Contents
1. Who we are
Bloom Corp Ltd ("Bloom", "Lumo", "we", "us") is the data controller for the personal data collected through the Lumo app and this website (the "Service"). We are registered in England and Wales.
We process personal data in line with the UK GDPR and the Data Protection Act 2018. This policy explains what we hold, why we hold it, and what you can do about it. Because Lumo acts on your behalf by writing to companies, claiming refunds and negotiating prices, section 5 sets out exactly what leaves us and when.
2. What we collect
2.1 What you give us
- Account details: name, email address, password (stored hashed), and your app settings and preferences.
- Task information: what you're claiming and why, account or reference numbers with the company concerned, the price you're prepared to accept, and anything else you tell the agent so it can make your case.
- Documents you upload: bills, invoices, receipts, letters, order confirmations and photographs used as evidence.
- Facts you ask us to remember: reusable details such as an account number or a standing preference ("never sign me into a new contract"), so the agent doesn't ask twice.
- Your taste, if you tell us: the styles, colours and brands you like or avoid, your clothing and shoe sizes, what matters to you when you buy (for example sustainable or UK-made), roughly how you like to spend, and the products you picked in the style quiz.
- People you buy for, if you add them: how you name them (for example "Mum"), what they're into, and optionally the day and month of their birthday, never the year. Only add what they would be comfortable with, and you can remove anyone at any time.
- Support messages: anything you send us directly.
- The waitlist, if you join it from outside the UK: your email address, the country you are in (read from your phone's region setting, or chosen on our website), where you joined and when. Nothing else.
2.2 Bank data, if you connect an account
- Accounts: account name, type, balance, currency, sort-code and account identifiers as provided.
- Transactions: date, amount, description, merchant and category.
- Connection details: bank name, connection status and consent expiry.
This access is read-only. We receive it through a regulated open banking provider and never see your banking credentials.
2.3 Email, if you connect an account
- Permission to send from your address, and the messages we send for tasks you have authorised.
- Replies received at the Lumo-controlled reply address, including whatever the company chooses to put in them.
We ask for send-only permission. We do not request access to read your mailbox, and we do not scan your inbox.
2.4 What the agent produces
- Opportunities: what we think is worth acting on, and why.
- Task records: every step the agent took, the channel it used, what it sent and what came back.
- Evidence: confirmations, screenshots and parsed replies that show what a task achieved. This is what a fee is based on.
- What you shop for: what you ask Lumo to find, the products you mark as loved or not for you, and the picks we make for you from these and from your taste.
- How you use Your shop: which aisles it showed you, which products you opened, and whether you bought, returned or cancelled something you bought from it, so your shop can learn which picks suit you.
- Orders Lumo places for you: what you bought, from which shop, what you paid and when, the shop's order confirmation page (which can show your order number, delivery postcode and the email the order was sent to), and later its delivery, return and price-match status.
- Prices you ask Lumo to watch: the product, the shop and the price you are waiting for.
2.5 Payment and technical data
- Payment: fees are processed by Stripe. We keep a record of amounts, dates and the outcome charged for, and a token identifying your card. We do not store full card numbers.
- Device and usage: device type, operating system, app version, screens used, timestamps.
- Technical: IP address, error logs and performance data.
3. Why, and on what legal basis
| Running your account and carrying out tasks you authorise | Performance of our contract with you. |
|---|---|
| Reading your transactions and documents to find opportunities | Performance of our contract, on the basis of the consent you give when connecting each source. |
| Corresponding with companies in your name | Performance of our contract, under the authority you give for that task. |
| Picking products for you from your taste, searches, reactions and how you use Your shop | Performance of our contract. |
| Suggesting gifts for the people you buy for | Our and your legitimate interests in helping you choose gifts, limited to the few details you add and deleted when you remove that person. |
| Charging our fee and keeping financial records | Performance of our contract; legal obligation. |
| Keeping the Service secure and preventing fraud or misuse | Our legitimate interests, and legal obligation. |
| Fixing faults and improving how well the agent works | Our legitimate interests in providing a service that works. |
| Service messages you can't opt out of (a task needs you, a fee was charged) | Performance of our contract. |
| Marketing and product updates | Your consent, withdrawable at any time. |
| Telling you when Lumo launches in your country, if you join the waitlist | Your consent, withdrawable at any time by emailing us. |
4. Who we share it with
We do not sell your personal data, and we do not share it for advertising. We share it in four situations:
4.1 Companies we contact for you
See section 5. This is the one that matters most, and it only ever happens for a task you approved.
