Your financial records are private by default.

Information Lumio handles

• Account information: your name, email address, authentication method, and the session data needed to keep you signed in.
• Financial records you provide: plans, transactions, categories, accounts, budgets, savings goals, contributions, emergency funds, bills and debts, and related preferences. Informal debts may include a creditor name and contact details if you choose to enter them.
• Households you create or join: the household name, its membership, and the records shared inside it.
• Life events, such as a wedding: the event details, budget categories and amounts, vendors and their contact details, tasks, milestones, and recorded payments.
• Documents you upload: PDF, PNG, or JPEG files up to 10 MB and 20 pages, plus the text extracted from them.
• Payment identifiers, if you use them: a Bakong account identifier you provide, and the status of payment requests generated through Lumio.
• Service and security data: limited request, import, export, restore, notification, and email-delivery status needed to operate the product and prevent abuse.

When other people can see your records

Most of Lumio is private to your account. There are exactly two ways another person can see your records, and both require your action:

• Household members. When you create a household and invite someone, records you place in that household are visible to its members. Your personal records stay outside it — a household is a deliberate boundary, not a merge of two accounts.
• A life-event planner. If you invite a planner to a wedding, their access is scoped to that one event. They can see its vendors, tasks, milestones, and budget amounts, and can update vendors and tasks. They cannot record or change payments, cannot reach any other part of your household, and cannot see documents you mark as restricted unless you grant them individually. Removing a planner takes effect on their next request.

These limits are enforced in the database itself, not only by hiding controls in the interface.

How the information is used

Lumio uses this information to authenticate your account, calculate and display your plans and balances, keep shared households in sync, read text from documents you upload, generate payment requests you ask for, send reminders and essential account messages when email is configured, complete exports or restores you request, and protect the service from misuse.

Lumio does not use financial records for advertising, sell them to data brokers, or provide automated financial advice. The beta does not use session replay or product analytics services.

Documents you upload

When you upload a bill, statement, or contract, Lumio reads text from it to suggest values you can review before anything is saved. That processing happens on Lumio's own infrastructure: PDF text is parsed directly, images are read with an optical-character-recognition library that runs on our servers, and the fields are matched with pattern rules. Uploaded documents are not sent to a third-party AI or document-processing provider.

Extraction is deliberately limited and often imperfect. Lumio always shows you what it read and waits for you to confirm or correct it — no record is created from a document without your review.

Files are stored in private storage that is not publicly reachable. Access is checked on every request, and links used to view a file are short-lived.

Bakong payment requests

Lumio does not connect to your bank account. It cannot see your balance, read your bank transaction history, or move money on your behalf.

If you choose to use the Bakong feature, Lumio stores the Bakong account identifier you enter and generates a KHQR payment code that you or someone else can pay from a banking app. Lumio then asks Bakong whether that one specific payment request was completed, so it can record the contribution. That status check is the only thing Lumio asks Bakong about — it does not request your account history, and nothing is charged automatically.

Service providers

Lumio relies on Supabase for authentication, database, and file storage; Vercel for application hosting; and Resend for limited transactional email when configured. If you use the Bakong feature, payment-request and status information is exchanged with the National Bank of Cambodia's Bakong Open API. These providers process only the information needed to deliver their part of the service under their own terms and privacy practices.

Lumio does not connect to your bank, and does not use a bank-data aggregation provider. You choose what financial records to enter or import.

Account isolation and security

Lumio uses authenticated access and database row-level controls designed to isolate each account's records, and the same controls govern who may read or change shared household and life-event records. Private application routes are not rendered for anonymous visitors, and sensitive API responses are not stored in shared caches. Application logs are written so that request and response bodies — including document contents and payment identifiers — cannot reach them. No online service can promise absolute security, so please use a strong, unique password and keep access to your sign-in method secure.

How long information is kept

• Account and financial records are kept until you delete them or delete your account.
• Uploaded documents are given a 30-day retention window by default, so files nobody links to a record do not accumulate indefinitely. You can delete a document yourself at any time.
• Completed or archived life events remain readable and exportable until you delete them; archiving is not deletion, and nothing in an archived event is removed.

Operational provider backups may retain a temporary copy after live deletion according to the provider's backup cycle. Lumio does not use deleted records for another purpose.

Your controls

• Review and correct your profile and preferences in Settings.
• Export your transactions, export a life event, or download an account backup.
• Leave a household, remove a member, or revoke a planner's access at any time.
• Delete an uploaded document without deleting the record it informed.
• Permanently delete your account and its live application records from Settings after recent authentication.

Cookies and local browser storage

Lumio uses essential authentication cookies and browser storage to maintain your session and remember product state. The current beta does not use advertising cookies.

If something goes wrong

If a security issue affects your records, Lumio will investigate, contain it, and notify affected accounts by email with what happened, what information was involved, and what to do next. To report a suspected issue, use the route described on the support page.

Children's privacy

Lumio is intended for adults managing their own finances and is not designed for children under 18. If you believe a child has provided personal information, use the route described on the support page.

Changes and questions

This notice may change as the beta and its providers evolve. Material changes will be reflected here with a new effective date. For privacy questions or account-access help, visit Support.