Privacy Policy

MERIT Lumina (“we”, “our”, or “us”) is operated by Merit Vision Pty Ltd (ABN available on request). We are committed to protecting your personal information in accordance with the Privacy Act 1988 (Cth) and the Australian Privacy Principles (APPs).

This Privacy Policy explains what information we collect, why we collect it, how we use it, and your rights regarding that information. By using our platform, you agree to the practices described in this policy.

We collect information you provide directly, including:

• Name and email address (account registration)
• Organisation name and role
• KPI data and performance metrics you enter into the platform
• Support and contact enquiry content

We also collect information automatically, including:

• IP address and approximate location
• Browser type and device information
• Pages visited and actions taken within the platform
• Session tokens (stored as HTTP-only cookies)

When you visit our website or use the platform, we record the pages you open, how long you stay and how far you scroll, the links and buttons you click and where on the page you click, how you arrived (the website or campaign link that sent you), the words you type into our blog search, technical errors, your browser, device type, screen size, language and time zone, and your IP address with the approximate location worked out from it (country, state and city). We do not record anything else you type into forms. If you are signed in, or later sign in or open a demo link we sent you, these records are linked to your name and account: on our public pages only if you chose Accept on our cookie notice, inside the platform always.

• To provide, operate, and improve the platform
• To authenticate your account and maintain security
• To respond to enquiries and provide customer support
• To send service-related communications (account confirmations, security alerts)
• To comply with legal and regulatory obligations
• To analyse usage patterns and improve user experience

We do not sell, rent, or trade your personal information to third parties for marketing purposes.

We use session cookies to keep you authenticated while using the platform. These cookies are HTTP-only and expire when your session ends or after 30 days, whichever comes first. Signing in with Microsoft or Google sets additional short-lived cookies that complete that sign-in and are not used for anything else. We do not use third-party advertising trackers.

You can configure your browser to refuse cookies; however, certain parts of the platform will not function without session cookies.

If you choose Accept on our cookie notice, we store a random visitor ID (cookie lumina_vid, kept up to 12 months) to recognise your return visits and, if you sign in, link them to your account. If you choose Decline, or your browser sends Global Privacy Control or Do Not Track, we store no ID on your device, but we still record the visit details in section 2, including your IP address, for 12 months. When you sign out, the visitor ID is removed from that device and the next person is asked again. You can change your choice at any time with “Cookie settings” at the bottom of each page.

We may share your information with:

• Service providers who assist in operating the platform (under confidentiality agreements)
• Law enforcement or regulatory bodies when required by law
• Successors in interest in the event of a merger or acquisition

Under Australian privacy law, you have the right to:

• Access the personal information we hold about you
• Request correction of inaccurate or incomplete information
• Complain about a breach of the APPs
• Request deletion of your account and associated data

To exercise any of these rights, contact us at [email protected].

We retain your personal information for as long as your account is active or as needed to provide our services. Upon account deletion, we will remove your personal information within 30 days, except where retention is required by law.

Visit records, including IP addresses, are kept for 12 months, and deleted sooner when your account or your organisation's data is deleted. After that we keep only totals that do not identify anyone, for up to 2 years. Locations are worked out on our own server with the DB-IP Lite database (IP Geolocation by DB-IP). Your visit data is not sent to any analytics company and is not available to our AI assistants.