Privacy
Effective date
Section titled “Effective date”This page is effective as of 27 Oct 2026. Last reviewed: 31 Oct 2026.
Who we are
Section titled “Who we are”The controller for the personal data described on this page is Hellmai Ltd, a company registered in England and Wales (company number 16412231).
This page covers:
- The documentation site at
lumenflow.dev - The package registry and licensing service for LumenFlow software
- The LumenFlow command line and SDK that run on your machine
- The optional connection from your machine to LumenFlow Cloud
LumenFlow Cloud is a separate hosted service with its own privacy notice and sub-processor list. Where Hellmai Ltd processes your workspace content for you, that notice and your customer agreement apply.
What the command line and SDK do by default
Section titled “What the command line and SDK do by default”LumenFlow runs on your machine and keeps its work records in local files in your repository and in your user configuration directory. It sends no usage telemetry. It does not run a background reporting process. It has no analytics beacon and no opt-out setting is needed, because nothing is collected.
Without a Cloud connection, these are the only network destinations the software contacts:
| Destination | When | What is sent |
|---|---|---|
registry.lumenflow.dev | When you install or search for packs, including the default pack install during init | The pack name and version you request, and the usual request metadata (your IP address and client version) |
licensing.lumenflow.dev | When you install or upgrade private packages, when the first licence file is fetched, and when the cached licence file is renewed (the renewal is about every 90 days) | Your registry credential (licence key or access token) in the request header. No project, repository or device information is sent. If an install is refused, the CLI repeats the request once with your credential to explain the refusal |
downloads.lumenflow.dev | When your package manager downloads a private package file during an install or upgrade. The licensing service sends it there with a short-lived signed link | The request for that file and the usual request metadata (your IP address and client version). The link itself grants access, so your registry credential is not needed there |
Commands that sync your work with your repository also contact the git remote you configured. Everything else works offline. The list of agent branch names ships with the software, so no request is made for it. A small licence acceptance record and the cached licence file are stored locally.
You can check this yourself. Our automated tests run the shipped command line with every non-local connection blocked and record each attempt. This page is checked against that record.
If you connect to LumenFlow Cloud
Section titled “If you connect to LumenFlow Cloud”Cloud is off until you run lumenflow cloud connect with an endpoint, organization and project, and a token you supply. After that, the software contacts only the endpoint you configured. It sends the following:
| Flow | What is sent |
|---|---|
| Token verification | The Cloud token, once, when you connect |
| Enrollment | Workspace and session identifiers, agent type and version, the host identifier, the lane and work item identifier, enrolment and last-seen times, and the reachability details you choose to supply (a URL, health endpoint or certificate fingerprint) |
| Telemetry | Metric name, value, timestamp and tags, including one test record when a session is enrolled |
| Evidence | References to evidence records for governed work |
| Lifecycle events | Events describing work lifecycle activity, such as claims, completions and capacity snapshots |
| Heartbeats | Session identifier, agent and work item identifiers, and busy or stalled health state |
| Policy and configuration | Your workspace identifier, to request the policy and configuration set for your workspace. These are received, not sent |
If you use approvals, the approval request and its decision are also exchanged with the endpoint. The content of your source code is not part of these flows.
To stop all of this, remove the Cloud section from workspace.yaml or unset the token. Data already received by Cloud is handled under the Cloud privacy notice.
Documentation site
Section titled “Documentation site”The documentation site sets no cookies and loads no analytics, advertising or third-party scripts, fonts or embeds. Our hosting provider keeps standard request logs (IP address, requested page, user agent, time) to deliver the site and to detect abuse.
Other information we handle
Section titled “Other information we handle”- Account and access identifiers that registry and licence authentication need
- Information you send us when you ask for access, licensing or support
Legal bases
Section titled “Legal bases”| Purpose | Basis under UK GDPR |
|---|---|
| Registry access, licence authentication and licence renewal | Performance of a contract (Article 6(1)(b)) |
| Security monitoring, abuse prevention and site delivery logs | Legitimate interests in keeping the service secure and available (Article 6(1)(f)) |
| Responding to access, licensing and support requests | Legitimate interests in answering the people who contact us, or steps taken at your request before a contract (Article 6(1)(b) and (f)) |
| Records we must keep for accounting and legal claims | Legal obligation (Article 6(1)(c)) |
The optional Cloud connection is something you set up and control. Its legal bases are in the Cloud privacy notice. We do not sell personal data.
Recipients and transfers
Section titled “Recipients and transfers”We use hosting, registry and licensing infrastructure providers to run the services on this page. They act on our instructions. Where a provider processes personal data outside the UK, we rely on an adequacy decision or on standard contractual clauses with the UK addendum.
Retention
Section titled “Retention”- Local files stay on your machine until you delete them.
- Registry and licence account records are kept while your licence is active, and afterwards for as long as legal, accounting and security needs require.
- Hosting request logs are kept for a short period set by the hosting provider.
- Support correspondence is kept for as long as it is needed to resolve the matter and to answer later questions about it.
Security
Section titled “Security”We use technical and organizational safeguards to protect access-related data. Licence keys and tokens are sent only in request headers over encrypted connections.
Your rights
Section titled “Your rights”Under UK data protection law you can ask us for access to your personal data, to correct it, to erase it, to restrict or object to our use of it, and to receive it in a portable format. Where we rely on consent, you can withdraw it at any time. To use any of these rights, contact us at the address below.
You can complain to the Information Commissioner’s Office (ICO) at ico.org.uk or on 0303 123 1113. We would like the chance to deal with your concern first.
Contact
Section titled “Contact”For privacy or data-handling questions, or to use your rights: