Legal
How Amexa.ai handles information across our website, Business Review, Lumira™ services, and authorized integrations. Last updated November 11, 2026.
Amexa.ai, LLC (“Amexa.ai,” “we,” “us”) provides Lumira™, an AI-assisted business operating and workflow platform. This policy explains how we handle information collected through amexa.ai, the Business Review, customer onboarding, customer workspaces, and authorized integrations.
This policy describes current practices. It is not an independent audit, legal certification, or claim that Amexa.ai holds a compliance certification that has not been formally obtained.
Information you choose to provide may include your name, business name, business contact information, industry, business goals, existing systems, scheduling preferences, onboarding details, and information included in a Business Review or support request.
We may collect limited technical, authentication, security, audit, and device/browser information needed to operate, protect, troubleshoot, and improve the service.
For a business customer, Amexa.ai may process business and customer information that the customer is authorized to provide or connect. The exact data, provider, purpose, and permitted use depend on the customer's approved scope and configuration.
If you connect a Google account (Gmail), the Google user data Amexa.ai accesses, and how it is used, stored, shared, and deleted, are described in the Google User Data section below.
Current Amexa.ai production application data is stored in the Lovable-managed Supabase/PostgreSQL environment used by the application. Access controls are designed around authenticated identity, organization membership, tenant boundaries, role-based access control, row-level security, and stronger authentication requirements such as AAL2/MFA for sensitive Founder or administrative actions where configured.
Customer workspaces are organization-scoped. A user must not gain another customer's records through URL guessing, email-domain matching, prompts, AI requests, frontend manipulation, or another customer's integration. Server-side authorization and database policies remain authoritative.
We use information to respond to inquiries, conduct Business Reviews, configure and provide approved services, operate integrations, support customers, maintain security and audit records, improve usability, reconcile authorized commerce activity, and comply with legal obligations.
We do not sell personal information and do not provide customer or prospect information to unrelated third parties for their own advertising purposes.
Some Lumira™ features show information from public sources, such as government maps, weather services, public business records and city or county permit records. Each source, what it provides, its license and its credit are listed at amexa.ai/legal/data-sources. Information from a public source is used only for the feature that shows it, and Amexa.ai does not send your name or account details to those sources.
Lumira™ uses an integration layer to represent approved third-party systems and to separate discovery, authorization, runtime use, revocation, and provider readiness. A provider definition or architecture-ready integration is not the same as a live or production-ready customer connection.
Authorization is intended to be scoped to the applicable tenant, provider, integration, and allowed action. Revoking or disabling an integration is intended to stop future authorized runtime use without granting unrelated access.
Provider credentials, OAuth refresh tokens, API secrets, and similar sensitive values are not intended to be exposed in ordinary frontend code, Lumira™ prompts, or customer-visible records. Secret-reference records are restricted to trusted server-side/service-role access rather than normal authenticated users.
Lumira™ supports provider-neutral email architecture and may support an approved mailbox provider only after the required authorization and configuration are complete. When a provider uses OAuth, users authenticate with that provider rather than giving Amexa.ai their mailbox password. When a provider uses an app password, you create it on the provider's own page, and Amexa.ai does not store it.
Mailbox content and connection data are used only for the features you use in your own workspace. Connected email content is never sent to an outside AI provider. Lumira™ reads a message only when you press Draft with Lumira™ on it, for that one draft, and does not keep it.
If you connect a social media account to Lumira™ One's inbox, the messages sent to that account are shown in the same list as your email, next to the customer they came from, and your replies are sent from that account. They are used only for the features you use in your own workspace, are never sent to an outside AI provider, and stop arriving when you disconnect the account.
Users may disconnect supported integrations. Provider-side revocation may also be available. Connection metadata, audit records, and legally required records may be retained where necessary to operate or secure the service.
Lumira™ One uses your device's location only when you allow it in your device's own prompt, and only for the feature you are using. Lumira™ GPS and Lumira™ Scout use it to show where you are, to plan a route and to give directions; your exact location stays on your device and is not stored, and only a route's starting point is sent when you ask for that route. When you ask Lumira™ about weather or news near you, an approximate location (about a kilometre) is used for that one answer and is not stored.
A business's team member shares their phone's location on the crew map only while clocked in, and only after agreeing to it for that shift; each new shift asks again. Only the business's Owner and Managers see it. Only the latest point is kept, and it is cleared when sharing stops at clock-out or when the team member taps Stop. No outside map service sees a crew member's location.
You can turn location off at any time in your device's settings. Features that need it then ask again or work without it.
Activity in the Lumira™ Go app can show your steps, active calories, workouts and weight from Apple Health on an iPhone or iPad, or from Health Connect on Android. It reads them only after you tap Connect and allow it in Apple Health's or Health Connect's own screen, and it only reads: Lumira™ Go never adds, changes or deletes anything in Apple Health or Health Connect.
What Activity reads is shown to you on your own phone and nowhere else. It is not sent to Amexa.ai's servers, not stored by Amexa.ai, not shared with any business, person or other company, not given to Lumira™ or any AI, and never used for advertising, marketing, data mining or to train any model. Closing Activity clears it from the screen.
You can stop Lumira™ Go reading your health data at any time: on an iPhone or iPad in Settings → Health → Data Access & Devices → Lumira, and on Android in Health Connect → App permissions → Lumira. Activity then shows nothing until you connect it again.
When something in Lumira™ One, Lumira™ Go or Lumira™ Web stops working, the app sends Amexa.ai a crash report so it can be fixed for everyone: the page or screen it happened on, the part of the app that failed, the kind of error in code words, the app (web, iPhone, iPad, Android, Mac or Windows) and its version. A crash report never holds what was on your screen, anything you typed, said or saw, your messages, amounts, addresses, health data or bank and card details, and it is not linked to your name or account.
With Help improve Lumira on, the apps also send how long screens take to load, buttons that did nothing when tapped, lists that showed nothing while records exist, the step where a sign-up, booking, checkout, payment or list was left unfinished (only the step, never what was entered), answers that missed, the web domain of a sender whose email you mark as spam or move out of Spam in Lumira Mail (only the domain, never the address, the subject or the email itself), and, while you drive with Lumira™ GPS, the time each stretch of road took, never where a trip began or ended or who drove it. Amexa.ai uses these only to make Lumira™ faster, more accurate and more reliable, on its own computers. They are never sold, never used for advertising and never shared with another company.
Help improve Lumira is on by default. You can turn it off at any time in Settings → Privacy; the apps then stop sending everything in the paragraph above at once, on every device you sign in on. Crash reports continue, because they hold nothing about you.
This section explains how Amexa.ai, the company behind Lumira™ One, accesses, uses, stores, shares, and deletes Google user data. If you sign in to Lumira™ One with Google, Google shares only your name, email address and profile picture, used only to create your Lumira™ One account and sign you in. It also applies when you choose to connect your own Gmail account to Lumira™ One. Gmail connects with an app password you create in your own Google account, the same way Yahoo Mail, Apple iCloud Mail and AOL Mail connect: Amexa.ai does not ask Google for permission to read or send your Gmail, and it never receives your regular Google password.
What Amexa.ai accesses. With your app password, Lumira™ One reaches your Gmail through Google's standard mail servers (IMAP and SMTP) to show your inbox, Spam and Trash folders, your messages and their attachments, and to send the emails and replies you write there. A Gmail account connected before October 22, 2026 through Google's own permission page keeps the permissions it was given until you connect it again with an app password or disconnect it: your Google account email address and sign-in identity (openid, email); read and organize Gmail (gmail.modify); and send email (gmail.send). Amexa.ai does not ask for permission to delete your email for good or for full access to your Google account.
How Amexa.ai uses it. Amexa.ai uses Google user data only to provide these features to you in your own Lumira™ One workspace: showing your inbox and messages when you open them; marking email read or unread, moving it to Spam or Trash and back, and adding or removing your own labels, only when you click to do so; sending an email or reply only when you press Send; and, only when you press Draft with Lumira™ on a message, giving that one message's sender, subject and text to Lumira™, Amexa.ai's own AI assistant running on computers Amexa.ai operates, to write a draft reply that you review, change or discard. The message and the draft are used for that one draft only and are not kept. Amexa.ai never sends email from your Gmail on its own and never asks for permission to delete your email for good. Google user data is not used for advertising, is not used to develop, improve, or train AI or machine-learning models, and is not sent to any outside AI service.
What Amexa.ai stores and how it is protected. Gmail messages and attachments are read from Google when you open them in Lumira™ One and are not kept as a copy by Amexa.ai. To keep the connection working, Amexa.ai stores the Gmail address you connected and the connection's status and dates. Amexa.ai does not store your app password: it is passed once to the email service that runs Lumira™ One's mailbox connections, which keeps it only so the connection keeps working and deletes it when you disconnect. For a Gmail account connected earlier through Google's permission page, Amexa.ai also stores the permissions you granted and the refresh token Google issues, which lets Lumira™ One reach your Gmail without asking you to sign in to Google each time. That token is encrypted (AES-256-GCM), kept on the servers Amexa.ai uses to run Lumira™ One, and never sent to your browser. Data moves only over encrypted (HTTPS) connections, and access is limited by sign-in, your workspace, and role-based controls. Only you, and the people you choose to share a connected inbox with in your Lumira™ One team, can open it.
Who it is shared with. Amexa.ai does not sell Google user data and does not share it with anyone except: the people you choose to share a connected inbox with in your Lumira™ One team; the service providers that host and run Lumira™ One for Amexa.ai, only to provide the service and subject to their own terms and security obligations; or where the law requires it or it is needed to protect against fraud, abuse, or security threats. People at Amexa.ai do not read your Gmail data unless you ask us to for a specific message, it is needed for security such as investigating abuse, or the law requires it.
How long it is kept and how to delete it. Amexa.ai keeps the connection details above only while Gmail stays connected and as needed for security and audit records. You can disconnect Gmail at any time in Lumira™ One: Amexa.ai then ends the connection and, for an account connected through Google's permission page, revokes its access at Google and deletes the stored token, so Lumira™ One can no longer reach your Gmail. Connecting that account again with an app password does the same for its earlier connection. You can also delete the app password at any time at myaccount.google.com/apppasswords, or remove an earlier permission at myaccount.google.com/permissions, and Lumira™ One stops reaching your Gmail. To have Amexa.ai delete any remaining information about a connected Google account, email privacy@amexa.ai; Amexa.ai deletes it after confirming the request comes from you, unless the law requires keeping it.
Amexa.ai's use and transfer to any other app of information received from Google APIs will adhere to the Google API Services User Data Policy (https://developers.google.com/terms/api-services-user-data-policy), including the Limited Use requirements.
AI-assisted features are subject to workspace permissions, approved scope, and provider/security controls. Sensitive customer information should not be sent to an external AI or provider unless that use has been reviewed and authorized for the workflow.
Amexa.ai does not provide customers, prospects, trials, or guests with a direct bridge to an outside AI review service through Lumira™. AI assistance is provided only through Amexa.ai-controlled product workflows and applicable authorization boundaries.
If you are part of a team in Lumira™ One, the people who manage that team can see whether you are active, idle, away, or offline in Lumira™ One and which part of it is open. Lumira™ One records activity only: never screenshots, keystrokes, or the content of what you type or view.
Lumira™ One counts active time only while Lumira™ One is open and in use. You can always see your own time. Within Amexa.ai's own team, Amexa.ai's management can also see each team member's time; in a Lumira™ One Business, an Owner's time is visible only to that Owner.
You choose whether other people can see when you have read their messages. The people who manage your team always see when you have read their messages.
Where communications are enabled, the customer is responsible for having a lawful basis and any required permission to contact recipients. Qualification, scoring, a Business Review, or the presence of contact information does not itself authorize outreach.
A website inquiry or Business Review request does not create a client agreement or authorize unrelated marketing by itself.
Amexa.ai sends text messages only to people who call Amexa.ai's business phone number and whose call is missed or ends before it is answered, and to people who agree on amexa.ai/sms. These messages are about that call or request: a follow-up after a missed call, replies to the person's own messages, and confirmations of times they ask for. Amexa.ai does not send marketing text messages.
We do not sell or share your SMS opt-in data or personal information with third parties for marketing purposes. No mobile information will be shared with third parties or affiliates for marketing or promotional purposes. All of the categories of information described in this policy exclude text-messaging originator opt-in data and consent; this information will not be shared with any third parties.
Reply STOP to any message to stop receiving texts, or HELP for help. Message frequency varies. Message and data rates may apply. Questions can be sent to hello@amexa.ai.
Amexa.ai uses service providers for functions such as hosting, authentication, database infrastructure, security, communications, integrations, payments, and product operations. Providers receive access only as needed for the service and remain subject to their own terms and security obligations.
A third-party provider is not represented as connected, synced, or production-ready unless Amexa.ai has evidence that the relevant account, permissions, configuration, and acceptance requirements are satisfied.
Where payments are enabled, payment-card and sensitive banking details should be entered directly into the authorized payment or banking provider interface. Amexa.ai does not require customers to place full card numbers, CVVs, full bank-account numbers, routing numbers, payment-provider secret keys, or financial login credentials into Lumira™ prompts or ordinary application logs.
Founder financial dashboards may display authorized provider-derived transaction and payout information while keeping test/sandbox activity separate from live revenue and masking payout destinations where displayed.
Amexa.ai uses layered safeguards appropriate to the current service, including authenticated access, tenant and role boundaries, row-level database controls, AAL2/MFA for sensitive access where configured, encrypted transport, provider authorization controls, secret handling, audit trails, and fail-closed controls for sensitive workflows.
No online system can be guaranteed perfectly secure. Amexa.ai does not claim SOC 2, ISO 27001, HIPAA, PCI DSS, or another certification unless and until that status is formally obtained and specifically stated.
We retain information only as long as reasonably needed to provide services, maintain security and business records, resolve disputes, satisfy contractual obligations, or comply with law. Customer-specific retention, return, and deletion requirements may also be defined in the applicable customer agreement.
You may contact Amexa.ai to request access to, correction of, or deletion of personal information Amexa.ai controls, subject to identity verification and legal or contractual requirements. If information is controlled by a business customer, that customer may be the appropriate decision-maker for the request.
The site may use storage or cookies needed for authentication, security, basic preferences, and operation, along with limited analytics used to understand product or website performance. Amexa.ai does not currently operate cross-site behavioral advertising pixels as part of the public website.
Amexa.ai is a business service and is not directed to children. We do not knowingly solicit personal information from children through the public website.
We may update this policy as the website, services, integrations, or legal requirements evolve. The last-updated date identifies the current public version. Material changes affecting an active customer relationship may also be handled under the applicable customer agreement.
Questions, privacy requests, or security reports can be sent to privacy@amexa.ai.