Privacy Policy

1. Who we are

This Privacy Policy explains how Illumae ("we", "us", "our") collects, uses, and protects personal data when you use our Service at illumae.io.

We are the data controller for the personal data described in this policy. You can contact us at support@illumae.co.

2. What data we collect

2.1 Information you give us directly

• Account details: name, email address, password (stored in hashed form)
• Billing details: handled by Stripe (see section 4) — we do not store your full card details ourselves
• Brand and business information you enter for a Domain: brand voice, target audience, industry, tone of voice, target country, and similar inputs used to personalise AI-generated content
• Content you input, edit, or generate through the Service
• Domains you add and track
• Support and help chat messages you send us

2.2 Information collected automatically

• Usage data: pages visited, features used, actions taken within the Service
• Log data: IP address, browser type, device information, timestamps
• AI usage counters: number of AI generations used, for enforcing plan limits

2.3 Information from connected third-party services

If you choose to connect them, we receive data from:

• Google Search Console, via OAuth: search performance data for your Domain (clicks, impressions, click-through rate, average position, and the Search Console property you authorise us to access). We only request the access needed to read this performance data.
• Publishing platforms (WordPress, Wix, Shopify, Squarespace, Webflow, Ghost, or a custom webhook you configure), if you connect them: credentials or API tokens needed to publish content on your behalf, and confirmation of publish status.
• Stripe, for payment processing: subscription status, payment history metadata (we do not receive or store your full card number).

3. How we use your data

We use the data described above to:

• Provide, maintain, and improve the Service
• Generate AI content and suggestions personalised to your brand and Domain
• Process payments and manage subscriptions
• Sync and display your Google Search Console performance data
• Publish content to your connected platforms, where you request this
• Send you service-related communications (for example, about your subscription, payment issues, or product changes)
• Respond to support requests, including through our in-app help assistant
• Monitor and improve the reliability and security of the Service
• Comply with our legal obligations

3.1 AI processing

To generate content, brand analysis, keyword ideas, and related outputs, we send relevant inputs (such as your brand information, target keyword, and site content) to third-party AI providers, currently Anthropic and OpenAI. These providers process this data to generate the requested output and, subject to their own data processing terms, do not use your data to train their models on standard commercial API terms. We do not control these providers' systems directly; their processing is governed by our data processing agreements with them and their own privacy terms.

4. Payment processing

All payment processing is handled by Stripe, Inc. We do not store your full card details on our own systems. Stripe acts as an independent data controller for the payment data it processes and retains billing history (invoices, payment records) in accordance with its own legal and regulatory obligations, independently of what we store. You can view Stripe's privacy policy at stripe.com/privacy.

If you delete your Illumae account, your Illumae account data is deleted as described in section 8, but Stripe retains your billing and payment history separately, as required for Stripe's own legal and tax obligations.

5. Legal basis for processing (UK GDPR)

Where UK GDPR applies, we process your personal data on the following bases:

• Contract: to provide the Service you have signed up for, including billing
• Legitimate interests: to improve and secure the Service, prevent fraud, and communicate with you about your account
• Consent: where you explicitly connect a third-party service such as Google Search Console, or opt into optional communications
• Legal obligation: where we must retain or disclose data to comply with the law

6. Who we share data with

We share data with:

• Service providers who help us operate the Service, including our hosting and database provider, Stripe (payments), Anthropic and OpenAI (AI processing), email delivery providers, DataForSEO (we send the domain and keyword strings you're tracking, to retrieve search rankings and backlink data — no personal data), and Pexels (used to source stock images for generated content; we send only a search term, no personal data)
• Third-party platforms you connect, such as Google or your chosen publishing platform, to the extent necessary to provide the integration you requested
• Legal and regulatory authorities, where required by law, or to protect our rights, safety, or property, or that of our users

We do not sell your personal data.

7. International data transfers

Some of our service providers (including Anthropic, OpenAI, and Stripe) may process data outside the UK. Where this occurs, we rely on appropriate safeguards, such as Standard Contractual Clauses or an equivalent lawful transfer mechanism, to protect your data.

8. Data retention and deletion

We retain your account data for as long as your account is active, and for a reasonable period afterwards to comply with legal, accounting, or reporting obligations.

8.1 Deleting a Domain

Removing a Domain from your account deletes the associated SEO and content data (articles, keywords, audits, traffic data, and related records) from our systems. This does not cancel any active billing for that Domain — you must cancel the subscription separately.

8.2 Deleting your account

You can request full account deletion from Settings. This will:

• Delete your Domains and all associated SEO and content data
• Delete your AI usage records, our stored Stripe customer and subscription references, and lead records associated with your account
• Delete your account and authentication record

Full account deletion requires that you first cancel any active Domain subscriptions, since deleting your account does not automatically stop billing.

Stripe retains your billing and payment history independently, in accordance with its own legal and tax retention obligations, even after your Illumae account is deleted. This is separate from, and not controlled by, your Illumae account data.

9. Your rights (UK GDPR)

Subject to applicable law, you have the right to:

• Access the personal data we hold about you
• Correct inaccurate data
• Request deletion of your data (see section 8)
• Object to or restrict certain processing
• Request a copy of your data in a portable format
• Withdraw consent where processing is based on consent (for example, disconnecting Google Search Console)

To exercise these rights, contact us at support@illumae.co. You also have the right to lodge a complaint with the UK Information Commissioner's Office (ICO) at ico.org.uk.

10. Cookies

We do not set any cookies to keep you signed in — that uses your browser's local storage instead, which is strictly necessary for the Service to work and does not require your consent.

We use Google Analytics (GA4) to understand how the Service is used. This sets analytics cookies, but only after you accept them in the cookie banner shown on your first visit — it is never loaded if you decline. You can change your cookie preference at any time, which will reload the page and show the banner again.

11. Children's data

The Service is not directed at, and we do not knowingly collect personal data from, individuals under 18.

12. Security

We use reasonable technical and organisational measures to protect your data, including access controls restricting data to its associated account and encrypted storage of credentials. No system is completely secure, and we cannot guarantee absolute security.

13. Changes to this policy

We may update this Privacy Policy from time to time. We will notify you of material changes, for example by email or in-app notice.

14. Contact us

If you have questions about this Privacy Policy or how we handle your data, contact us at support@illumae.co.