing the scope of permissible data sharing.
AI-generated interpretation, not legal advice.
" Public authorities acting as processors or joint controllers. Luminance may be required to disclose personal data following lawful requests from public authorities, with respect to meeting national security or law enforcement requirements."
Identifies public authorities as third parties and imposes an obligation on Luminance to disclose personal data in response to lawful requests for national security or law enforcement purposes, establishing a mandatory disclosure obligation.
AI-generated interpretation, not legal advice.
" Other companies affiliated with the Luminance Group, as acting as joint controllers or processors and providing HR and system administration services."
Defines 'Internal Third Parties' as affiliated companies within the Luminance Group acting as joint controllers or processors for HR and system administration, identifying entities with whom personal data is shared.
AI-generated interpretation, not legal advice.
Common questions about Luminance's policies
- Does Luminance train its AI models on your data?
- Training possible — conditions or opt-outs apply — based on 1 verified finding from Luminance's published policy. Informational only, not legal advice.
Clause detail — protections, your obligations, and coverage
Every clause below is a verbatim quote from Luminance's own published policy, read in full and linked to its exact location. Protections and user obligations are reported separately from risk because they are different kinds of clause — an obligation on you is not a risk to your data. Informational only, not legal advice.
✅ Protections found
37 verified clausesClauses in Luminance's policies that work in your favour — commitments the platform made to you.
- Audit rights, DPA & residency
“We take appropriate safeguards to protect your privacy, your fundamental rights and freedoms, and the ability to exercise your rights. For example, if we transfer personal information from the EEA, the UK, and/or Switzerland to another country, such as the Uni…”
Obliges the controller to implement appropriate data transfer instruments such as standard contractual clauses approved by the European Commission or competent authority when transferring personal data from the EEA, UK,…
📍 Privacy Policy › “TRANSFERRING PERSONAL DATA”Jump to exact text → - Audit rights, DPA & residency
“if we transfer personal information from the EEA, the UK, and/or Switzerland to another country, such as the United States, we will implement an appropriate data transfer instrument, such as entering into standard data protection clauses approved by the Europe…”
Reliance on EU-U.S. DPF and SCCs as transfer instruments provides legal basis for cross-border data flows. However, DPF adequacy decisions are subject to political and legal challenge (cf. Schrems I & II history), creati…
📍 Privacy Policy › “TRANSFERRING PERSONAL DATA”Jump to exact text → - Privacy & data use
“Request erasure of your personal data. This enables you to ask us to delete or remove personal data where there is no good reason for us continuing to process it. You also have the right to ask us to delete or remove your personal data where you have successfu…”
Grants data subjects the right to request erasure of personal data and specifies the grounds on which erasure must occur, while carving out exceptions based on legal reasons that override the deletion obligation.
📍 Privacy Policy › “YOUR LEGAL RIGHTS”Jump to exact text → - Subprocessors & data sharing
“Luminance places substantial importance on protecting the confidentiality of personal information and seeks the cooperation of all its suppliers in furthering this goal. Luminance will only transfer personal information to a supplier where the supplier has pro…”
Imposes an obligation on the controller to only transfer personal data to suppliers who provide equivalent privacy protections, and to take reasonable steps to prevent or stop supplier processing that contravenes the pol…
📍 Privacy Policy › “TRANSFERRING PERSONAL DATA”Jump to exact text → - Audit rights, DPA & residency
“In compliance with the EU-U.S. DPF and the UK Extension to the EU-U.S. DPF and the Swiss-U.S. DPF, Luminance commits to cooperate and comply respectively with the advice of the panel established by the EU data protection authorities and the UK Information Comm…”
This segment commits Luminance to cooperate with EU data protection authorities, the UK ICO, Gibraltar Regulatory Authority, and Swiss FDPIC regarding unresolved personal data complaints, creating a binding obligation to…
📍 Privacy Policy › “Complaints”Jump to exact text → - Privacy & data use
“Object to processing of your personal data where we are relying on a legitimate interest (or those of a third party) and there is something about your particular situation which makes you want to object to processing on this ground as you feel it impacts on yo…”
Grants data subjects the right to object to processing based on legitimate interests or for direct marketing, while preserving the company's ability to override such objections where compelling legitimate grounds exist.
📍 Privacy Policy › “YOUR LEGAL RIGHTS”Jump to exact text →
+ 31 more verified clauses of this kind on this platform, cited in full in the report.
📋 Rules you must follow
0 verified clausesWhat Luminance requires of YOU. These are your obligations, not risks to your data or IP, so they are cited here and excluded from this platform's risk rating.
