Privacy notice.

1. Who we are

Lumii.me FZ-LLC ("Lumii", "we", "our", "us") is a company registered in Dubai, United Arab Emirates. We provide an early insights platform for schools.

For privacy queries: ask@lumii.me.

2. The principle

Lumii is designed so that the school — not Lumii — holds the link between a pupil's identity and what that pupil shares. This is structural, not a configuration choice.

• Pupils access Lumii using a unique code issued by their school. The school holds the code-to-pupil mapping. Lumii does not.
• No pupil names, dates of birth, addresses, parent details, or other directly identifying information are collected by Lumii.
• No audio, no camera, no biometric data.
• Pupil conversations and platform data are not used to train AI models.

3. What we process — and why

From pupils (via the school)

When a pupil uses Lumii, we process the content of their conversations and check-ins, the unique code that identifies them within their school, and basic technical data (browser type, anonymised session data). We use this to surface emotional patterns, alerts, and trends to authorised school staff.

From staff (with the school's authorisation)

Authorised school staff have named accounts to access the dashboard. We process names, role titles, and email addresses for authentication and audit purposes only.

From the website

If you fill in the contact form or sign up for resources, we process the information you give us — name, role, school, email, and your message. We use this only to respond to your enquiry.

4. Lawful basis

We rely on the following lawful bases under the UAE Personal Data Protection Law (Federal Decree-Law No. 45 of 2021):

• Performance of a contract — for the school deployment of Lumii under our service agreement.
• Legitimate interest — for safeguarding signal review, where the protection of children outweighs other considerations and is consistent with Wadeema's Law (Federal Law No. 3 of 2016).
• Consent — for website contact form submissions and resource downloads.

5. Data hosting and transfers

All Lumii platform data is hosted in the United Arab Emirates. We do not transfer pupil or staff data outside the UAE in the normal course of operating the platform. If a future operational need required cross-border processing, we would assess and document the legal basis under PDPL Articles 22–23 and notify the school in advance.

6. Sharing

We do not sell personal data. We do not share pupil data with third parties for marketing. We share data only:

• With the school — pupil signals, alerts, and aggregated trends are shared with the school under a Data Processing Agreement.
• With our service providers — limited technical providers under contract (cloud hosting, error monitoring) bound by equivalent confidentiality and data-protection obligations.
• Where required by UAE law or court order — and only to the extent legally required.

7. Retention

Operational platform data is retained for the duration of the school's subscription plus a defined post-termination period for handover and audit. Aggregated, non-identifying analytical data may be retained for longer for service improvement. The Data Processing Agreement with the school sets the exact retention windows applicable to that deployment.

8. Children's data

Because Lumii is used by pupils aged 6–18, child digital safety considerations are central to the platform's design. We adhere to:

• UAE Federal Decree-Law No. 26 of 2025 (Child Digital Safety Law) — enforceable from January 2027; our architecture is aligned in advance.
• Wadeema's Law (Federal Law No. 3 of 2016) — child protection duties.
• The principle that the school is the data controller for pupil data and Lumii is the processor.

Parents and guardians wishing to discuss their child's use of Lumii should contact the school in the first instance, as the school holds the relationship and the data.

9. Your rights

Under the UAE PDPL, individuals whose data is processed have rights including:

• The right to be informed about how data is processed
• The right of access
• The right to correct inaccurate data
• The right to object to processing in certain circumstances
• The right to request deletion in certain circumstances

For pupils: rights are exercised via the school, which holds the identity-to-code mapping and the parental relationship. For staff and website visitors: contact ask@lumii.me.

10. Security

We take appropriate technical and organisational measures to protect personal data. These include encryption in transit and at rest, role-based access control, audit logging, regular security review, and incident response procedures. We document a breach notification process for the school in line with PDPL requirements.

11. Updates

We update this notice from time to time. Material changes will be communicated to schools through the dashboard and to website contacts by email where appropriate. The "last updated" date at the top of this page reflects the most recent revision.

12. Complaints

If you have a concern about how we handle personal data, please contact us at ask@lumii.me first. You also have the right to complain to the relevant UAE data protection authority.