4.2 Providers who help us run the Service
| Open banking provider | To connect to your bank and retrieve balances and transactions. |
|---|---|
| Amazon Web Services | Hosting, storage and authentication of the Service, in European regions. |
| Anthropic | The AI models the agent runs on. Content sent for processing is not used to train their models. |
| Google (Gmail API) | Sending messages from your address, where you have connected an email account. |
| Browser automation provider (Browserbase) | Completing forms and processes on company websites where no email or API route exists, and checking on orders Lumo placed for you: delivery tracking, returns and price-match claims. |
| Product search provider (DataForSEO) | Finding where a product is sold and for how much. It receives the product you are looking for, never your name or account. |
| Expo, Apple and Google | Delivering notifications to your phone. |
| Stripe | Processing success-fee payments. |
| Braintrust | Recording what the agent asked the AI models and what came back, so we can find and fix faults in how it reasons. |
| Analytics and error reporting | Understanding faults and how the app is used. |
Each is bound by a data processing agreement, may only act on our instructions, and may only use your data to provide their service to us.
4.3 Where the law requires it
We may disclose data if required by law, court order or a regulator, or where necessary to protect our rights or someone's safety.
4.4 If the business changes hands
In a merger, acquisition or sale of assets, data may transfer to the acquirer. We will tell you, and this policy continues to apply until you are given a new one.
5. Acting on your behalf: what leaves us
To claim a refund, negotiate a price or cancel a service, we have to identify you to the company concerned. When you authorise a task, we may disclose to that company:
- your name and email address;
- your account, order, booking or policy reference with them;
- the details of the matter: dates, amounts, what happened and what you want;
- supporting evidence you have provided, such as a receipt, invoice or photograph;
- where relevant to a negotiation, the price you currently pay and comparable prices we have researched.
We disclose the minimum needed to make your case. We do not send your bank statements, your balances, your transaction history or details of any unrelated account, and we do not disclose one company's information to another.
Once your details are with that company, their own privacy policy governs what they do with them. We cannot control or delete data held by them, though you can exercise your rights with them directly.
Correspondence about your task returns to a Lumo-controlled reply address, and the agent reads it in order to act on it. You can see it all in the app.
5.1 Buying for you
When you ask Lumo to buy something, the checkout runs in a browser inside the app, on your phone. The agent reads the shop's page (its text and the names of its buttons and boxes) to choose each step. It never reads what is typed into a box, only whether the box is filled.
- Your delivery details are kept only on your phone, in its encrypted keychain, and your phone types them into the shop's page. Lumo is not sent them, though a shop page that shows them back to you, such as an order summary, is read like any other page.
- Signing in to the shop: what you enter in Lumo's sign-in form, including your password, goes only into the shop's page on your phone. Lumo does not receive or keep it.
- Paying: you pay the shop yourself, with Apple Pay, Google Pay or your card. Lumo never sees your card details.
- When the agent is stuck on a page, your phone may send our AI provider a picture of that page with your details covered. A payment page is never sent.
- After you buy: to track delivery, start a return or claim a price match, our browser automation provider opens the shop's own pages with your order number and the postcode and email from your order confirmation.
The shop receives your order, delivery and payment details as it would if you bought from it directly, and its own privacy policy governs them.
6. Google API Services Limited Use
Lumo's use and transfer of information received from Google APIs to any other app will adhere to the Google API Services User Data Policy, including the Limited Use requirements.
In practice, for the one Google permission we ask for:
- We request a single scope,
gmail.send, and use it only to send messages for a task you have authorised. We do not request permission to read, search or download your mailbox, and we cannot do so. - We do not use Google user data for advertising, and we do not sell it or transfer it to data brokers or information resellers.
- We do not transfer it to others except as necessary to provide or improve the Service, to comply with applicable law, or as part of a merger or acquisition with your notice.
- No human at Lumo reads it, except with your explicit consent, where necessary for security purposes such as investigating abuse, to comply with applicable law, or where the data is aggregated and de-identified.
- We do not use it to train generalised artificial-intelligence or machine-learning models.
You can revoke this permission at any time in the app, or from your Google account's security settings.
7. AI and automated processing
Lumo is built on large language models. They are used to interpret your transactions and documents, decide what is worth acting on, draft correspondence, read replies and choose the next step.
What we send to our AI provider, and your permission. Lumo's AI is provided by Anthropic, PBC, the company that makes the Claude models. The app asks your permission before any of your data is sent to it. With your permission we send Anthropic what you ask Lumo for, what you love or pass on, and the documents or photos you upload; the shop pages Lumo reads while it finds and buys things for you, including the checkout, which can show your name and delivery address (card and password boxes are blanked out first, and so is any picture of the page it takes when it gets stuck; section 5.1); your bank transactions (merchant names, amounts and dates), if you connect a bank, to find bills, subscriptions and refunds; replies companies send about your tasks and the details needed to write to them for you, such as your name and your account number with that company; and other web pages the agent reads while it works on a task. We never send your bank login, card numbers or passwords. Anthropic processes this data only to provide Lumo, under a data processing agreement that gives it the same protection as this policy, and does not use it to train its models. A copy of what is sent to the AI and what comes back is kept by Braintrust under the same terms (section 4). Anthropic may process data outside the UK under the safeguards in section 12. You can withdraw your permission at any time by deleting your account or contacting us; Lumo cannot work without it.
