Privacy Policy — Lumessa

Lumessa (“we”, “our”, or “us”) operates lumessa.au and the Lumessa platform. This policy explains what information we collect, how we use it, and your rights in relation to it.

1. Information we collect

Information you give us directly: When you submit a creator application, we collect your name, email address, Instagram handle, suburb, follower range, and content focus area.

Instagram account data: If you connect an Instagram account to Lumessa, we access data made available through the Instagram Graph API, including your username, follower count, audience location data, and engagement metrics. We use this data solely to calculate your Local Score and match you with relevant local businesses.

Messages: If you send a direct message to our Instagram account (@lumessa.au), we receive that message via the Instagram Messaging API. We use it to respond to your enquiry and guide you through the application process.

Usage data: We collect standard web analytics data (pages visited, time on site) via our analytics provider. We do not use third-party advertising cookies beyond the Meta Pixel, which tracks page visits for ad attribution purposes.

2. How we use your information

To process and review your creator application
To match you with local businesses on the platform
To respond to messages and support enquiries
To send you platform notifications (offer received, application status)
To improve the platform and understand how it is used
To comply with legal obligations

We do not sell your personal information to third parties. We do not use your data for purposes beyond those listed above.

3. Instagram and Meta data

Lumessa uses the Instagram Graph API, governed by Meta’s Privacy Policy. We access only the permissions necessary to operate the platform:

instagram_business_basic — to verify your Instagram business or creator account
instagram_business_manage_insights (or its Facebook Login equivalent instagram_manage_insights) — with your authorisation, to read your own follower count, engagement, and the demographic breakdown of your audience (the cities and countries your followers are in), used only to calculate your Local Score. We never post on your behalf.
instagram_business_manage_messages — to receive and respond to direct messages sent to @lumessa.au
instagram_manage_comments — to post and manage comments on our own content

We do not store the content of Instagram messages beyond the session in which they are processed. We do not access messages from accounts other than our own @lumessa.au account.

4. Data storage and security

Creator application data is stored in a secured PostgreSQL database hosted by Neon on Vercel infrastructure (AWS, Sydney region). We use industry-standard encryption in transit (HTTPS/TLS) and at rest.

We retain application data for as long as your account is active or as needed to provide the service. You may request deletion at any time (see Section 6).

5. Cookies and tracking

We use a Meta Pixel on lumessa.au to measure the effectiveness of our advertising. You can opt out of Meta’s ad tracking via your Meta account settings. We use no other advertising trackers. We use functional cookies only for session management.

6. Your rights

Under Australian Privacy Law (Privacy Act 1988) and, where applicable, the GDPR, you have the right to:

Access the personal information we hold about you
Request correction of inaccurate information
Request deletion of your data
Withdraw consent for data processing
Lodge a complaint with the Office of the Australian Information Commissioner

To exercise any of these rights, email us at hello@lumessa.au. We will respond within 30 days.

7. Children

Lumessa is not directed at children under 18. We do not knowingly collect personal information from anyone under 18.

8. Changes to this policy

We may update this policy from time to time. We will post the updated date at the top of this page. Material changes will be notified by email to registered users.

9. Contact

Lumessa
Perth, Western Australia
hello@lumessa.au