ILUMINA Privacy Policy

This Privacy Policy explains how ILUMINA AI OÜ ("ILUMINA", "we", "us") processes personal data in connection with the ILUMINA platform and websites.

ILUMINA AI OÜ is an Estonian private limited company (OÜ), registration number 17272671, registered office at Ahtri tn 12, Kesklinna linnaosa, Tallinn, Harju maakond, 15551, Estonia.

This Policy is issued in accordance with Regulation (EU) 2016/679 (GDPR). It covers ilumina.co, Startup Studio (app.ilumina.co), and Investor Hub (hub.ilumina.co).

1. Roles Under GDPR

Depending on the context, ILUMINA may act as:

• Data Controller: when processing personal data for platform operations, founder onboarding, website management, contact requests, event participation, analytics, and account management.
• Data Processor: when processing personal data on behalf of Customers under a separate Data Processing Agreement (DPA).

2. Categories of Data Subjects

We may process personal data relating to:

• Founders submitting startup applications or using Startup Studio
• Startup team members listed in submissions
• Investor or Program Partner users of Investor Hub
• Expert Network operators matched to a booked session
• Website visitors
• People who write to us through the website contact form
• Event participants

3. Categories of Personal Data

Personal data may include:

• Name
• Email address
• Professional title and role
• Company or organization
• Contact details
• Messages you send through the contact form, and the page the message was sent from
• Information contained in pitch decks, assessments, action plans, or other submitted documents
• Account login data
• Technical data (IP address, device information, log data)
• Your analytics cookie choice, stored in your browser

4. Purposes of Processing

We process personal data for the following purposes:

• Enabling structured startup submissions and readiness assessments
• Providing AI-assisted scoring, gap analysis, and action plans
• Sharing submissions with selected Investors or Program Partners, and only the profile sections a founder chooses to make visible
• Matching a founder who books an Expert Network session with an operator who reviews the relevant plan
• Operating dashboards and analytics tools
• Managing user accounts
• Responding to contact messages and demo requests
• Hosting events and programs
• Improving platform functionality and AI models (in anonymized or aggregated form)
• Ensuring security and preventing misuse
• Complying with legal obligations

5. Lawful Bases for Processing

We rely on the following legal bases under Article 6 GDPR:

• Performance of a contract (platform use and submissions)
• Steps taken at your request before entering a contract (contact and demo requests)
• Legitimate interests (platform improvement, security, and responding to enquiries)
• Legal obligations
• Consent (where required, including analytics cookies)

6. AI Processing

The platform uses automated systems, including artificial intelligence models, to generate scoring outputs and summaries.

AI outputs are decision-support tools only and are subject to human review by Customers. Expert Network sessions are a separate, human review of a plan a founder chooses to book.

We do not make fully automated decisions producing legal or similarly significant effects.

7. Sharing of Personal Data

Personal data may be shared with:

• Customers to whom a founder applies
• Program Partners in which a founder voluntarily participates
• Expert Network operators, when a founder books a session, limited to what that session needs
• Service providers and subprocessors (including AI providers, hosting providers, and email delivery)
• Legal authorities where required

A Public Profile shows only the sections a founder selects, and the founder can password-protect that page. We do not sell personal data.

Booking a walkthrough opens Google Calendar. Google processes that booking under its own terms.

8. Subprocessors

We may engage subprocessors including:

• AI service providers (e.g., OpenAI)
• Cloud hosting providers (infrastructure located in Germany)
• Google, for Google Analytics on this website, and only after you accept analytics cookies
• Resend, to deliver contact-form messages to us
• Other email and infrastructure service providers

Subprocessors are bound by contractual data protection obligations.

9. International Transfers

Where personal data is transferred outside the European Economic Area (EEA), including to AI, analytics, and email providers, we ensure appropriate safeguards are in place, including Standard Contractual Clauses or other lawful transfer mechanisms.

10. Data Retention

Personal data is retained only as long as necessary for the purposes described in this Policy, or as required by law.

Startup submissions may be retained for operational and legal purposes unless deletion is requested or contractual obligations require retention.

Contact-form messages are kept for as long as we need them to handle the enquiry and keep a record of the correspondence.

11. Data Subject Rights

Under GDPR, individuals have the right to:

• Access their personal data
• Rectify inaccurate data
• Request deletion
• Restrict processing
• Object to processing
• Data portability
• Withdraw consent, including for analytics cookies, at any time
• Lodge a complaint with a supervisory authority, in particular the Estonian Data Protection Inspectorate (Andmekaitse Inspektsioon)

Requests may be submitted to: contact@ilumina.co

12. Security

We implement appropriate technical and organizational measures to protect personal data, including:

• Access controls
• Role-based permissions
• Encryption in transit where applicable
• Monitoring and logging

No system can guarantee absolute security.

13. Cookies

ilumina.co does not set essential cookies. Your accept or reject choice is stored in this browser (local storage) so we can remember it. That choice is not sent to our servers.

We use Google Analytics to understand how the site is used. The Google tag loads on each page with Google Consent Mode. Analytics storage, and analytics cookies, stay off until you accept in the cookie banner. IP anonymization is enabled. Advertising storage stays denied, including after you accept: we do not use advertising cookies.

You can change your choice anytime using Cookie settings in the website footer. Rejecting or withdrawing consent stops analytics storage from that point.

14. Changes to This Policy

We may update this Privacy Policy periodically. Updated versions will be published on our website with a revised effective date.

15. Contact Information

For any questions regarding this Privacy Policy or data protection matters, contact:

ILUMINA AI OÜ
Ahtri tn 12
Kesklinna linnaosa, Tallinn
Harju maakond, 15551
Estonia
Email: contact@ilumina.co