Approval stays with you. We do not make decisions producing legal or similarly significant effects on you by automated means alone: consequential actions are shown to you and require your approval, and a task pauses and asks rather than proceeding beyond what you authorised. You can ask a person at Lumo to review anything the agent did.
Training. We do not train models on your identifiable personal or financial data, and our AI providers do not train on the content we send them. Where we use information to improve how the agent performs, it is aggregated and de-identified first.
Content we receive is treated as untrusted. Emails, web pages and documents are processed as information, never as instructions. Content arriving from outside cannot change what the agent has been authorised to do.
8. How long we keep it
| Account data | Until you delete your account, plus up to 30 days to complete deletion. |
|---|---|
| Bank transactions | For as long as your account is open, because finding a yearly bill or a recurring charge needs a full year of history. Each sync requests a rolling 365-day window. Deleted when you disconnect that bank, and when you delete your account. |
| Task records, correspondence and evidence | Up to 7 years while your account is open, as the audit trail behind a fee we charged or a matter that could be disputed. Deleted with your account, except the evidence behind a fee you actually paid, which we keep for 6 years in case that charge is ever disputed. |
| Documents you upload | Until you delete them, or with your account. |
| Your taste, the people you buy for, and the products you loved or turned down | Until you change or remove them in About my taste, or delete your account. |
| How you used Your shop | 12 months, then deleted. Deleted with your account. |
| What you searched for | 90 days, so an old one-off stops shaping your picks. You can forget any search sooner in About my taste. |
| Products Lumo found for you | 7 days, so an old price is never bought. |
| Orders Lumo placed for you, and their confirmations | As task records and evidence (above). |
| Prices you watch | 60 days, or until you stop watching. Deleted with your account. |
| Notifications held overnight | Until they are sent the next morning. |
| Payment records | 6 years, as required for UK financial and tax records. |
| Usage analytics | Aggregated and anonymised after 12 months. |
| The waitlist | Up to 2 years from when you joined, then deleted. Sooner if you ask us to remove you. |
9. Security
- Encryption in transit (TLS 1.2 or higher) and at rest (AES-256).
- The token that lets us send email from your address is sealed with a managed encryption key and unsealed only at the moment it is used. We hold no banking credential or bank access token at all: bank data reaches us through a regulated open banking provider.
- Least-privilege access controls, structured logging with sensitive fields redacted, and audit trails on every action the agent takes.
- Automation runs in isolated sessions, separated per task.
- Multi-factor authentication support, regular security review and an incident response process.
No system is perfectly secure, but if a breach affects your data and creates a high risk to you, we will tell you and the ICO without undue delay.
10. Your rights
Under UK data protection law you have the right to:
- Access the personal data we hold about you, and export it from the app;
- Correct anything inaccurate;
- Delete your data (deleting your account in settings does this), subject to records we must keep by law;
- Restrict or object to processing based on our legitimate interests, and to object to direct marketing at any time;
- Portability: receive your data in a structured, machine-readable format;
- Withdraw consent where processing relies on it, including by disconnecting a bank or email account;
- Human review of anything the agent decided or did on your behalf.
Contact us through the app or by email and we will respond within one month. You can also complain to the Information Commissioner's Office at ico.org.uk, though we'd rather you gave us the chance to put it right first.
11. Managing your connections
Every data source is optional and removable. Lumo works without any of them, because you can simply tell the agent what you pay for.
- Bank: disconnect in the app or through your bank's open banking portal. We revoke the consent, stop receiving data, and delete the accounts and transactions we synced through it. Open banking consent expires roughly every 90 days anyway.
- Email: disconnect in the app, or revoke Lumo's access in your Google account settings. We can then no longer send on your behalf.
- Documents: delete any file individually.
- Card: remove it once you have no outstanding fees.
12. International transfers
Our infrastructure is hosted in the AWS London region (eu-west-2), so your account, transaction and task data stays in the United Kingdom. Some providers, including AI processing, may process data outside the UK. Where they do, we rely on UK adequacy regulations or on Standard Contractual Clauses with the UK Addendum, together with appropriate technical safeguards.
13. Children
Lumo is for adults. It is not intended for anyone under 18 and we do not knowingly collect their data. If we discover that we have, we will delete it promptly.
14. Changes and contact
If we change this policy in a way that materially affects you, we'll tell you in the app or by email before it takes effect, and update the date at the top.
Data protection enquiries
Bloom Corp Ltd
3 Tidal Basin Road
London, E16 1UW, United Kingdom
Email us