Privacy Policy
This Privacy Policy explains what Personal Data WebDIY collects, how it is used, disclosed, and protected, how your prompts and generated code are processed, how long data is retained, and the rights and choices available to you.
Introduction
Lumeio, Inc., a Delaware corporation (“Lumeio,” “we,” “us,” or “our”), operates WebDIY, an AI-powered development platform that enables founders, businesses, and developers to build, edit, and deploy complete web applications using natural-language prompts. Making software creation accessible begins with earning your trust: the prompts you write, the code the Service generates, and the data your projects hold are used to provide and improve the Service for you, and we never use them to train AI models.
This Privacy Policy (this “Policy”) describes how Lumeio collects, uses, discloses, and protects personal data when you visit our website at web.diy, create an account, or use the WebDIY platform and related services (collectively, the “Service”), and it explains the rights and choices available to you. We are committed to complying with the privacy laws applicable to the Service, including the EU and UK General Data Protection Regulation (“GDPR”), the Swiss Federal Act on Data Protection, and applicable United States state privacy statutes, including the California Consumer Privacy Act as amended (“CCPA”).
This Policy should be read together with our Terms of Service, which govern your use of the Service, and with our Cookie Policy, US State Privacy Notice, and Sub-processors page, which supplement it. If you do not agree with this Policy, please discontinue your use of the Service.
Our roles. For the personal data described in this Policy, Lumeio acts as the controller (or “business” under US state privacy laws). Separately, when you use the Service to build applications that collect personal data from your own End Users, you are the controller of that data and Lumeio processes it on your behalf as your processor (or “service provider”), as described in Your responsibilities for apps you build.
Definitions
The following terms have the meanings given below wherever they appear in this Policy. Capitalized terms used but not defined here have the meanings given in our Terms of Service.
- “Personal Data” means any information that relates to an identified or identifiable natural person, and includes “personal information” and equivalent terms as defined under applicable privacy laws.
- “Inputs” means the prompts, chat messages, uploaded files, and other content you submit to the Service.
- “Generated Output” means the code, applications, and other content the Service generates in response to your Inputs.
- “Customer Content” means your Inputs, your Generated Output, and other content stored in your projects, including data held in the databases and storage we provision for your projects.
- “End Users” means the individuals who access or use the applications you build or deploy with the Service.
- “Usage Data” means technical and operational data generated by use of the Service, such as log data, metering data, and interaction events. Where Usage Data includes Personal Data (for example, an IP address), we treat it as Personal Data under this Policy.
Information we collect
We collect Personal Data from three sources: information you provide to us directly, information collected automatically when you use the Service, and information we receive from third parties. The categories we collect depend on how you use the Service.
Information you provide directly
- Account information. When you create an account, we collect your email address (required to sign in). You may also provide a display name and account preferences.
- Content you submit. Your Inputs and the Generated Output stored with your projects, including prompts, chat messages, uploaded files and attachments, and project configuration.
- Payment information. When you subscribe to a paid plan, our payment processor collects and processes your payment details on our behalf. We receive limited billing records, such as subscription tier and transaction status, and we do not store full card numbers.
- Communications. When you contact support or otherwise correspond with us, we receive the contents of your message, your contact details, and any other information you choose to provide.
Information we collect automatically
- Device and log data. IP address, browser and device type, operating system, referring pages, and timestamps.
- Security and audit data. Records of sign-in and security events, including IP address, user-agent, approximate location (country level), and bot-detection signals, used to secure accounts and to detect and prevent fraud and abuse.
- Usage Data. Information about how you interact with the Service, including the features you use and metering data such as tokens and credits consumed per request.
- Account activity. The days on which you visit the Service while signed in, with the country and time zone of each visit.
- Cookies and similar technologies. Described in the Cookies and tracking section below and in our Cookie Policy.
Information we receive from third parties
- Sign-in providers. If you choose to sign in with Google, we receive the basic profile information that Google makes available in accordance with your Google account settings, such as your name and email address.
