Privacy Policy

This Privacy Policy explains how Digitaro Private Limited ("Digitaro", "we", "us", or "our"), the company behind Lumus, collects, uses, discloses, retains, and otherwise processes personal information when you use the Lumus learning management platform, our websites (including getlumus.co), mobile applications, integrations (including Zoom), and related services (collectively, the "Services").

By using the Services, you acknowledge this Policy. If you do not agree, do not use the Services. Where we act as a processor for a school, academy, or other institution (the "Customer"), that Customer is typically the controller of student and staff data, and we process such data on their instructions.

1. Who we are

Legal entity: Digitaro Private Limited, Singapore
Product: Lumus
Privacy / data requests: labs@digitaro.co

2. Scope

This Policy applies to:

• Visitors to our marketing and documentation websites
• Administrators, teachers, students, parents, and other end users of Lumus
• Users who connect third-party services (such as Zoom) to Lumus
• Individuals who contact us for support, sales, or partnership inquiries

It does not apply to third-party websites or services that we do not control (including Zoom's own services), which have their own privacy policies.

3. Personal information we collect

3.1 Information you or your institution provide

• Account and profile data: name, email address, phone number (if provided), role (admin, teacher, student, parent), institution affiliation, profile photo
• Educational and operational content: courses, classes, assignments, grades, attendance, submissions, messages, feedback, and media uploaded to the platform
• Billing and commercial data: organization name, billing contacts, invoices, and payment-related metadata processed via payment providers (we do not store full card numbers on Lumus servers when payments are handled by a gateway)
• Support communications: content of emails or tickets sent to labs@digitaro.co

3.2 Information collected automatically

• Device and browser type, operating system, language, and approximate location (from IP)
• IP address, timestamps, pages viewed, referring URLs, and feature usage telemetry
• Cookies, local storage, and similar technologies needed for authentication, security, and preferences
• Log and diagnostic data for reliability, abuse prevention, and troubleshooting

3.3 Information from integrations (including Zoom)

If a Customer or user authorizes the Lumus Zoom integration, we may receive and process data from Zoom APIs and webhooks as needed to provide the integration, which may include:

• Zoom user identifiers and basic profile information for the connected account
• Meeting metadata (topic, schedule, join URLs, host/participant identifiers as provided by Zoom)
• Attendance-related events (e.g., join/leave) for class attendance sync
• Cloud recording metadata and, where configured, recording files or links for import into Lumus course modules
• OAuth tokens required to call Zoom APIs on the user's or institution's behalf

We request only the Zoom scopes required for scheduling, attendance sync, user identification, and recording import. We do not sell Zoom-derived personal data.

4. How we use personal information

We use personal information to:

• Provide, operate, maintain, and improve the Services
• Authenticate users, manage accounts, and enforce access controls
• Deliver educational workflows (classes, grading, attendance, content delivery)
• Enable and operate authorized integrations (including Zoom)
• Process payments and manage Customer subscriptions where applicable
• Provide customer support and respond to inquiries
• Monitor security, prevent fraud/abuse, and ensure service integrity
• Comply with legal obligations and enforce our Terms of Use
• Send service-related notices (e.g., security or material product changes)

Where required by law, we rely on one or more of: performance of a contract, legitimate interests (balanced against individual rights), consent, and legal obligation.

5. How we share personal information

We may share personal information with:

• The Customer (institution): administrators and authorized staff of the school/organization that provisioned your account
• Service providers (subprocessors): hosting, storage, email, analytics, error monitoring, payment, and similar vendors who process data on our instructions
• Integration partners you authorize: e.g., Zoom, when you connect an integration
• Professional advisors and authorities: where required by law, legal process, or to protect rights, safety, and security
• Business transfers: in connection with a merger, acquisition, or asset sale, subject to appropriate confidentiality and notice where required

We do not sell personal information and do not share it for cross-context behavioral advertising as those terms are commonly defined under US state privacy laws.

6. International transfers

Digitaro is based in Singapore. Personal information may be processed in Singapore and in other countries where we or our subprocessors operate. Where required, we use appropriate safeguards (such as contractual protections) for cross-border transfers.

7. Retention

We retain personal information for as long as needed to provide the Services, comply with legal obligations, resolve disputes, and enforce agreements. Customer-controlled education records are generally retained for the life of the Customer account plus a limited wind-down period after termination or deletion request, unless a longer period is required by law or agreed in a Customer contract. See our Data Retention & Protection Policy for more detail.

8. Security

We implement administrative, technical, and organizational measures designed to protect personal information, including encryption in transit, access controls, and monitoring. No method of transmission or storage is 100% secure. See our Security Policy for an overview of our controls.

9. Your rights

Depending on your location and role (and whether Digitaro or your institution is the controller), you may have rights to:

• Access personal information we hold about you
• Correct inaccurate or incomplete information
• Request deletion (erasure), subject to legal or contractual exceptions
• Restrict or object to certain processing
• Receive a portable copy of certain data
• Withdraw consent where processing is based on consent
• Lodge a complaint with a supervisory authority

How to exercise rights: Email labs@digitaro.co with the subject line "Data Subject Request", including your name, the email associated with your account, your institution (if any), and the nature of your request. If your data is controlled by a school or academy, we may redirect you to that institution or require their authorization before acting.

We will respond within the timeframe required by applicable law (typically within 30 days where GDPR or similar frameworks apply, subject to permitted extensions).

10. Children's data

Lumus is used by educational institutions that may enroll minors. We process children's data only as instructed by the Customer (typically the school or guardian-authorized program). Parents or guardians should contact their institution first for access or deletion requests related to student records.

11. Cookies

We use essential cookies and similar technologies for login sessions, security, and preference storage. Where we use non-essential analytics cookies, we will do so in accordance with applicable law and, where required, obtain consent.

12. Changes to this Policy

We may update this Policy from time to time. The "Last updated" date at the top will change when we do. Material changes may be communicated via the Services or email where appropriate. Continued use after an update constitutes acceptance of the revised Policy to the extent permitted by law.

13. Contact

For privacy questions, data subject requests, or concerns about this Policy:
Digitaro Private Limited (Singapore)
Product: Lumus
Email: labs@digitaro.co

Related documents: Terms of Use · Security Policy · Data Retention & Protection · GDPR · FERPA