Privacy Policy

1Introduction & Contact Information

Lumex CRM LLC ("Lumex CRM," "we," "our," or "us") operates the Lumex CRM platform and related services (the "Services"). This Privacy Policy describes how we collect, use, disclose, and protect your personal information.

By creating an account or using the Services, you acknowledge that you have read and understand this Privacy Policy. If you do not agree with our practices, please do not use the Services.

Business Information

• Business Name: Lumex CRM LLC
• Website: https://lumexcrm.net
• Location: Northern Virginia & Richmond, VA

Privacy Contact

2Information We Collect

We collect information in multiple ways depending on how you interact with our Services.

2.1 Information You Provide Directly

• Account Information: Name, email address, phone number, business name, business address
• Contact & Consent Data: Phone numbers and email addresses for SMS/communication opt-in, consent records, timestamps of consent
• Business Information: Company details, industry, service area, contractor type (HVAC, electrical, landscaping, general contractor, etc.)
• Payment Information: Billing address, subscription tier selection. We do not store credit card numbers directly; payment processing is handled by our payment processors.
• Customer Data: Contact information for your clients/prospects (names, phone numbers, emails, addresses) that you input into Lumex CRM
• Communications: Messages, SMS opt-in status, call logs, voice agent interactions, and communication preferences
• AI Agent Inputs: Text prompts, voice commands, and context provided to our AI voice agent and SMS automation

2.2 Information Collected Automatically

• IP address and approximate geolocation derived from IP
• Device information (device type, operating system, browser type, unique identifiers)
• Usage data (pages/features accessed, frequency of use, session duration)
• Log data (access times, actions taken, error logs)
• Cookies and similar tracking technologies (see Section 11)

2.3 Information from Third Parties

• Service integrations (Google, payment processors, SMS/voice providers)
• Publicly available information for lead enrichment purposes
• Information provided by prospective clients during onboarding

3How We Use Your Information

We use collected information to:

• Provide Services: Deliver the Lumex CRM platform, automations, AI voice agent, SMS follow-up systems, and customer tools
• Send Communications: SMS notifications, appointment reminders, AI voice agent calls, follow-up messages, and automation campaigns
• Process Transactions: Handle subscriptions, billing, and payment processing
• Improve Platform: Analyze usage patterns, troubleshoot issues, and develop features
• Ensure Compliance: Meet legal and regulatory obligations, including A2P 10DLC carrier compliance and SMS regulations
• Detect Fraud & Abuse: Protect the platform, prevent unauthorized access, and enforce Terms of Service

4AI Features & Automated Decision-Making

Lumex CRM incorporates artificial intelligence to power core features. This section explains how your data flows through these systems.

4.1 AI Features & Data Processing

4.2 How AI Uses Your Data

• Your data is processed in real-time to generate AI responses and automations
• We do not use your business data, customer data, or conversations to train general-purpose AI models
• AI features are powered by third-party AI services. See Section 6 for vendor details.
• You retain full control over when AI features are active and how they respond

4.3 Your Rights Regarding Automated Decision-Making

Under state privacy laws (California CPRA, Virginia VCDPA, Colorado CPA, and others), you may have the right to:

• Understand which of our automated systems make or influence decisions about you
• Request human review of automated decisions if they have a meaningful legal effect on you
• Opt out of certain automated decision-making systems

To exercise these rights, contact us at [email protected].

5SMS & Mobile Communications

5.1 SMS Communications & Consent

When you provide a phone number and consent to receive SMS communications through Lumex CRM:

• We collect and store your phone number
• We record your consent and the timestamp of that consent
• We use this information to deliver SMS messages you request or configure
• Message frequency depends on your automation settings and interactions

5.2 REQUIRED A2P 10DLC COMPLIANCE NOTICE

5.3 Opt-Out & HELP Commands

• Recipients may reply STOP to opt out of messages at any time
• Recipients may reply HELP for assistance
• After opting out, no further SMS messages will be sent unless the recipient opts back in
• Message and data rates may apply per the recipient's mobile carrier

5.4 SMS Service Provider

SMS messages are delivered by third-party service providers. These providers may have their own data retention and privacy policies. SMS delivery records may be retained by carriers and service providers for regulatory compliance (typically 6-12 months).