No user-conduct rule has been verified in Luminance's published policies yet.
What the policies actually cover
10 topics- Product telemetry & usage tracking20 clauses
- Advertising & tracking1 protective10 clauses
- Sale or sharing of personal data1 protective1 clause
- Children's data1 protective1 clause
- Government & law-enforcement disclosure3 clauses
- Trains by default, opt-out available1 clause
- Arbitration & class-action waiver1 protective1 clause
- Terms can change at any time2 clauses
- Deletion rights & post-termination survival2 protective3 clauses
- Breach-notification promises1 protective2 clauses
80 further verified clauses are cited on this page but not yet assigned a topic.
Cross-clause notes
Two verified clauses intersect on the same subject matter: the Privacy Policy, Privacy Policy › “JOB APPLICANTS” addresses how long content is retained, and the Privacy Policy, Privacy Policy › “To manage our relationship with you which will include” addresses use of content in connection with model training or service improvement. Both clauses are in force at the same time — read them together.
Automated cross-reference against the published rubric — not legal advice.
Clause intelligence
Canonical clauses and stance patterns extracted from the same gate-verified citations shown on this page.
The clause imposes arbitration, class-action waiver, or jury-trial waiver terms.
“You may, under certain conditions, invoke binding arbitration for complaints regarding DPF compliance which may not be resolved by any of the other DPF mechanisms. Further information regarding this option may be found at Annex I to the DPF Principles, located here: https://www.dataprivacyframework.gov/s/article/ANNEX-I-introduction-dpf?tabset-35584=2 .”Open source citation
The clause imposes arbitration, class-action waiver, or jury-trial waiver terms.
“You may, under certain conditions, invoke binding arbitration for complaints regarding DPF compliance which may not be resolved by any of the other DPF mechanisms. Further information regarding this option may be found at Annex I to the DPF Principles, located here: https://www.dataprivacyframework.gov/s/article/ANNEX-I-introduction-dpf?tabset-35584=2 .”Open source citation
The clause imposes arbitration, class-action waiver, or jury-trial waiver terms.
“You may, under certain conditions, invoke binding arbitration for complaints regarding DPF compliance which may not be resolved by any of the other DPF mechanisms. Further information regarding this option may be found at Annex I to the DPF Principles, located here: https://www.dataprivacyframework.gov/s/article/ANNEX-I-introduction-dpf?tabset-35584=2 .”Open source citation
The clause includes sublicensable, transferable, or assignable rights.
“All software we may provide to access and use the Services is proprietary to Luminance or, as applicable, its licensors. We grant you a limited, non-exclusive, non-transferable, revocable right to use such software strictly in accordance with and subject to these Terms. Such right does not grant or transfer any ownership rights in the software to you or any other person or imply any rights other than those express...”Open source citation
The clause includes sublicensable, transferable, or assignable rights.
“Subject to section 2.2, you acknowledge and agree that we may access and use any User Data to the extent necessary for us to operate, maintain and improve the Services (including by analysing, retaining, storing and utilising the results of any usage, Outputs, learnings or trends to develop the Services for use by you and our other users) and to generate Outputs for all users. You grant us a non-exclusive, non-tra...”Open source citation
Tier matrix
Plan-level conditions detected from citation-backed clauses. Empty tiers mean AIRIN has not captured decisive tier language yet.
| Tier | Surface | Verdict | Risk | Citations |
|---|---|---|---|---|
| All applicable tiers | indemnity liability | conditional | MEDIUM | 3 |
| All applicable tiers | output ownership | improves | LOW | 6 |
| All applicable tiers | privacy data use | worsens | HIGH | 19 |
| All applicable tiers | subprocessors data sharing | worsens | HIGH | 4 |
| Free | output ownership | worsens | HIGH | 8 |
| Government | governing law disputes | conditional | MEDIUM | 3 |
| Team / Business | indemnity liability | conditional | MEDIUM | 2 |
| Team / Business | privacy data use | worsens | HIGH | 1 |
| Team / Business | subprocessors data sharing | worsens | HIGH | 2 |
Policy evolution
Open full timelineBefore/after stance changes across captured policy versions. When no material delta exists yet, AIRIN shows the latest citation-backed stance events instead.
legal burden changed from medium/indemnity to medium/liability limited.
“Where you need us to hold the data even if we no longer require it as you need it to establish, exercise or defend legal claims.”Before citation
“Limitation of liability for Businesses. If you are a Business, then subject to section 9.1:”After citation
data sharing improved from high/sale or sell to medium/third party or vendor sharing.
