Who we are and our role
ConceptMem is operated by LumenLabs Development LTDA (CNPJ 48.155.438/0001-75), based in Brazil (“LumenLabs,” “we,” or “us”). This policy covers personal data handled through our website, console, managed databases, hosted API and MCP endpoint, and SDK.
We act as a controller for account administration, billing, support, and service security. For personal data customers place in their workspaces, we generally act as an operator (processor), handling it on their behalf. The customer determines the purpose and lawful basis of that processing and manages authorized access.
Contact maximiliano.veiga@lumenlabs.dev about privacy. This policy explains our practices with reference to Brazil’s Lei Geral de Proteção de Dados (LGPD); other mandatory privacy rights may also apply.
Information we collect
- Account and profile details. Your email, authentication records, and optional name, company, job role, and phone number. Password authentication is handled by Supabase. Optional profile fields are not required to create an account.
- Workspace content and access. Observations, records, relations, schemas, provenance, historical changes, and review decisions, together with memberships and integration authorizations. Content submitted by you or your agents may include personal data about other people.
- Billing records. Customer and subscription identifiers, plan, subscription status, and payment-related records. Payment details entered in Stripe checkout are handled by Stripe; ConceptMem does not store full card numbers or card security codes.
- Technical and usage information. Request and error logs, IP addresses, client or browser details, timestamps, usage counters, and page-view analytics. Authentication and abuse-prevention providers also process technical signals needed to validate requests.
- Support communications. Messages and information you send when requesting help, reporting a problem, or exercising a privacy right. Avoid sending passwords, API keys, or unnecessary personal data in support messages.
Why we use information
- Authenticate users and manage accounts, workspace membership, and connected clients.
- Process proposed changes, apply configured rules, maintain current records and history, and respond to queries, reviews, and exports.
- Manage subscriptions, process payments, and enforce plan limits.
- Send account, billing, security, and service notices and respond to support requests.
- Investigate errors, prevent abuse and unauthorized access, understand website usage, and improve service reliability.
- Meet applicable legal obligations and establish or defend legal claims.
Legal bases for processing
For processing we control, the applicable basis depends on the purpose: performing our agreement with you for account and subscription services; meeting legal obligations for required records; or legitimate interests for proportionate security, support, and service improvement, considering the impact on your rights.
Where processing requires consent, we must obtain it separately and you may withdraw it. Accepting the Terms or filling an optional profile field is not blanket consent to unrelated uses. Customers are responsible for determining the appropriate basis for personal data submitted to their workspaces; our service agreement does not establish that basis for them.
AI processing and connected clients
When enabled, hosted AI operations may send submitted content, relevant existing records, and schema context to the provider configured for the Service. Supported providers include OpenAI, Anthropic, and Google. Processing can include extraction, synthesis, conflict assessment, semantic checks, and embeddings. Some calls occur within write workflows or configured policies, without a separate prompt for each call.
The provider is determined by the hosted service configuration; it is not necessarily chosen by each workspace user. Contact us before submitting data that requires a particular provider, processing location, or contractual restriction. Provider retention and handling depend on the applicable service terms and configuration.
An external agent or MCP client that you connect may send retrieved records to its own model provider and keep its own copies. Review its permissions and privacy policy. Revoking its access prevents further authorized access through that grant; it does not recall information already shared.
International processing
LumenLabs is based in Brazil. Our providers may process data in other countries, including the United States. Locations depend on the provider and service configuration. International transfers must satisfy applicable data protection requirements, including an appropriate legal transfer mechanism where required. Contact us for information about the locations and safeguards relevant to your use; this policy does not promise storage exclusively in Brazil or a particular region.
Retention, history, and deletion
We retain account and workspace data while needed to provide the Service. Retention also depends on the type of record, support and security needs, applicable legal obligations, and any agreed contractual requirements. Billing or security records may need to remain after an account closes.
Retracting or superseding a fact does not erase it. Those actions change the current state while preserving historical records and provenance. A workspace’s history or retention settings should not be treated as a guarantee of physical erasure from all records.
Authorized administrators can delete a workspace in its settings. To request account closure or erasure of personal data, contact us and identify the affected account or workspace. Export what you need before deletion. Closing an account and canceling a subscription are separate steps.
Deletion from active systems may not immediately remove copies in backups or records retained for legal obligations or claims. Where applicable, we will explain what must be retained and the reason. Contact us if you need a specific retention or deletion commitment before using the Service.
Security and access
We use technical and organizational safeguards, including encrypted connections, authentication, workspace access controls, and credential revocation. Access permissions help determine which users and integrations can retrieve or propose changes to data.
No system can guarantee absolute security. Protect credentials, review access, and report suspected incidents to maximiliano.veiga@lumenlabs.dev. If an incident triggers notification obligations, we will notify affected parties and authorities as required by applicable law.
Your rights and how to request them
Subject to applicable law and its conditions, you may request:
- Confirmation of processing, access to your data, and correction of inaccurate records.
- Anonymization, blocking, or deletion of unnecessary, excessive, or unlawfully processed data.
- Portability and information about recipients of shared data.
- Withdrawal of consent and deletion of data processed on that basis, subject to legal exceptions.
- Information about refusing consent, opposition to unlawful processing, and review of solely automated decisions affecting your interests.
Email maximiliano.veiga@lumenlabs.dev with the right you want to exercise and enough context to locate your records. We may verify your identity and authority without asking for unnecessary information. Requests are free of charge and handled within applicable legal deadlines.
For data held in another organization’s workspace, contact that organization as controller; you may also contact us for help directing the request. You may raise unresolved concerns with the Brazilian data protection authority (ANPD) or another competent authority.
Children’s data
Account registration is intended for adults aged 18 or older. Customers must assess any additional legal requirements before submitting children’s or adolescents’ data in a workspace. If you believe a minor has created an account or that such data has been submitted unlawfully, contact us so we can investigate and take appropriate action.
Changes to this policy
We will update the revision date when this policy changes and provide additional notice for material changes, such as an email or an in-product notice. If a new use requires consent, we will request it before that processing. Continuing to use the Service is not a substitute for consent where it is required.
Privacy contact
Send privacy questions or requests to maximiliano.veiga@lumenlabs.dev, our contact for LumenLabs Development LTDA (CNPJ 48.155.438/0001-75), Brazil. You can also visit our contact page or read the Terms of Use.