Effective date: 28 June 2026
Service: myLumita
Data Controller: Erdős Tímea EV, registered sole proprietor
Contact: info@mylumita.com
Registration number: 59772051
Tax number: 90543412-1-33

This Privacy Policy explains how myLumita collects, uses, stores and shares personal data, what rights you have, and how you can contact us.

For the purposes of this Privacy Policy, the data controller is Erdős Tímea EV, registered sole proprietor, operating the myLumita service.

1. Scope of this Privacy Policy

This Privacy Policy applies to:

• the myLumita mobile apps,
• the myLumita web or desktop interface,
• the myLumita website,
• myLumita accounts,
• family spaces,
• shared family features,
• paid subscriptions,
• customer support,
• optional family map and location sharing,
• personal journals and health-related record-keeping features.
  
  

2. Personal data we may process

2.1. Account data

We may process:

• name or display name,
• e-mail address,
• profile photo, if provided,
• login identifiers,
• language, country or region,
• account creation date,
• last login or last activity date.
  
  

2.2. Family space data

When you create or join a family space, we may process:

• family space name,
• names or nicknames of family members,
• roles and permissions,
• invitation links, QR codes or family codes,
• family space membership,
• joining, leaving and invitation activity.
  
  

2.3. Family organization content

Depending on how you use myLumita, we may process content such as:

• calendar events,
• appointments,
• tasks,
• chores,
• errands,
• reminders,
• shopping lists,
• personal and family task lists,
• meal plans,
• recipes,
• menu notes,
• family chat messages,
• household notes,
• school, work or activity-related entries,
• baby care routines and notes,
• pet care notes and reminders,
• vehicle service, tax, insurance or maintenance reminders,
• budget and household organization notes.
  
  

2.4. Location data

If you enable the family map or location sharing, we may process:

• current or last known device location,
• geographic coordinates,
• timestamp of location update,
• location sharing status,
• technical data needed to display the location on a map.

Location sharing is optional. It only works if the user enables it in myLumita and grants location permission on the device.

2.5. Health-related and sensitive data

myLumita may include personal record-keeping features where you can enter health-related or sensitive information, such as:

• baby routine and care notes,
• period and cycle tracking records,
• blood sugar records,
• wellness notes,
• daily personal records,
• care routine notes.

These types of data may be sensitive and may, depending on the content, qualify as special category personal data under the GDPR.

You should only enter health-related data if you choose to use that feature and understand that myLumita is for personal record keeping only.

myLumita is not a medical device and does not provide medical advice.

2.6. Subscription and purchase data

If you subscribe or make a purchase, we may process:

• subscription type,
• entitlement status,
• purchase platform: Apple, Google Play or web/Stripe,
• transaction or order ID,
• subscription start date,
• subscription expiry date,
• renewal or cancellation status,
• purchase history needed to verify subscription access.

RevenueCat states that it acts as a processor when handling end-user personal data for app developers, and its documentation also refers to purchase history in the context of Google Play Data Safety disclosures.

2.7. Technical and device data

We may process technical information such as:

• device type,
• operating system,
• app version,
• browser type,
• IP address,
• crash logs,
• diagnostic data,
• session identifiers,
• security logs,
• performance data.
  
  

2.8. Customer support data

If you contact us, we may process:

• name,
• e-mail address,
• message content,
• attachments you send,
• support history,
• information needed to respond to your request.
  
  

3. Purposes and legal bases

We may process personal data for the following purposes:

4. Sharing within a family space

myLumita is designed for shared family use.

Content added to a family space may be visible to other members of that family space, depending on permissions and feature settings. This may include calendar events, lists, tasks, notes, messages, reminders, family information and, if enabled, location data.

Please only invite people you trust and only add information that is appropriate for the members of the family space.

5. Location sharing in more detail

The location sharing feature is optional.

Location data is processed only when:

• the user enables location sharing,
• the device operating system grants the required location permission,
• the app can technically collect or update the location.

Shared location may be visible to authorized members of the family space.

The purpose of location sharing is everyday family coordination. It is not an emergency service, safety monitoring tool or rescue system.

You can turn off location sharing:

• in the myLumita app,
• in your device location settings,
• or in family/account settings, if available.

Location data may be inaccurate, delayed, outdated or unavailable.

6. Health-related records and personal journals

Baby care notes, cycle tracking, blood sugar records, wellness notes and similar personal journals are voluntary.

You decide whether to use these features and what information to enter.

Because this information may be sensitive:

• only record what you need,
• review who has access to your family space,
• avoid sharing sensitive information with people who should not see it,
• do not make medical decisions based only on information stored in myLumita.

myLumita is for personal record keeping only. It is not a medical device and does not provide diagnosis, treatment or medical recommendations.

7. Processors and third-party service providers

We may use third-party providers to operate myLumita.

This provider list may change as myLumita develops. We will update this Privacy Policy when necessary.

8. International data transfers

Some of our providers may process data outside the European Economic Area, including in the United States.

This may include providers such as Google/Firebase, Mapbox, RevenueCat or Stripe.

Where international transfers take place, we aim to rely on appropriate safeguards, such as data processing agreements, standard contractual clauses, technical and organizational security measures, or other lawful transfer mechanisms.

RevenueCat’s DPA describes processing of customer personal data, sub-processors, security measures and international transfer-related terms.

9. Data retention

We keep personal data only for as long as needed for the relevant purpose or as required by law.

General retention principles:

• account data: while the account exists and for a limited period after deletion if needed for legal, security or technical reasons,
• family content: until deleted by the user or an authorized family member, or while needed for the family space,
• location data: for the period needed to provide the location sharing feature; exact retention period: [e.g. latest shared location only / X days / no location history],
• personal journals and health-related records: until deleted by the user or account deletion, unless legal retention applies,
• customer support messages: [e.g. 12–24 months after case closure],
• billing and accounting data: for the period required by law,
• security logs: [X months],
• backups: according to technical backup cycles, up to [X days/months].

Deletion may not be immediate in all backup or log systems, but data will be removed according to our technical deletion cycles unless retention is legally required.

10. Data security

We use technical and organizational measures designed to protect personal data, such as:

• access controls,
• encrypted transmission where appropriate,
• permission management,
• backups,
• security logging,
• fraud and abuse prevention,
• security features provided by our infrastructure providers.

No online service can be guaranteed to be completely risk-free. Please use a strong password, protect your devices and invite only trusted people to your family space.

11. Cookies and similar technologies

The myLumita website and web payment pages may use cookies or similar technologies.

These may be used for:

• website operation,
• login and session management,
• security,
• payment processing,
• error detection,
• analytics, if used,
• marketing, only where appropriate consent is obtained.

Strictly necessary cookies are used to provide the website and payment flow. Non-essential analytics or marketing cookies are used only where required consent has been obtained.

12. Marketing communications

We may send marketing e-mails, newsletters or promotional messages only if you have consented or if applicable law otherwise allows it.

You can unsubscribe at any time by using the unsubscribe link in the message or contacting info@mylumita.com.

We may still send important service messages, such as security, payment, account, legal or technical notices, even if you unsubscribe from marketing.

13. Children’s data

myLumita is a family app, so information about children may be recorded by parents or legal guardians.

This may include routines, school events, care notes, family calendar entries or reminders.

Parents and legal guardians are responsible for entering children’s data and supervising children’s use of the Service.

The GDPR includes specific rules for children’s consent in relation to information society services, including parental authorization below the relevant age threshold.

Please only record child-related data that is necessary, proportionate and appropriate for family organization.

14. Your data protection rights

Depending on your location and applicable law, you may have the right to:

• request information about how we process your data,
• access your personal data,
• correct inaccurate data,
• request deletion of certain data,
• restrict certain processing,
• object to certain processing,
• request data portability,
• withdraw consent,
• lodge a complaint with a supervisory authority.

NAIH provides guidance on GDPR data subject rights, including access, rectification, erasure, restriction, portability and objection rights.

To exercise your rights, contact us at info@mylumita.com.

We may need to verify your identity before responding, especially where the request relates to an account or family space.

15. Withdrawing consent

If processing is based on consent, you may withdraw your consent at any time.

For example:

• you can turn off location sharing in the app or device settings,
• you can unsubscribe from marketing messages,
• you can delete health-related journal entries,
• you can request deletion of certain account data.

Withdrawing consent does not affect processing that took place before consent was withdrawn.

16. Account deletion and data export

You may request account deletion through the app, if available, or by contacting info@mylumita.com.

You may also request an export of your data where the right to data portability applies and where the data can technically be provided.

Some shared family content may remain available to other family members if it is part of a shared family space and is not deleted by an authorized user, unless deletion is required by law.

17. Complaints

If you believe your personal data has not been handled properly, please contact us first at info@mylumita.com.

You may also lodge a complaint with the Hungarian National Authority for Data Protection and Freedom of Information.

Hungarian National Authority for Data Protection and Freedom of Information — NAIH
Address: 1055 Budapest, Falk Miksa utca 9–11, Hungary
Postal address: 1363 Budapest, Pf. 9, Hungary
Phone: +36 (1) 391 1400
E-mail: ugyfelszolgalat@naih.hu

NAIH publishes these contact details on its official website.

18. Consumer dispute resolution

If you are a consumer and have a consumer dispute with us, you may be able to contact a Hungarian conciliation board.

The Budapest Conciliation Board states that it helps consumers and businesses settle consumer disputes out of court.

The European Commission’s Online Dispute Resolution platform has been discontinued as of 20 July 2025, so myLumita should not publish the old ODR platform link as an active dispute resolution route.

19. Changes to this Privacy Policy

We may update this Privacy Policy from time to time, for example when we add new features, change providers, update our data practices or need to reflect legal changes.

The updated version will be published on the website or in the app. If the change is significant, we will try to notify you separately.

20. Contact for privacy matters

For privacy questions, requests or complaints, contact:

myLumita / Erdős Tímea EV
E-mail: info@mylumita.com
Website: www.mylumita.com