Effective 31 October 2026. This page explains what our Data Processing Agreement (DPA) covers and how to request it. It is not the DPA itself; the signed agreement is the binding document.

A Data Processing Agreement (DPA) is a contract that governs how one company handles personal data on behalf of another. It sets out the roles: the controller decides why and how personal data is processed, and the processor handles that data only on the controller's documented instructions. Under Article 28 of the GDPR, a DPA is required whenever a processor handles personal data for a controller.

Who needs a DPA with us

Business customers (brands, agencies, talent managers and creative pros) process personal data through the Service, for example the creators on a manager's roster and what a manager fills in when inviting one, or their own team members' email addresses. For that data the business customer is the controller and Lumienzo is the processor acting on their instructions, and those customers can have a DPA in place with us.

For the people who use Lumienzo themselves, including creators and what they connect from Instagram, Lumienzo is the controller, as our Privacy Policy describes.

What our DPA covers

GDPR Article 28 processor terms: we process personal data only on your documented instructions, keep our staff under confidentiality obligations, assist you with data-subject requests and breach notifications, and delete or return data at the end of the engagement.
International transfers: the EU Standard Contractual Clauses (Commission Decision 2021/914) cover transfers of personal data outside the EEA.
UK transfers: the UK International Data Transfer Addendum to the EU SCCs covers transfers of UK personal data.
Security measures appendix: the technical and organizational measures we operate for the Service, including encryption in transit and at rest, access controls, and incident response. Our security page summarizes them.
Sub-processor list: the third parties we rely on to deliver the Service, with a commitment to flow equivalent obligations down to them.

Sub-processors

These are the third-party service providers we use. We only list the ones we actually rely on.

The app

Altarium Consulting Private Limited (India): our affiliate, which operates our app on Meta's platform, the connection creators use to share their Instagram data.
Google Cloud: application hosting, database, file storage, and the AI models that power Lumi, in the United States.
Clerk: account access with an email address or a Google account.
Cloudflare: hosting and delivery of the app and its API.
Resend: sending the emails the app sends, such as a teammate's invite or a manager's invite to a creator.
Slack: our team's notices when someone finishes setting up an account, with the details they gave and, for a creator, their Instagram handle, picture, follower and post counts, average likes and comments, and a summary of who follows them.

The website

Buttondown: stores email addresses for updates and sends them.
Cloudflare: hosts our marketing website and its content delivery network, and provides cookie-free visit statistics.
Unsplash: serves some decorative images from its image CDN.

Each processes personal data under its own data processing addendum, which our DPA incorporates by reference. We will give at least 30 days' notice of any material change to this sub-processor list, so you have time to review and, where you have the right, object.

How to request the DPA

Email team@lumienzo.com with the subject line "DPA request" and include:

Your company name.
Your registered address.
A signatory contact (name, role, and email).

We will return a counter-signed DPA to you promptly.

Contact

Lumienzo, Inc., 2093 Philadelphia Pike #7740, Claymont, DE 19703, USA. For DPA, privacy, or security questions, email team@lumienzo.com.

We will update this page and the DPA as the product develops, and where the law requires it we will seek fresh terms before new processing begins.