1. Introduction
Welcome to LumiNori.app ("Service", "we", "our", "us"). We are committed to protecting your personal data. This Privacy Policy explains how we collect, use, store, and transfer your information when you use our Telegram bot (@LumiNoribot) and related Mini App.
Data Controller:
Company: LumiNori.app
2. What Data We Collect (Minimal Approach)
We collect only the minimum necessary data to provide our services:
| Category | Data Collected |
|---|---|
| Profile Data | Telegram ID, username, display name |
| Preferences | Date of birth (optional, may be fictional), language, timezone, selected character, communication mode |
| Subscription | PRO status, subscription expiration date |
| Temporary Data | Daily chat messages, AI responses, ratings (automatically deleted at 00:00 local time) |
We DO NOT collect:
Payment card details (processed by Telegram Stars)
Chat history or logs (deleted daily)
Health, political, religious, or other sensitive data
Website analytics
The public website uses self-hosted Umami on the Operator's server. It records page views; URL paths without query strings or fragments; referrers; browser language; browser, operating system and device categories; screen size; approximate location; Core Web Vitals; and clicks on links to Telegram. The IP address and User-Agent are used transiently to generate an anonymous session and approximate location; the IP address is not stored. Umami does not use cookies, localStorage, advertising identifiers, cross-site tracking, session replay or heatmaps. Browser Do Not Track is respected. No Telegram ID, username, message content or payment data is sent to analytics. Analytics data stays on the Operator's server until the website statistics are deleted.
3. Lawful Bases for Processing (GDPR Article 6)
We process your data on the following lawful bases:
Consent (Art. 6(1)(a)): For creating your profile, personalizing experience, and sending daily predictions.
Contract Performance (Art. 6(1)(b)): For providing paid PRO features and managing subscriptions.
Legal Obligation (Art. 6(1)(c)): For compliance with legal requirements (e.g., fiscal records).
4. Purposes of Processing
We use your data exclusively for:
User identification and profile management
Providing AI conversations, horoscopes, and numerology
Managing PRO subscriptions and payments
Processing voluntary complaints and quality improvement
Security and fraud prevention
Legal compliance
5. Data Processors & International Transfers
We share your data with the following processors:
| Processor , Purpose | Location | Legal Basis for Transfer | |
|---|---|---|---|
| Telegram | Communication, notifications, payment via Telegram Stars | International | Contractual necessity |
| DeepSeek (Hangzhou DeepSeek AI Co., Ltd.) | AI responses, horoscopes, numerology | China (CN) | Standard Contractual Clauses (SCCs) - EU Commission Decision |
| Russian Hosting Provider - | Data storage - | Russia (RF) | Data localization requirement (242-FZ) |
Important: DeepSeek receives anonymized data only (not Telegram ID, not username). Data is transmitted under EU Standard Contractual Clauses to ensure adequate protection.
6. Data Retention
| Data Type | Retention Period |
|---|
Profile (ID, username, date of birth, PRO status). Until account deletion (command: /delete_data)
Daily chats, AI responses, ratings - Automatically deleted at 00:00 (local time)
Complaints (response + 6 previous messages). Until account deletion
| Anonymized website analytics | Stored on the Operator's server until the website statistics are deleted; IP addresses are not stored |
|---|
7. Your Rights (GDPR Articles 12-22, PIPL, 152-FZ)
You have the right to:
Access your data (request a copy)
Rectification (correct inaccurate data)
Erasure (delete your account via /delete_data)
Restrict processing (in certain circumstances)
Data portability (receive your data in a structured format)
Object to processing (including for direct marketing)
Withdraw consent at any time (without affecting previous processing)
Lodge a complaint with your local data protection authority
To exercise these rights, contact us at: or use /delete_data in the bot.
8. Data Security
We implement appropriate technical and organizational measures:
Data minimization (collecting only what is necessary)
Encryption in transit (TLS/HTTPS)
Access control (only authorized administrators)
Regular security updates
No permanent storage of chat history
9. Children's Data
Our Service is intended for users 18 years and older. We do not knowingly collect data from minors.
10. Changes to This Policy
We may update this Privacy Policy. Significant changes will be notified via the Telegram bot at least 7 days in advance. The latest version is always available at https://lumi-nori.com/en/privacy.