“If you do not want us to use your data in this way, or to pass your details on to third parties for marketing purposes, please tick the relevant box on the form on which Luminance collects your data. We will not sell or rent your data to third parties or share your data with third parties for marketing purposes. We may use third party software to send you information for marketing purposes but such third parties will not have access to or be able to read your personal information.”Before citation
“Luminance, in its role as a Processor, currently uses the following subprocessors in the processing of personal data for the purposes of providing the Product:”After citation
legal burden changed from medium/liability limited to medium/indemnity.
“Limitation of liability for Businesses. If you are a Business, then subject to section 9.1:”Before citation
“Where you need us to hold the data even if we no longer require it as you need it to establish, exercise or defend legal claims.”After citation
data sharing worsened from medium/third party or vendor sharing to high/sale or sell.
“The Data Processor shall be fully liable for any breach by the subprocessors of any of the data protection obligations hereunder.”Before citation
“If you do not want us to use your data in this way, or to pass your details on to third parties for marketing purposes, please tick the relevant box on the form on which Luminance collects your data. We will not sell or rent your data to third parties or share your data with third parties for marketing purposes. We may use third party software to send you information for marketing purposes but such third parties will not have access to or be able to read your personal information.”After citation
data sharing improved from high/sale or sell to medium/third party or vendor sharing.
“If you do not want us to use your data in this way, or to pass your details on to third parties for marketing purposes, please tick the relevant box on the form on which Luminance collects your data. We will not sell or rent your data to third parties or share your data with third parties for marketing purposes. We may use third party software to send you information for marketing purposes but such third parties will not have access to or be able to read your personal information.”Before citation
“The Data Processor shall be fully liable for any breach by the subprocessors of any of the data protection obligations hereunder.”After citation
Latest stance: third party or vendor sharing on output ownership
“you own all rights to the User Data that you upload or you otherwise have the full right to upload or share such User Data (including where such data is owned by a third party) and grant the rights set out in these Terms;”Open timeline citation
Latest stance: broad license on output ownership
“We provide you with a non-exclusive, royalty-free, fully paid-up, non-exclusive, non-transferable, perpetual, irrevocable licence during the term and following termination of this Agreement, to use any Outputs solely for the Permitted Purpose, subject always to your compliance with these Terms.”Open timeline citation
Latest stance: sublicensable or transferable on output ownership
“Subject to section 2.2, you acknowledge and agree that we may access and use any User Data to the extent necessary for us to operate, maintain and improve the Services (including by analysing, retaining, storing and utilising the results of any usage, Outputs, learnings or trends to develop the Services for use by you and our other users) and to generate Outputs for all users. You grant us a non-exclusive, non-transferable, perpetual, royalty-free licence of your User Data for these purposes.”Open timeline citation
Latest stance: broad license on output ownership
“Subject to section 2.2, you acknowledge and agree that we may access and use any User Data to the extent necessary for us to operate, maintain and improve the Services (including by analysing, retaining, storing and utilising the results of any usage, Outputs, learnings or trends to develop the Services for use by you and our other users) and to generate Outputs for all users. You grant us a non-exclusive, non-transferable, perpetual, royalty-free licence of your User Data for these purposes.”Open timeline citation
Capture recency
- Privacy Policy:Last captured 2026-07-27· verified 2026-07-27
- Terms of Service:Last captured 2026-08-28· verified 2026-08-28
Dates state when our pipeline captured and verified each document — not when the vendor last changed it. Documents are re-scanned on a recurring cadence; a document verified once says so until a re-scan confirms it again.
↑ 125 more findings this quarter vs last (288 vs 163). First scan: June 2026.
Compare and stack are saved in your browser. Open compare · View your stack. A correction triggers an automated re-read of Luminance's policies — no human edits the data.
Need this for procurement or legal diligence?
Free shows today's risk. A Stack Audit gives you a citable, verbatim-sourced PDF across your whole AI stack — and flags the moment a vendor's terms change.
Every finding above is a verbatim quote from Luminance's own published policy, captured to an immutable snapshot and read in full through a two-gate verification pipeline. Confidence labels and any analysis are AI-generated and informational only — not legal advice.
AIRIN Brief
Built for compliance officers, legal counsel, and SaaS founders. Subscribe to the email digest — one short brief when a tracked vendor materially changes its terms, training policy, or risk rating. Prefer in-app? Watch platforms in your alerts inbox instead.