Lumus privacy policy
Last updated 2 November 2026
Lumus is an AI concierge and inbox for restaurants, beach clubs, nightclubs and concierge desks, operated by The Rize Group FZ-LLE (Fujairah Creative City Media Free Zone licence no. 9000/2016, Fujairah Twin Towers, P.O. Box 4422, Fujairah, United Arab Emirates), "we". This policy covers the website www.lumus.vip, the Lumus dashboard and the Lumus for Venues app.
Who uses Lumus
Lumus is used by venue teams. Access is by invitation: each person signs in with their email address and a password or a one-time code. The venue decides who has access.
What we process
- Website enquiries: the name, venue, email, phone, role and message you send through the form on www.lumus.vip. We use them only to reply to you and to set up your venue.
- Venue staff accounts: name, email address, phone number (for shift alerts) and sign-in sessions.
- Guest conversations on the venue's own channels, through Meta's official platforms: WhatsApp Business Platform, Instagram messaging and Messenger. This includes messages, photos guests send, the guest's phone number or account ID, and the name and profile picture the platform shares.
- Booking details the venue records: date, time, party size, minimum spend and notes.
- Public professional information about a guest, only when the venue switches this on: a guest's name may be checked against public sources such as company websites and professional profiles. Phone numbers and personal email addresses are never used for this.
- App notifications: a device token, so the app can alert staff to new messages.
- Website analytics: pages viewed and anonymous usage on www.lumus.vip (Google Analytics). In the EU, UK and Switzerland, analytics cookies are off by default.
How it is used
Only to run the venue's Lumus: show and send messages, draft and send replies (including AI replies the venue switches on), log bookings, send weekly reports and alerts to the venue's team, and reply to enquiries. We do not sell personal data and do not use guest data for advertising. Guest data belongs to the venue; we process it on the venue's behalf.
Service providers
Meta (WhatsApp, Instagram, Messenger), Cloudflare (hosting and storage), Anthropic and OpenAI (AI replies and summaries), Migadu (email), Google (website analytics), Expo and Apple (app notifications). Each processes data only to provide its service to us.
Retention and your rights
Data is kept while the venue uses Lumus and deleted within 30 days of the venue's request. You can ask for a copy, a correction or deletion of your data at any time; see data deletion. Guests can stop messages at any time by replying STOP. We follow the UAE Personal Data Protection Law (Federal Decree-Law No. 45 of 2021) and, where it applies, the GDPR.
Security
Data is encrypted in transit, access is limited to each venue's own team, and Meta access tokens are stored server-side only.
Contact
[email protected] · WhatsApp +971 50 226 1662