ComeToNet Inc. ("ComeToNet," "we," "us," or "our") operates Luma AI Receptionist ("Luma" or the "Service").
Luma is an AI-powered website receptionist that allows businesses to communicate with website visitors, answer questions, capture and qualify leads, assist with appointment scheduling, and provide related receptionist functions.
This Privacy Policy explains how ComeToNet collects, uses, stores, processes, and discloses information when businesses and their customers, website visitors, and other users interact with Luma.
By using Luma, you acknowledge the practices described in this Privacy Policy.
Depending on how a business configures and uses Luma, we may collect or process the following categories of information.
When a business uses Luma, we may collect:
When a person interacts with Luma on a business's website, Luma may process information provided during the conversation, including:
The information collected depends on the business's configuration and the information the visitor chooses to provide.
Luma processes conversation content in order to provide the AI receptionist functionality.
This may include questions, responses, appointment-related messages, business information used to answer questions, and other information exchanged during a conversation.
We may also receive technical and usage information associated with use of Luma, such as:
We use information for purposes including:
We do not use customer or visitor information for purposes unrelated to providing, securing, maintaining, or improving Luma except where otherwise described in this Privacy Policy or required or permitted by law.
Luma uses artificial intelligence services provided by OpenAI to generate responses and provide AI-powered receptionist functionality.
When a visitor interacts with Luma, information from the conversation may be transmitted to OpenAI for processing. Depending on the conversation and the features being used, this may include:
We send information to OpenAI only as reasonably necessary to provide the AI functionality of Luma.
OpenAI states that, by default, it does not use inputs or outputs from its API platform to train or improve its models, unless the organization explicitly opts in to applicable data-sharing programs.
OpenAI may nevertheless process and retain API data in accordance with its applicable terms, policies, and data-retention controls. OpenAI also provides additional retention controls, including Zero Data Retention for eligible API customers and deployments.
ComeToNet does not represent that information transmitted to OpenAI is never temporarily retained or processed by OpenAI. The applicable OpenAI terms and data-processing arrangements govern OpenAI's processing.
Luma's application and related infrastructure are hosted using Vercel.
Vercel may process information necessary to host, operate, secure, monitor, and maintain Luma. Depending on the applicable service and configuration, this may include application requests, technical information, logs, IP addresses, system information, and information transmitted through the application.
Vercel describes circumstances in which it acts as a processor for customer data and states that customer data is processed as necessary to provide its services.
Vercel may also process service-generated and technical information in accordance with its own privacy notice and applicable contractual terms.
Luma uses Supabase for database and related backend services.
Information stored or processed through Supabase may include:
Supabase provides database and related services for application development and operation. Its Data Processing Addendum describes processing activities including storage, deletion, rectification, analysis, transfer, and aggregation and identifies the purpose as providing database and tooling services for applications.
Supabase may retain personal information for the duration of the applicable service agreement unless earlier deletion is requested through available functionality, subject to applicable legal and contractual requirements.
Luma offers an optional integration with Google Calendar that allows a business to use its Google Calendar for appointment scheduling.
When a business connects Google Calendar, Luma requests the following Google OAuth permission:
https://www.googleapis.com/auth/calendar.events
Google currently describes this permission as allowing an application to view and edit events on all of the user's calendars.
Luma uses this access to provide appointment-related calendar functionality.
Depending on the functionality being used, Luma may:
When Luma creates or updates a Google Calendar appointment event, the event may contain:
The customer's telephone number is not included in the Google Calendar event.
The customer's email address is not included in the event title or description. However, the customer's email address may be added as a Google Calendar attendee when the business has enabled the option to send the customer a calendar invitation.
Similarly, the business's contact email may be added as an attendee when the business enables the applicable booking notification setting.
If these attendee options are disabled, no attendee email addresses are added to the event.
Luma uses Google Calendar information to provide appointment scheduling and related functionality requested by the business.
Luma does not use Google Calendar information for advertising or unrelated purposes.
A business may disconnect its Google Calendar integration through applicable Luma functionality. After disconnection, Luma will no longer use the Google Calendar connection for ongoing calendar operations, subject to information that must or may be retained under this Privacy Policy or applicable law.
ComeToNet uses third-party service providers to operate Luma.
The principal providers currently include:
| Provider | Purpose |
|---|---|
| OpenAI | AI conversation processing and response generation |
| Vercel | Application hosting and infrastructure |
| Supabase | Database and backend services |
| Optional Google Calendar integration |
These providers may process information on our behalf or provide infrastructure necessary for Luma.
We seek to use service providers that provide appropriate contractual and technical protections for information processed through Luma.
Businesses using Luma are responsible for determining what information they collect through Luma and how they use that information.
A business may configure Luma to collect information such as customer names, telephone numbers, email addresses, appointment information, and answers to lead-qualification questions.
Businesses are responsible for:
If you interact with Luma on behalf of a particular business and have questions about how that business uses your information, you should also review that business's privacy policy.
Luma is a general-purpose AI receptionist and is not intended to be a medical-record system unless ComeToNet expressly provides and contracts for such functionality.
Businesses should not intentionally submit highly sensitive personal information to Luma unless the applicable Luma service and contractual arrangements expressly permit such information to be processed.
In particular, businesses should consider whether their intended use involves health information, medical records, financial information, government identification information, or other sensitive information requiring additional legal, technical, or contractual protections.
If Luma is used by healthcare organizations, additional terms, safeguards, agreements, or configurations may be required depending on the applicable jurisdiction and use case.
ComeToNet retains information for as long as reasonably necessary to:
Specific retention periods may vary depending on the type of information, the Luma plan and configuration, and applicable legal requirements.
Businesses may request deletion of information where applicable, subject to legal, security, operational, and contractual requirements.
Information processed by third-party providers may also be subject to their applicable retention policies and contractual arrangements.
We use reasonable administrative, technical, and organizational measures designed to protect information against unauthorized access, disclosure, alteration, destruction, or loss.
These measures may include:
However, no internet-based service can guarantee absolute security.
We may disclose information:
We do not sell customer information for monetary consideration.
Because ComeToNet and its service providers may operate using infrastructure located in different countries, information processed through Luma may be transferred to, stored in, or accessed from jurisdictions outside the country where the information was originally collected.
These jurisdictions may have privacy laws that differ from those in your jurisdiction.
We use contractual, technical, and organizational measures appropriate to the circumstances to protect information when it is processed through our service providers.
Depending on your jurisdiction, you may have rights regarding your personal information, including rights to:
The availability of these rights depends on applicable law and the circumstances of the processing.
If you interact with Luma through a business, some privacy requests may need to be directed to that business because the business may determine how and why your personal information is processed.
Luma and its hosting and infrastructure providers may use cookies, local storage, analytics, or similar technologies as necessary to operate, secure, maintain, and improve the Service.
These technologies may be used for purposes such as:
Where required by applicable law, appropriate consent mechanisms may be provided.
Luma is intended for businesses and their customers and is not directed specifically to children.
We do not knowingly design Luma to collect personal information from children for purposes unrelated to providing the requested business service.
If you believe that a child has provided personal information to Luma in circumstances where it should not have been collected, please contact us so that we can review the situation.
We may update this Privacy Policy from time to time to reflect changes to Luma, our business practices, technology, service providers, or applicable legal requirements.
When we make changes, we will update the Last Updated date at the top of this Privacy Policy.
We encourage businesses and users to periodically review this Privacy Policy.
If you have questions, concerns, or requests regarding this Privacy Policy or the handling of personal information by Luma, please contact:
ComeToNet Inc.
Email: privacy@cometonet.net