Lumopa Mobile App Privacy Policy

1. Data controller

The controller responsible for processing personal data through Lumopa is:

References to “Lumopa”, “we”, “us” or “our” in this Privacy Policy mean the entity identified above.

2. Scope of this Privacy Policy

This Privacy Policy applies to the Lumopa mobile application, the Lumopa website where it relates to the application, and support or account-management services connected with Lumopa.

It explains what personal data we process, why we process it, the parties that may process it on our behalf and the rights available to users.

3. Personal data we collect

3.1 Account and authentication data

Depending on the sign-in method you use, this may include:

• email address;
• account identifier;
• authentication-provider identifier;
• information supplied through supported Google or Apple sign-in services;
• account creation and last sign-in information.

Lumopa does not receive your password from Google or Apple. Passwords used for email authentication are handled through the authentication infrastructure supporting the app.

3.2 Profile data

Information you choose to add to your profile may include:

• name or displayed profile name;
• profile photograph;
• biographical or introductory text;
• sports, activities or interests;
• general location or city information;
• other profile information made available in the app.

3.3 Invite and activity data

When you create, join or manage an invite, we may process:

• invite type and activity category;
• title and description;
• date and time;
• meeting or activity location;
• participant limits;
• participation requests and request status;
• host and participant identifiers;
• shared-ride preferences and available seats;
• invite status and related timestamps.

3.4 Communications

Lumopa processes messages exchanged through invite-based chat, together with information such as sender, recipient, invite reference, message timestamp and read status.

Communication in Lumopa is connected to a specific invite. The app does not provide unrestricted public messaging between all users.

3.5 Device and technical data

When you use Lumopa, technical systems may process data such as:

• device type and operating system;
• app version;
• language and regional settings;
• device or installation identifiers;
• push-notification token;
• IP address;
• authentication, security and server logs;
• error and diagnostic information.

3.6 Support and reporting data

If you contact Lumopa Support or report another user or content, we may process:

• your contact information;
• the content of your request or report;
• screenshots or files you provide;
• relevant account, invite or message information;
• our response and actions taken.

4. How personal data is collected

We collect personal data:

• directly from you when you register or edit a profile;
• when you create, join or interact with an invite;
• when you send messages through the app;
• from an authentication provider you choose to use;
• automatically from your device and use of the service;
• when another user interacts with your invite or account;
• when you contact support or submit a report.

5. How we use personal data

We may process personal data to:

• create and administer your account;
• authenticate users and protect account access;
• display and manage user profiles;
• create, display and manage invites;
• process participation requests;
• enable invite-based communication between relevant users;
• coordinate information about training, races and shared rides;
• send operational and security notifications;
• calculate or display estimated shared-mobility impact;
• provide support and respond to requests;
• investigate reports and enforce community rules;
• detect fraud, abuse and security incidents;
• maintain and improve the app;
• comply with legal obligations;
• establish, exercise or defend legal claims where necessary.

6. Legal bases for processing

Where the General Data Protection Regulation applies, we rely on one or more of the following legal bases:

Where processing is based on consent, you may withdraw that consent at any time. Withdrawal does not affect processing that took place before consent was withdrawn.

7. Information visible to other users

Lumopa is a community application. Some information is therefore intended to be visible to other users so they can understand an invite and decide whether to participate.

This may include:

• your displayed name;
• profile photograph;
• profile description and activity interests;
• invites you publish;
• your role as host or confirmed participant;
• participation and transport information relevant to an invite.

Do not add information to your profile, invitations or messages that you do not want the relevant Lumopa users to see.

8. Invitations, requests and chat

When you request to join an invite, the host may receive information necessary to review that request.

After the relevant participation flow is approved or confirmed, Lumopa may enable one-to-one communication connected to that invite.

Messages are processed to deliver the communication, display conversation history, provide unread indicators, investigate reports and maintain the security of the service.

Other users participating in a conversation may retain or reproduce information you voluntarily send to them. Consider carefully before sharing personal contact, health, financial or other sensitive information.

9. Location information

Lumopa may process locations entered for profiles, activities, meeting points or shared rides.

Where the app offers nearby discovery or device-based location functionality, location access is used only after the relevant device permission has been granted.

You can manage device location permission through your operating-system settings. Some nearby or location-based functions may not work when permission is disabled.

