Privacy
Policy
Effective date: 1 July 2026 · Issued by: ScarletFlash™
1. Who We Are
Illumea is a product of ScarletFlash, an independently operated technology company. We develop and operate the Illumea platform — an AI-powered visitor engagement and business intelligence service.
This Privacy Policy explains how ScarletFlash collects, uses, discloses, and protects personal data when you visit illumea.ai (our "Website") or use the Illumea platform (our "Service").
For questions about this policy, contact us at arun@scarletflash.io.
2. What Data We Collect
2.1 Data you provide directly
- Account registration information: name, email address, company name
- Payment and billing information (processed by our payment provider; we do not store card details)
- Support enquiries and communications sent to us
- Knowledge base content you upload to the platform
2.2 Data collected automatically
- Website analytics: pages visited, referral source, browser type, approximate location (via Google Analytics)
- Log data: IP address, timestamps, HTTP request details
- Cookie identifiers used to maintain your session
2.3 Visitor data processed on your behalf
When you deploy the Illumea widget on your website, we process visitor data on your behalf as a data processor. This includes visitor chat messages, session metadata, and approximate geolocation. This processing is governed by our Data Processing Agreement.
3. How We Use Your Data
- To create and manage your Illumea account
- To provide, operate, and improve the Illumea platform
- To send transactional emails: account confirmations, billing receipts, platform notifications
- To respond to your support requests
- To send product updates and relevant communications (you may opt out at any time)
- To analyse website usage and improve our marketing
- To comply with legal obligations
4. Legal Basis for Processing
Where the GDPR or UK GDPR applies, ScarletFlash processes personal data on the following legal bases:
- Contract performance — to provide the Illumea service under our Terms of Service
- Legitimate interests — to improve our platform, prevent fraud, and communicate relevant product updates
- Legal obligation — to comply with applicable laws and regulations
- Consent — for marketing communications and optional cookies; you may withdraw consent at any time
5. Data Sharing and Sub-processors
ScarletFlash does not sell personal data. We share data only with trusted sub-processors necessary to deliver the Service, including Anthropic (LLM inference), Vercel (AI gateway), Hostinger (VPS hosting), Resend (email delivery), Google (analytics), and ip-api.com (city/country geolocation from visitor IP). Full details are listed in our Data Processing Agreement.
We may disclose data if required by law, court order, or regulatory authority, or to protect the rights, property, or safety of ScarletFlash, our customers, or the public.
6. International Transfers
ScarletFlash's primary data storage is within the European Union. Some sub-processors (including Anthropic and Resend) process data in the United States. We ensure such transfers are protected by appropriate safeguards including Standard Contractual Clauses adopted by the European Commission.
7. Data Retention
We retain account data for as long as your subscription is active and for a reasonable period thereafter to comply with legal obligations or resolve disputes.
Visitor conversation data is retained for 30 days from the date of collection across all subscription tiers. You may configure a shorter period in the admin dashboard at any time.
Upon account deletion, all personal data is purged within 60 days. Backups are purged within a further 30 days.
8. Your Rights
Depending on your location, you may have the following rights regarding your personal data:
- Access — request a copy of the personal data we hold about you. To request visitor conversation data, email our Grievance Officer with your session identifier (available on request).
- Rectification — request correction of inaccurate personal data we hold about you.
- Erasure — request deletion of your personal data. Account holders may use the Danger Zone in the admin dashboard for immediate deletion.
- Restriction — request that we limit how we process your data in specific circumstances.
- Portability — receive your personal data in a structured, machine-readable format (JSON).
- Objection — object to processing based on legitimate interests.
- Withdraw consent — where processing is based on consent, withdraw it at any time by contacting our Grievance Officer.
- Nominate — under the DPDP Act 2023, you may designate another person to exercise your data rights on your behalf in the event of your death or incapacity. Contact our Grievance Officer to register a nomination.
- Escalate — if your request is not resolved to your satisfaction, you may lodge a complaint with the Data Protection Board of India.
How to submit a request
Email our Grievance Officer with a clear description of your request. We aim to respond within the following timelines:
- Access requests: within 30 days of receipt
- Erasure requests: within 14 days of receipt
- Correction and all other requests: within 30 days of receipt
9. Cookies and Tracking
The Illumea website uses cookies for:
- Session management — to keep you logged in to the admin dashboard (strictly necessary)
- Analytics — Google Analytics to understand how visitors use our website (can be declined)
The Illumea widget embedded on customer websites uses a session identifier stored in the browser to maintain conversation continuity. No cross-site tracking or advertising cookies are set by the widget.
You can control cookies through your browser settings. Disabling analytics cookies will not affect core functionality.
10. Children's Privacy
The Illumea platform is intended for business use and is not directed at children under the age of 16. We do not knowingly collect personal data from children. If you believe we have inadvertently collected data from a child, contact us at arun@scarletflash.io and we will delete it promptly.
11. Changes to This Policy
We may update this Privacy Policy from time to time. Material changes will be communicated by updating the effective date at the top of this page and, where appropriate, by notifying registered customers by email. Continued use of the platform after changes take effect constitutes acceptance of the revised policy.
12. Contact
For privacy-related enquiries, data subject requests, or to raise a complaint, contact ScarletFlash at:
Arun V Sarma
Founder, ScarletFlash · For data access requests, erasure, complaints, or any privacy matter: