Privacy Policy

Effective Date: 30th of January 2026

This Privacy Policy explains how Luo Technologies Oy (“Luo” or “we”) uses, collects, or otherwise processes the Personal Data of users ("you") of our platform, website, and related services ("Services"). This Privacy Policy also describes the Personal Data we process and what rights you have related to our processing of your Personal Data.

We may update this Privacy Policy from time to time by posting a new version on our website. If we make any material changes, we will notify you by posting a notice in the Services or sending a notice to the email address we have on file for you before the change becomes effective. Your continued use of the Services after the effective date will be subject to the new Privacy Policy.

Capitalized terms used but not defined in this Privacy Policy have the meanings given to them in our Terms of Service.

1 Personal Data, Data Controller and How to Contact Us

“Personal Data” refers to any data that relates to you as an identifiable individual. It may include your name, address, telephone number, email address, job title, company information, and your use of our Services, for instance. Anonymous information, which we are not in a position to relate to you, does not qualify as “Personal Data”.

“Data Controller” means an entity determining how and why Personal Data is processed. For the purposes of this Privacy Policy, the data controller of your Personal Data is Luo Technologies Oy, a Finnish company (Business ID 3578796-6).

Address: Harjutie 27 A, 02730 Espoo, Finland.

If you have questions about your Personal Data or data protection, you can reach us by email at support@luo.app.

2 Why Do We Process Your Data

Providing data to us is not mandatory. However, we are unable to provide the Services, or some parts or features of the Services, without processing your data. If you use our Services, we will collect your data for some or all of the purposes described below, depending on the Services you decide to use and your choices when using them.

2.1 To Perform a Contract

To provide you with the Services, we process Personal Data necessary to:

create accounts and enable you to use our Services;
operate the Services and enable you to create and manage workspaces;
process payments and verify purchases;
send you communications related to the Services; and
provide customer support and respond to your inquiries.

2.2 Legitimate Interests

To maintain and improve the Services to our users, we have a legitimate interest in collecting and processing your Personal Data to:

develop and improve the Services;
handle your support requests and manage our relationship with you;
develop, improve and customize your user experience;
analyze usage patterns to improve Platform performance and features; and
provide you with information about our Services and offers.

To keep our Services safe and fair and to fight fraud, we have a legitimate interest in collecting and processing your Personal Data to:

analyze and monitor use of the Services;
take action against fraudulent or misbehaving users;
ensure the security of the Platform; and
prevent unauthorized access to the Services.

With your consent, we may process your Personal Data to:

send you newsletters or other similar communications if you have subscribed to them; and
other purposes explained to you when we ask for your consent.

2.4 Legal Obligations

We may process your Personal Data as necessary to:

comply with legal obligations that apply to us; and
protect your vital interests or another person's vital interests.

We do not use your data to make automated decisions that significantly affect you.

3 Data Collect

In relation to your use of our Services, we gather information either directly from you (when you provide information to us) or indirectly (e.g., through our website’s technology or through our partners and contractors).

3.1 Onboarding and Identity Data

We collect the following data during registration and onboarding:

your work email, company details, and job role;
professional history and background information; and
company information obtained through automated research or, where you choose to connect, via LinkedIn.

This data is used to tailor your onboarding experience and recommend relevant templates.

3.2 Customer Input and Interaction Data

We collect data from your interactions with the Services, including:

chat logs with the Luo Assistant;
business logic descriptions and workflow information you provide; and
data you enter into the workspaces you create.

This data is used to generate your Specifications, execute your Application Logic, and improve the quality of our Services.

3.3 Third-Party Integration Data

When you connect Third-Party Services to the Platform, we collect data from those integrations, such as:

business data fetched via APIs; and
other data required to enable your workspaces to read from and write to your existing technology stack.

You are solely responsible for ensuring you have the necessary rights to integrate such Third-Party Services.

When you connect your 3rd party accounts, we only access the specific data (scopes) you authorize. We process this data as your 'processor' to execute your workflows. You remain the 'controller' of this data and are responsible for ensuring your use of these integrations complies with your own privacy obligations to third parties.

3.4 Google API Services Limited Use

Luo's use and transfer to any other app of information received from Google APIs will adhere to the Google API Services User Data Policy, including the Limited Use requirements.

Specifically, any data we access through Google APIs — including the Google Ads and Google Workspace APIs — is used only to provide and improve the user-facing features you have explicitly requested within the Services. We do not transfer or sell this data to third parties, and we do not use it for serving advertisements. We do not allow humans to read this data unless: (a) we first obtain your consent to view specific data; (b) it is necessary for security purposes, such as investigating abuse; (c) it is required to comply with applicable law; or (d) the data has been aggregated and anonymized so that it can no longer identify any individual user.

3.5 Data We Collect Indirectly

We indirectly collect data through your interaction with and use of our websites. This may include, but is not limited to:

browser and device information (both software and hardware);
IP address and approximate geographic location;
application usage data;
referral information; and
statistical and aggregated information.

Statistical or aggregated information does not directly identify a specific person, but it may be derived from Personal Data. If such information is combined with Personal Data, we will treat the combined information as Personal Data.

4 AI and Data Processing

4.1 Use of Foundational AI Models

The Services are powered by third-party foundational AI models (e.g., OpenAI, Anthropic). These models may process your data to generate Specifications and Application Logic.

4.2 No Training on Customer Data

We do not use your data (including Onboarding and Identity Data, Customer Input and Interaction Data, and Third-Party Integration Data) to train our internal AI models or the foundational AI models we use.