Activity and meeting locations you publish may be visible to users who can access the relevant invite.

10. Push notifications

Where notifications are enabled, Lumopa may send operational notifications relating to:

• participation requests;
• accepted or declined requests;
• new invite-based messages;
• important account or security information;
• other app activity relevant to your account.

A device or installation token may be processed to deliver notifications. You can disable notification permission in your device settings, although you may then miss timely app updates.

11. Service providers and recipients

We may use service providers that process information on our behalf to operate Lumopa.

Depending on the deployed app configuration, these may include:

• Google Firebase services for authentication, databases, storage, cloud functions, hosting and notifications;
• Google Sign-In, where selected by the user;
• Sign in with Apple, where selected by the user;
• Apple and Google as app-store and operating-system providers;
• infrastructure, security, email and technical-support providers;
• professional advisers or authorities where legally necessary.

Providers may process only the data reasonably necessary to perform their services and are subject to applicable contractual and legal requirements.

We do not sell personal data.

12. International data transfers

Some service providers may process personal data outside the European Economic Area or make it accessible from other countries.

Where required, international transfers are protected using an applicable legal mechanism, such as an adequacy decision, standard contractual clauses or another safeguard recognized under data-protection law.

13. Data retention

We retain personal data only for as long as reasonably necessary for the purposes described in this Policy, including to provide the service, maintain security, resolve disputes and comply with legal obligations.

Retention periods depend on the type of information and the reason it is processed. In general:

• account and profile data is retained while your account remains active;
• invites, requests and messages may remain available while required for app functionality and legitimate records;
• security and technical logs are retained for a limited operational period;
• support and report records may be retained while needed to handle the request and protect legal interests;
• information required by law may be retained for the legally required period.

Information may be deleted, anonymized or retained in a restricted form when it is no longer required for active use.

14. Data security

We use reasonable technical and organizational measures intended to protect personal data against unauthorized access, alteration, disclosure, loss or destruction.

These measures may include:

• authenticated account access;
• role-based access to application data;
• encrypted network communication;
• restricted administrative access;
• security monitoring and logging;
• software and infrastructure maintenance;
• data-access rules applied to backend services.

No online system can guarantee absolute security. Users are responsible for protecting their devices, email accounts and login credentials.

15. Account deletion

You may request or initiate deletion of your Lumopa account through the available in-app process or the account deletion instructions on the Lumopa website.

View account deletion instructions

Account deletion removes or anonymizes personal data that is no longer required, subject to information that must be retained for security, legal compliance, dispute resolution or the protection of other users.

Content already shared with another user, such as messages forming part of their conversation history, may not always disappear immediately from every user-facing record. Where appropriate, account identity may instead be removed or anonymized.

16. Your data-protection rights

Depending on applicable law and the circumstances, you may have the right to:

• receive information about the processing of your data;
• request access to your personal data;
• request correction of inaccurate data;
• request deletion of personal data;
• request restriction of processing;
• object to processing based on legitimate interests;
• receive certain data in a portable format;
• withdraw consent where processing is based on consent;
• lodge a complaint with a competent data-protection supervisory authority.

These rights may be subject to legal conditions, exceptions and the rights of other persons.

To exercise a right, contact us using the privacy email listed below. We may need to verify your identity before completing the request.

Users in Croatia may also contact the Croatian Personal Data Protection Agency, known as AZOP.

17. Children and minimum age

Lumopa is not intended for children below 16 years of age.

A person below the applicable minimum age must not create an account or submit personal data through Lumopa.

If we learn that an account was created in violation of the applicable minimum-age requirement, we may restrict or delete the account and associated personal data.

18. Third-party websites and services

Lumopa may contain links to race organizers, maps, app stores or other external services.

External services are controlled by their respective providers and are subject to their own terms and privacy policies. Lumopa is not responsible for the privacy practices of independently controlled third-party services.

19. Changes to this Privacy Policy

We may update this Privacy Policy when Lumopa changes, when service providers or processing activities change, or when legal requirements need to be reflected.

The current version will be published on this page with an updated effective date. Where required, we may also provide notice through the app or another appropriate channel.

20. Privacy contact

For privacy questions, requests or complaints, contact:

For general application assistance, visit:

Lumopa Support