The short version
This is the privacy policy for everything Teurons, Inc., a Delaware corporation ("Teurons", "we"), runs: the teurons.com website, Teurons Accounts (accounts.teurons.com), and our products on teurons.com subdomains. One policy covers all of them. Where a product handles data differently, it has its own section below.
- The teurons.com website has no accounts, forms, payments, analytics or advertising, and sets no cookies.
- We do not sell personal data, and we do not share it for advertising.
- We list every company that can process your data on our subprocessors page.
- Questions or requests: hello@teurons.com.
Which part applies to you
- You only visit teurons.com: read "The teurons.com website".
- You sign in to a Teurons product: read "Teurons Accounts" and the section for that product.
- You use Lumio, or you are a visitor to an app that embeds the Lumio widget: read "Lumio".
Two roles: controller and processor
Our responsibilities depend on whose data it is.
Your own account data. When you sign up, create an organisation or invite colleagues, we decide how that data is used. We are the controller, and this policy governs it.
Your end users' data. Some products, such as the Lumio widget, run inside our customers' own apps and receive data about the people who use those apps. That data belongs to the customer. The customer decides what is sent and why, and we only process it to run the service for them. The customer is the controller and we are their processor. The customer's own privacy policy, not this one, governs their relationship with those people. Our Data Processing Addendum covers this processing.
The teurons.com website
teurons.com is an informational site. We do not ask you for personal information on it, and we do not track you across pages or across other sites.
Server logs
The site is hosted on Vercel. Vercel keeps standard server request logs, which include your IP address and user agent. These logs exist for security and operations. We do not use them to profile visitors.
Third-party images
Product screenshots load from images.unsplash.com. When your browser fetches them, Unsplash can see your IP address and user agent, as with any image host. Fonts are served from our own site, so your browser makes no request to Google for them.
Theme preference
The site stores one value in your browser's localStorage: your light or dark theme choice. It stays on your device, is never sent to us, and you can clear it any time in your browser settings.
If you email us
If you write to hello@teurons.com, we receive your email address and whatever you tell us. We use it only to reply and to keep a record of the conversation.
Teurons Accounts
Teurons Accounts is the shared sign-in for Teurons products, at accounts.teurons.com. It runs on Cloudflare Workers with a Cloudflare D1 database.
| What | Details |
|---|---|
| Account | Email address, name, profile picture if one is provided, and whether the email is verified. If you sign in with a password, we store a hash of it, never the password itself. |
| Social sign-in | If you sign in with Google or GitHub, we receive your email address, name and picture from that provider, plus the provider account id and the tokens it issues for the sign-in. |
| Sessions | A session record with its expiry, your IP address and your user agent, kept so we can keep you signed in and detect abuse. |
| Organisations | Organisation names, teams, memberships and roles, and invitations (the invited email address, role and status). |
| Product consent | Which Teurons products you have authorised to sign you in, and the scopes you granted them. |
| Abuse protection | Request counters used to rate-limit sign-in attempts. |
We use this to sign you in, tell products who you are and which organisation you act for, send verification, password-reset and invitation emails, and keep the service secure. Our basis is performing our contract with you and our legitimate interest in keeping the service secure and working.
Accounts sets only cookies needed to sign you in: a session cookie, and short-lived cookies that carry a sign-in through the redirect to a product. Products that use Teurons Accounts set their own signed-in cookie, which is secure, HttpOnly and expires after an hour. We set no advertising cookies and no cross-site tracking.
When you delete your account, your sessions, linked provider accounts, memberships and consents are deleted with it. To delete your account, email hello@teurons.com.
Lumio
Lumio (lumio.teurons.com) is an embeddable, Notion-powered widget for product updates, docs and announcements. It previously had its own privacy policy. This section replaces it, and every commitment in that policy that we keep is stated here. Lumio is our customer's tool: the customer is the controller of data from their own end users, and we process that data for them.
What we collect about Lumio customers
| What | Details |
|---|---|
| Account | Email address, name, and profile picture if you set one. If you sign in with Google we receive these from Google instead of a password. |
| Organisation | Organisation name, membership and roles, and invitations you send. |
| Notion connection | The OAuth grant for the Notion workspace you connect: an access token, a refresh token, the workspace id and name. Tokens are encrypted at rest. |
| Synced content | The pages of the Notion databases you choose, including titles, text, properties and images, copied into our database so the widget can serve them without calling Notion on every request. |
| Support | Anything you send us by email. |
We do not run advertising, we do not sell personal data, and we use no third-party tracking or analytics on our marketing site.
What the widget collects about your end users
The customer controls this. The widget works for anonymous visitors, and everything below other than the anonymous identifier only exists because the customer chose to send it.
| What | Details |
|---|---|
| Anonymous identifier | A random id stored in the browser so unread state works for a visitor who is not signed in. It is not linked to a person. |
| Identified user | If the customer calls identify, the user id they send plus any properties they attach, such as plan or role. The customer chooses these values. Sending an email address or name is their decision, not a requirement. |
| Usage events | Widget opened and closed, articles viewed and read, announcements shown, clicked or dismissed, with the page URL and title where it happened and the origin the widget was loaded from. |
| Read state | Which updates a visitor has seen, so the unread badge is correct. |
| AI Assistant | If the customer enables it, the questions asked and the conversation history, so follow-up questions make sense. |
We use this only to provide the service to the customer: rendering the widget, keeping unread counts right, targeting announcements the customer configured, and showing the customer their own analytics. We do not use it to build profiles, and we never use one customer's data to serve another.
Why we are allowed to process it
For account data, we rely on performance of our contract with you (you asked us to provide Lumio) and on our legitimate interest in keeping the service secure and working. Where the law requires consent, such as for non-essential cookies, we ask first. We do not set non-essential cookies today.
For end-user data, we act on the customer's documented instructions. Establishing a lawful basis for collecting it, and telling those people about it in their own privacy notice, is the customer's responsibility as controller.
How long we keep Lumio data
- Synced Notion content and widget data stay for as long as the account is active, because they are what the widget serves.
- Deleting a source removes its pages. Deleting a widget removes its analytics and read state.
- Closing an account removes the organisation's data within 30 days, except where we must keep records for legal reasons.
- Disconnecting Notion stops all syncing immediately and revokes our access to your workspace. Content already synced stays until you delete the source.
Lumio cookies and browser storage
All of it is strictly necessary.
| What | Purpose |
|---|---|
| Session cookie | Keeps you signed in to the dashboard. |
| Notion connect cookies | Two short-lived cookies that carry your session through the Notion authorisation redirect. They expire in ten minutes and are signed so they cannot be tampered with. |
| Widget storage | The widget stores an anonymous id and read state in the browser so unread counts work. This is storage on the visitor's device, not a tracking cookie, and it is never shared across our customers. |
No advertising cookies, and no cross-site tracking.
Lumio security
Notion access tokens and other stored credentials are encrypted at rest with AES-GCM. API tokens are stored only as SHA-256 hashes and shown to you once, at creation. Traffic is served over HTTPS with HSTS. Requests that identify an end user are verified with an HMAC signature generated by the customer's server, so an identity cannot be forged from a browser. See also our security page and the Lumio terms.
If you are an end user of an app that embeds Lumio
We are only the processor. Please contact the company whose app you use, because they control your data. If you reach us instead, we will pass the request on.
Other Teurons products
Hosted products such as metascan.teurons.com, ohimg.teurons.com and lens.teurons.com may have their own privacy policies. Where they do, that policy applies to the product.
Arc (arc.teurons.com) is an API and documentation site. It has no hosted customer accounts today. If we start hosting accounts or data for Arc users, we will add an Arc section here first.
Who else can see your data
We use a short list of companies to run our services. Each is named, with its purpose, the data it handles and where, on our subprocessors page. We may also disclose data if the law compels us, and we will tell you unless we are legally barred from doing so.
We do not sell or rent your data, and we do not share it for advertising.
International transfers
Our services run on Cloudflare's and Vercel's global networks, so data may be processed in countries other than your own. Where personal data protected by UK or EU law is transferred outside those regions, we rely on the European Commission's standard contractual clauses.
How we protect data
Access to production data is limited to people who need it to operate the service. No system is perfect. If a breach affects your data, we will tell you promptly and describe what happened.
Your rights
Depending on where you live, you can ask us for a copy of your data, correct it, delete it, restrict or object to how we use it, or take it elsewhere. You can export or delete some of it yourself in the product settings. For anything else, email hello@teurons.com and we will respond within 30 days. For server logs held by Vercel, Vercel's own policies also apply.
If you are in the EEA or UK, you may also complain to your local data protection authority.
Children
Our site and products are for businesses and are not aimed at children. We do not knowingly collect data from anyone under 16. If you believe a child has given us data, email us and we will delete it.
Changes to this policy
We will update the date at the top of the page when this changes. For changes that materially affect how we handle your data, we will email account owners at least 14 days beforehand. The current version always lives at teurons.com/legal/privacy.
Contact
Teurons, Inc., a Delaware corporation. Privacy questions and requests: hello@teurons.com.