4.3 Data Isolation

Your inputs are used solely as context to generate your specific results. One customer's proprietary data, business logic, or Specifications will never influence or appear in another customer's application.

5 Who Can See Your Data

Except as described below, we do not share, sell, or otherwise disclose your Personal Data to third parties. To achieve the purposes described in this Privacy Policy, we may share your data with the following types of recipients:

5.1 Within Your Organization

If you are part of an organization using our Services, other authorized users within your organization may see your name, email address, role, and activity within the Platform.

5.2 Service Providers

We have partners and service providers performing services for us. These partners process your data only at and in accordance with Luo’s instructions to provide the Services. These services may include:

cloud hosting and infrastructure;
customer support;
analytics;
payment processing; and
communication services.

5.3 AI Service Providers

We use third-party AI service providers to power certain features of the Services. Your data may be processed by these providers in accordance with their terms of service and privacy policies. We select providers who commit to appropriate data protection standards.

5.4 Workspace Store

If you choose to publish workspaces in the workspace Store, certain information may be visible to other users, such as:

your name or company name (as the publisher);
workspace descriptions and documentation; and
ratings and reviews.

5.5 Other Companies and Public Authorities

To combat fraud and illegal activity, we may exchange data with other companies and organizations and provide it to public authorities in response to lawful requests.

We may also disclose your Personal Data:

based on your explicit consent;
to comply with the law; or
to protect the rights, property, or safety of us, our users, or others.

6 International Data Transfers

In connection with the processing activities described in this notice, your data may be transferred to and/or processed in countries outside the European Union (“EU”) and the European Economic Area (“EEA”). Because different countries may have different data protection laws from your own country, we take steps to ensure adequate safeguards are in place to protect your data. Adequate safeguards that our partners and we may use include standard contractual clauses approved by the EU Commission and other lawful safeguards.

7 How Do We Protect Your Data

To help ensure a secure and safe user experience, we are continuously developing and implementing administrative, technical, and physical security measures to protect your data from unauthorized access or against loss, misuse, or alteration. These security measures may include, for example:

encryption of data in transit and at rest;
access controls and authentication mechanisms;
regular security assessments and audits;
employee training on data protection; and
incident response procedures.

8 How Long Do we Keep Your Data

We retain your data for as long as your Account is active or as long as necessary to achieve the purpose(s) for which your data was collected. We may periodically delete or de-identify inactive Accounts or other data in our Services.

After the applicable retention period, we will either delete or de-identify your data. We may periodically delete or de-identify inactive Accounts and associated data.

Note that if you ask us to remove your Personal Data, we may retain your data as necessary for our legitimate business interests, such as to comply with our legal obligations, resolve disputes, and enforce our agreements.

9 Cookies

Like most online services today, we and our partners may use cookies or similar technologies to provide, personalize, and improve the Services, analyze how the Services are used, and prevent fraud. Cookies and similar technologies allow us and our partners to store preferences and track your activities within the Services. Please note that our partners may operate under their own privacy policies.

You can manage your cookie preferences through your browser settings. Please note that disabling certain cookies may affect the functionality of the Services.

10 Your Rights and Options

You have the right to:

access the Personal Data we hold about you;
correct or request deletion of your Personal Data;
request us to restrict the processing of your Personal Data;
object to the processing of your Personal Data to the extent our processing is based on our legitimate interests or the legitimate interests of a third party;
where technically feasible, request a copy of the Personal Data you have provided to us in a machine-readable format (data portability);
withdraw your consent at any time where we rely on consent as the legal basis for processing;
not to be subject to a decision based solely on automated processing, including profiling, which produces legal effects or similarly significantly affects you; and
lodge a complaint with a supervisory authority, in particular in the EU Member State of your habitual residence, place of work, or place of the alleged infringement.

If you wish to exercise any of your data subject rights described above, please contact us by email at: support@luo.app

To unsubscribe from our marketing communications, please use the unsubscribe link provided in the messages we send.

We will respond to all requests within a reasonable timeframe. If you have an unresolved privacy or data-use concern that we have not satisfactorily addressed, please contact us. You may also contact your local data protection authority within the European Economic Area for unresolved complaints.

11 Data Deletion Requests

You can request the deletion of the Personal Data we hold about you at any time. This includes data we have collected directly, data generated through your use of the Services, and data we have obtained from Third-Party Services you have connected (such as Meta/Facebook, Instagram, Google, or other integrations).

To request deletion of your data:

Email us at support@luo.app with the subject line “Data Deletion Request”; and
Include the email address associated with your Account and, if applicable, the specific integration or data you would like us to delete.

We may ask you to verify your identity before processing the request. Once verified, we will delete the relevant Personal Data, and instruct our service providers to do the same, within 30 days. We may retain certain data where we are legally permitted or required to do so, for example to comply with our legal obligations, resolve disputes, or enforce our agreements, as described in Section 8 (How Long Do We Keep Your Data).

12 Children

Our Services are designed for business use and are not directed to children under 13 (or other age as required by applicable local law). We do not knowingly collect any Personal Data from children under the age of 13. If we discover we are processing the Personal Data of a person under 13 years old, we will take appropriate measures to promptly delete the data from our records. If you have reason to believe we hold Personal Data relating to a user under 13, please contact us.

13 Contact

If you have any questions about this Privacy Policy or our data practices, please contact us at: support@luo.app.