6Third-Party Service Providers

Lumex CRM uses third-party vendors to deliver services. These providers are contractually required to protect your data and use it only for the purposes we specify.

7When We Share Your Information

7.1 With Your Consent or Direction

• When you connect third-party integrations
• When you authorize SMS message sending or AI voice agent use
• When you export or share data from your account

7.2 Legal Requirements

We may disclose information if required by law, regulation, legal process, or government request (including subpoena, court order, or law enforcement request).

7.3 Business Transfers

If Lumex CRM is acquired, merged, sold, or enters bankruptcy, your information may be transferred as part of that transaction. We will notify you via email of any such change in ownership.

7.4 Protection of Rights

We may disclose information when we believe disclosure is necessary to protect the rights, property, or safety of Lumex CRM, our users, or the public.

7.5 No Sale of Personal Information

Lumex CRM does not sell your personal information. We do not sell, rent, or trade personal information to third parties for monetary consideration.

8Your Privacy Rights

Depending on your location, you may have rights regarding your personal information. We extend these rights to all users regardless of location.

8.1 Available Rights

• Right to Know/Access: Request a copy of all personal information we hold about you
• Right to Delete: Request deletion of your personal information, subject to legal retention requirements
• Right to Correct: Request correction of inaccurate information
• Right to Data Portability: Request your data in a portable, machine-readable format
• Right to Opt Out: Opt out of marketing communications, targeted advertising, and certain automated decision-making
• Right to Non-Discrimination: We will not discriminate against you for exercising your privacy rights

8.2 How to Submit a Request

Email: [email protected]

Include "Privacy Request" in the subject line and specify which right you are exercising. We will verify your identity and respond within 45 days.

8.3 Applicable Laws

These rights are provided under:

• California Consumer Privacy Act (CCPA) and California Privacy Rights Act (CPRA)
• Virginia Consumer Data Protection Act (VCDPA)
• Colorado Privacy Act (CPA)
• Connecticut Data Privacy Act (CTDPA)
• And other applicable state privacy laws

9Data Retention

We retain personal information for as long as necessary to provide Services, comply with law, and enforce agreements.

9.1 Account Deletion

When you request account deletion:

• All personal information is deleted or anonymized within 30 days
• Transaction records and SMS consent records are retained as required by law (see table above)
• After the legally required retention period, all remaining data is permanently deleted

10Data Security

We implement commercially reasonable technical and organizational safeguards to protect your information:

• Encryption in Transit: All data transmitted between your device and our servers is encrypted using HTTPS/TLS
• Encryption at Rest: Data stored on our servers is encrypted at rest
• Access Controls: Role-based access restricts employee access to sensitive data
• Authentication: Secure authentication protocols for all account access
• Monitoring: Continuous security monitoring and incident response procedures
• Payment Security: Payment information is processed by PCI-DSS compliant third parties; we do not store credit card data

11Cookies & Tracking Technologies

We use cookies and similar technologies on our website and platform.

11.1 Types of Cookies

11.2 Managing Cookies

• You can configure your browser to block or delete cookies. Blocking essential cookies may prevent proper functionality.
• You can opt out of Google Analytics tracking by installing the Google Analytics Opt-Out Browser Extension
• We recognize and honor Global Privacy Control (GPC) signals as a valid opt-out request for tracking and targeted advertising

11.3 Do Not Track

We do not currently respond to "Do Not Track" browser signals, but we do honor Global Privacy Control (GPC) signals.

12Children's Privacy

Lumex CRM is designed for business use by adults (age 18+). We do not knowingly collect information from children under 13. If we learn we have collected information from a child under 13, we will delete it immediately. Contact [email protected] if you believe this has occurred.

13International Data Transfers

Lumex CRM operates in the United States. If you access the Services from outside the US, your information will be transferred to, stored in, and processed in the US. US data protection laws may differ from those in your country. By using the Services, you consent to this transfer and processing.

14Updates to This Privacy Policy

We may update this Privacy Policy at any time. Material changes will be marked with an updated "Last Updated" date at the top of this page. We will notify you via email of material changes. Your continued use of the Services constitutes acceptance of the updated policy.

15Contact Us

If you have questions about this Privacy Policy, your privacy rights, or our data practices:

Lumex CRM LLC
Northern Virginia & Richmond, VA
Privacy Policy — Effective February 20, 2026