Data Processing Agreement

Parties

This Data Processing Agreement (“DPA”) is between the customer organization that uses LuminaBuilt (“Customer”) and Negi Enterprise Inc (“Processor”), operating luminabuilt.com. Contact: support@luminabuilt.com.

Scope

Customer is the controller of personal data and project records submitted to LuminaBuilt. Processor processes that data only to provide, secure, and bill the service, and as required by law. Processor does not sell Customer data.

Categories of data

• Account identity (name, email) and organization membership
• Job, quantity, duty, coordination, and billing records Customer enters
• Files and drawings Customer uploads
• Billing metadata from our payment partner (not full card numbers on our systems)
• Service logs needed for security and reliability

Processor obligations

• Process data only on Customer instructions as embodied in the product and this DPA
• Maintain appropriate technical and organizational security measures
• Ensure persons authorized to process data are bound by confidentiality
• Assist with reasonable data-subject and security-incident requests
• Delete or return Customer data after account closure, subject to legal retention

Subprocessors

Processor uses the following infrastructure partners. Category names describe the function; they are not construction-product vendors.

• Vercel

  Application hosting and edge delivery

  Hosts the LuminaBuilt web application and related serverless functions.

• Supabase

  Database, authentication, and file storage

  Stores organization records, secure sign-in, and project files you upload.

• Stripe

  Subscription billing

  Processes subscription payments. LuminaBuilt does not store full card numbers.

• Resend

  Transactional email

  Delivers account and workflow notices you authorize from the product, including upload-link invitations you send to subcontractors and suppliers.

• Anthropic

  Document reading (AI)

  Reads a document when you ask it to — drawings, specifications, quotes, contracts, email you paste in — and returns the extracted items with citations. Content is processed for that request only and is not used to train models. Used only while document reading is switched on for your organization; an administrator can disable it.

Material subprocessor changes will be reflected on this page. See also the Security and Privacy pages.

International transfers

Subprocessors may process data in the United States, Canada, or other regions where they operate. Where required, Processor relies on appropriate transfer mechanisms offered by those providers.

Professional judgment

LuminaBuilt is a tool for construction professionals. Quantity outputs and workflow suggestions do not replace licensed engineering, architecture, surveying, or legal judgment. Customer remains responsible for bids, contracts, certifications, and filings.

Contact

Privacy or processing questions: support@luminabuilt.com