Data Handling Policy
Last updated: July 20, 2026
This page is a reference document that complements the Privacy Policy, explaining how your data technically flows through our systems, where it is stored, and what security measures protect it.
1. Data Flow Summary
- Waitlist registration: Your name and email are written directly to the PostgreSQL database via the marketing (landing) site; a confirmation email is sent over SMTP.
- Account and app data: Your username, email, and password (hashed) are stored in the app database. Exam history, chat messages, and progress records are also kept in the same database, associated with your account.
- AI processing: Exam generation and chat requests are sent to the relevant large language model provider so a response can be generated. The request is sent together with relevant regulatory/question-bank references (RAG, Retrieval-Augmented Generation).
- Exam files: PDF exam/source files are stored on local disk or in S3-compatible object storage, depending on configuration.
- Embedding (vector) service: Text is converted into numeric vectors for search/matching; this service is reachable only over the internal network and with a shared access key.
2. Sub-processors
| Provider | Purpose | Data processed |
|---|---|---|
| Google (Gemini API) | AI-powered exam generation and chat responses | Chat/request text, related regulatory context |
| Railway | App hosting, database, and internal network infrastructure | All app data (as hosting infrastructure) |
| S3-compatible object storage | Storage of exam PDF files | Exam/source files |
| SMTP email provider | Waitlist confirmation emails, account/support notifications | Name, email address, email content |
| Google Ads (gtag.js) | Conversion measurement on the marketing site | Cookie-based visitor/interaction data |
3. Security Measures
- Passwords: Never stored in plain text; hashed with the one-way bcrypt algorithm.
- Session management: Authentication is handled with signed, expiring tokens (JWT).
- Authorization: The admin panel and bulk ingest endpoints are restricted to accounts with admin privileges; every request is independently verified server-side.
- Transport security: Connections between the browser and servers, and between servers and the database, are encrypted (TLS).
- Abuse protection: Rate limiting is applied on login, registration, and AI generation endpoints; endpoints that fetch external content can only reach public addresses (access to internal/private addresses is blocked).
- Input limits: Size limits are enforced on uploaded files and submitted text; requests exceeding these limits are rejected.
- Source-side leak prevention: Credentials (API keys, database credentials) are never embedded in source code; they are kept only in server environment variables.
4. Data Retention and Deletion
Your account data is retained for as long as your account is active. Your exam history is limited to a set number per topic; once that limit is reached, creating a new record requires deleting older ones. If you request full deletion of your account, your data is permanently deleted within a reasonable time, subject to my legal retention obligations.
5. Data Breach Notification
If I detect a data security breach that could affect your personal data, I will notify the Personal Data Protection Board and affected users without delay, in accordance with KVKK Art. 12 and related legislation.
6. How to Reach Out With Requests
For any data-processing question, including requests for access, correction, deletion, or portability of your data, you can write to info@lumiverion.com.