Privacy Policy
Last updated: October 2, 2026
This Privacy Policy explains what data Aivis (aivis.lumnika.com, a Lumnika product) collects, why, and who processes it.
Data we collect
Account data (email and hashed password) when you sign up; the domains you submit and the resulting reports; billing data handled by Stripe (we receive your email, country and plan, never full card numbers); for USDC payments, the sending wallet and transaction, which are public on the Base network; server logs (IP, user agent, timestamps) for security and abuse prevention.
How we use it
To run scans and show you reports, to operate billing and subscriptions, to send service emails (report ready, trial and billing, security), and to compute aggregate, non-identifying statistics about AI visibility across the scanned corpus.
Legal basis
Processing is based on performance of a contract (running the service you signed up for or bought), our legitimate interest (security, abuse prevention, measuring which pages and channels work) and, where required, your consent.
Processors
Accounts and reports are stored in our own self-hosted auth and Postgres servers, hosted by Hetzner in Germany. Stripe processes payments as merchant of record. Resend delivers our emails. To measure how AI engines see a domain, the domain name, its public content and questions about it are sent to AI model providers: OpenRouter (which routes to models from OpenAI, Anthropic, Perplexity and others) and Google (Gemini API). Your email and account data are never sent to AI providers. We do not sell your data.
Visit counting
We count human page views with a first-party script (/visita.js) that only signals that a page of Aivis was viewed. It sets no cookie and stores no IP address or identifier.
Cookies
We use a few first-party cookies: the sign-in session, the last domain you scanned, the price test arm and the first-visit source. No advertising or cross-site tracking cookies are used. The full list, with purposes and durations, is in our Cookie policy.
International transfers
Stripe, Resend, OpenRouter and Google may process data outside the EU/EEA, including in the United States, under the European Commission's standard contractual clauses or equivalent safeguards.
Retention
Account data is kept while your account is active. Data tied to an account (monitored sites, history) is deleted when the account is closed. Billing records are kept as long as tax law requires. Public domain reports are not personal data and stay online unless the domain owner asks for removal.
Your rights
You may request access to, correction of, deletion or export of your personal data, and object to processing, by writing to deus+aivis@lumnika.com. If you are in the EU/EEA you also have the right to lodge a complaint with your local data protection authority.
Security
We use industry-standard measures (encryption in transit, access controls) to protect your data, but no system is 100% secure; we ask you to use a strong, unique password.
Changes
We may update this Policy as the product evolves. Material changes will be reflected here with an updated date.
Contact
Questions about this Policy: deus+aivis@lumnika.com.