- Payment processors. Our payment processor provides us with transaction confirmations and related billing information needed to administer your subscription.
The Service is not designed to process sensitive or special categories of Personal Data, such as health information, precise geolocation, biometric identifiers, or government-issued identification numbers. Do not include such data in your Inputs. Where an application you build processes sensitive data belonging to your End Users, the obligations described in Your responsibilities for apps you build apply.
How we use personal data
We use Personal Data for the following purposes:
- to provide, operate, maintain, and support the Service, including generating Output in response to your Inputs and hosting your projects;
- to authenticate you, secure accounts and the platform, and detect, prevent, and investigate fraud, abuse, and security incidents;
- to process payments and administer subscriptions, credits, and billing records;
- to communicate with you about the Service, including transactional, service, and security notices, and to respond to your requests;
- to analyze usage and performance in order to understand and improve the Service;
- to review Inputs and Generated Output in order to improve the Service’s AI features, for example by refining the instructions and tools we provide to AI models;
- to comply with applicable law and to establish, exercise, or defend legal claims; and
- for any other purpose described to you at the time of collection or to which you consent.
Where the GDPR or similar laws apply, we process Personal Data only where a legal basis supports the processing:
| Legal basis | Processing it supports |
|---|---|
| Performance of a contract | Providing and operating the Service, generating Output in response to your Inputs, hosting your projects, processing payments, and providing support |
| Legitimate interests | Securing the Service, preventing fraud and abuse, analyzing and improving the Service (including reviewing content to improve AI features), and establishing or defending legal claims, where those interests are not overridden by your rights and freedoms |
| Consent | Non-essential cookies, marketing communications, and any other processing for which we request your consent; you may withdraw consent at any time |
| Legal obligation | Retaining records for tax, accounting, and similar duties, and responding to lawful requests from public authorities |
We do not use Personal Data for automated decision-making that produces legal or similarly significant effects concerning you.
How your prompts and output are processed
WebDIY is built on third-party foundation models. To build and edit your projects, your Inputs and relevant project context (including chat history, uploaded files, and existing project code) are stored as part of your project and are transmitted to third-party AI providers, including Anthropic, OpenAI, Google, and xAI (see Sub-processors), solely to generate responses and code for you.
These providers act as our sub-processors: they process your content under agreements that limit its use to providing the service to us and that prohibit them from using your content to train their models.
We also use Customer Content to improve the Service itself. For example, our team may review chats and generated code, including cases where the Service produced poor results, to refine the instructions, tools, and safeguards we provide to AI models and to improve the Service’s features. Content reviewed for this purpose is accessed on a need-to-know basis and is never used to train or fine-tune AI models.
Your responsibilities for apps you build
Applications you build or deploy with the Service may collect Personal Data from your End Users, including through the databases and authentication we provision for your projects. For that data, you are the controller and Lumeio is your processor: we process End User data to provide the Service to you and in accordance with your instructions and our agreements with you. As between you and Lumeio, you are responsible for:
- providing your End Users with a legally compliant privacy notice and obtaining any required consents;
- honoring your End Users’ privacy rights and responding to their requests;
- complying with the laws that apply to your application, including children’s-privacy laws (such as COPPA) where relevant;
- not processing sensitive Personal Data through your application unless permitted by law and appropriately safeguarded; and
- ensuring that your application and the content it makes available comply with our Platform Rules.
If an End User contacts us directly about Personal Data processed in your application, we will direct the request to you where appropriate.
Separately from our role as your processor, we process limited technical data about End Users (such as IP addresses, request metadata, and bot-detection signals) as an independent controller where necessary to secure and operate our platform and to maintain the integrity of our network.
Data retention and deletion
We retain Personal Data for as long as your account is active and as needed to provide the Service. When Personal Data is no longer required for the purposes described in this Policy, we delete or de-identify it, subject to the exceptions described below.
| Data | Retention |
|---|---|
| Account and project data (Inputs, Generated Output, files) | Retained while your account or project is active; deleted after you delete the project or account |
| Deleted accounts | Deleted within 30 days of your verified deletion request, subject to the exceptions below |
| Security and audit logs (including IP address, user-agent, and country) | Up to 90 days |
| Account activity (days active, country, and time zone) | Retained while your account exists; deleted when your account is deleted |
| Backups | Deleted on a rolling basis within a limited period after the source data is deleted |
Your privacy rights
Depending on where you live, you may have some or all of the following rights with respect to your Personal Data, subject to the limits and exceptions provided by applicable law:
- Access and portability. Request confirmation of the Personal Data we process about you, a copy of that data, and, where applicable, a machine-readable export.
- Correction. Request that we correct inaccurate or incomplete Personal Data.
- Deletion. Request that we delete Personal Data, subject to the retention exceptions described in this Policy.
- Objection and restriction. Object to, or request that we restrict, certain processing of Personal Data.
- Withdrawal of consent. Withdraw consent at any time where processing is based on consent, without affecting the lawfulness of processing carried out before withdrawal.
- Opt out of sale, sharing, and targeted advertising. Direct us not to sell or share personal information or use it for targeted advertising, including through the Global Privacy Control.
- Non-discrimination. Exercise these rights without receiving discriminatory treatment.
To exercise any of these rights, use your account settings where available or contact us at compliance@web.diy. We will verify your request (and, where a US state law permits an authorized agent to act on your behalf, verify the agent’s authority) and respond within the time required by applicable law. If we decline a request, you may appeal by replying to our response.
Residents of the EEA, the United Kingdom, and Switzerland may also lodge a complaint with their supervisory authority. US residents should see our US State Privacy Notice for state-specific disclosures, including the categories of personal information we collect and how to submit a “Do Not Sell or Share” request.
International data transfers
Lumeio is headquartered in the United States, and we and our sub-processors process Personal Data in the United States and in other countries that may not provide the same level of data protection as your home jurisdiction.
Where we transfer Personal Data out of the European Economic Area, the United Kingdom, or Switzerland, we rely on appropriate safeguards recognized by applicable law, including the European Commission’s Standard Contractual Clauses, the UK International Data Transfer Addendum, and the Swiss addendum to the Standard Contractual Clauses, together with additional technical and organizational measures where appropriate. You may contact us at compliance@web.diy for more information about the safeguards applied to a particular transfer.
Security
We maintain administrative, technical, and organizational measures designed to protect Personal Data against unauthorized access, disclosure, alteration, and destruction. These measures include:
- encryption of data in transit;
- least-privilege access controls over production systems and Personal Data;
- network and application protections, including bot detection and rate limiting;
- logging and monitoring of security-relevant events; and
- contractual security obligations for the sub-processors that support the Service.
No method of transmission or storage is completely secure, and we cannot guarantee absolute security. If we become aware of a breach affecting your Personal Data, we will notify you and the competent authorities as required by applicable law. Please protect your account credentials, and do not include passwords, API keys, or other secrets in your Inputs or in content you share.
Children's privacy
The Service is not directed to children under the age of 13 (or 16 in the European Union, or any higher age required by the law of your jurisdiction), and we do not knowingly collect Personal Data from children under those ages. If you believe that a child has provided us with Personal Data, contact us at compliance@web.diy and we will delete it promptly.
Changes to this policy
We may update this Policy from time to time to reflect changes in our practices, the Service, or applicable law. If we make material changes, we will provide reasonable advance notice, for example by email or by a notice within the Service, and we will update the “Last updated” date shown above. Your continued use of the Service after an updated Policy takes effect means that the updated Policy applies to you.
Contact us
Questions, concerns, or requests relating to this Policy or to our processing of Personal Data may be directed to Lumeio, Inc. at compliance@web.diy, or by mail at Lumeio, Inc., 16192 Coastal Highway, Lewes, DE 19958, United States. We respond to verified requests within the time required by applicable law.