Privacy Policy

Who is responsible for your information

Lumenshore Limited is the controller of personal information processed for the LumenApexflow website, iPhone and iPad app and associated account services, except where a provider independently determines its own purposes as explained below. In this notice, “Apexflow”, “we” and “us” refer to this product and its operator.

Lumenshore Limited, company number 09607326, registered in England and Wales. Registered office: Windsor House, Troon Way Business Centre, Humberstone Lane, Leicester, England, LE4 9HA, United Kingdom.

This notice covers visitors, listeners, account holders, purchasers and people contacting us. Other Lumenshore products have separate notices. A link between brands does not mean that all of their accounts or data are combined. Read this notice alongside the Terms of Use and Cookie Policy; those documents cannot remove your data-protection rights.

The product this notice describes

Apexflow plays prerecorded soundscapes for listening states such as Deep Work, Recovery and Gym. Its imaginative scenes and state names are not measurements of your health, a diagnosis, or an assessment of your mental state. Choosing a state is a listening preference, not a medical record we ask you to supply.

The website offers information and user-initiated previews; it does not currently provide account sign-in or checkout. Account and Royal purchase flows occur in the app. We explain a materially different use of information before introducing it, and obtain a separate choice where required.

Information, sources and choices at a glance

Personal information can identify you directly or indirectly. An account identifier, a support message or a connection record can remain personal information even when it does not contain your name. The following inventory describes the current product, not every permission an operating system could technically offer.

Information that stays on your device

The app stores preferences, onboarding choices, private notes, favourites, playlists, saved rituals, cached audio, daily listening allowance and local listening history on your device to remember your choices and support playback. Private notes, favourites, playlists and the complete local history are not automatically uploaded as part of account sync. Signed-in completed sessions, fit ratings and excluded/restored song preferences can be sent separately.

Local storage is not the same as an online account. Clearing eligible local data does not automatically erase records already sent to us, cancel an Apple subscription or remove a device backup. Your operating system and backup settings determine whether copies are included in backups. Other people with access to an unlocked device may be able to see local information.

Optional accounts and sign-in

An account is optional for local listening. If you use account features, Clerk provides authentication and processes your account identifier, email address and available profile details. We use the verified identity and session information to recognise you and protect account access. An account is needed for signed-in sync and Royal purchases or restoration.

Clerk also receives the app’s vendor device identifier (Apple’s identifierForVendor), device and client details, and connection information when the app contacts its authentication service. Sign-in session activity can include IP address and the approximate city and country derived from it. This helps operate and protect authentication; it is not GPS location access or an advertising identifier. Authentication services can retain operational sign-in and security records separately from your local listening history.

The information returned by Apple or Google depends on the method, your permissions and your provider settings. Apple may supply a private-relay email address. Keep access to your chosen sign-in method; a different provider or address may identify a different Apexflow account. We do not receive your Apple or Google password.

Google and Apple permissions

Google sign-in is used for authentication, not to read your Gmail, Drive, Calendar, contacts or other unrelated Google content. We receive the identity information authorised for sign-in, such as name, email and the provider identifier. We do not use Google sign-in information to build advertising profiles or train a general-purpose AI model.

You can manage connected-app access with the sign-in provider. Revoking a provider permission can prevent future sign-in but does not, by itself, delete information already lawfully held by Apexflow. Contact us if you need an account-data request as well. Deleting Apexflow data does not delete your Apple Account, Google Account or information held by those services for their own purposes.

Listening history, fit ratings and exclusions

When signed in, completed listening sessions and fit ratings can be sent to the account service. Records identify the selected content and relevant session details, such as duration and completion. Excluding or allowing a song can also sync the song identifier and preference to your account. We use these records to provide account history, honour your choices and understand the feedback you deliberately give about content.

A fit rating is not a request for health advice. Do not place medical details or other sensitive information into a free-text field just to describe a listening preference. Signing out stops use of signed-in features but is not a deletion request for information already associated with the account.

Royal and purchase records

Apple processes App Store payments. We do not receive your full payment-card details. Purchase and entitlement information from Apple and RevenueCat lets us confirm Royal access, recognise renewal or expiry, restore eligible purchases and investigate a mismatch.

RevenueCat receives a purchase-service identifier, including an opaque Apexflow account identifier when associated with your signed-in purchase, and relevant product, transaction and subscription information. Its service may use an anonymous purchase-service identifier before an account is associated. We do not send it your profile name or email for this integration, or use it to collect an advertising identifier.

Apple also retains purchase records under its own terms and legal obligations. Ending a subscription, removing an entitlement, deleting an Apexflow account and deleting provider records are different actions. See the deletion and retention sections before choosing an action.

Support messages and diagnostics

When you send an in-app report, we receive what you enter, including the issue category, impact, message and expected behaviour. The report can be associated with your account and relevant screen or feature. Basic request context, including client/browser information and a request identifier, may accompany it even if optional extended diagnostics are off.

If you choose extended diagnostics, a report may also contain app and operating-system versions, device class, language, time zone, audio state and recent diagnostic events. The choice concerns that additional context, not the information necessary to deliver and understand the report itself. Email correspondence includes your address, message and any attachments you choose to send.

Please remove passwords, access codes, full card numbers, unrelated third-party information and unnecessary health details from messages or screenshots. We may ask for a narrower example instead of a full recording or export. Do not send another person’s confidential information without authority.

Website visits and preview playback

You can browse and listen to previews without an account. Audio starts only when you request it. The current preview, playback position and volume are held in page memory, not stored by the website as an account listening profile. Requesting an audio file still sends connection information needed to deliver it.

Hosting and content-delivery services receive technical requests to deliver pages, fonts, artwork and audio, manage errors and protect against abuse. Optional usage and speed reporting is a separate feature, off by default. Declining it does not prevent browsing or listening. The Cookie Policy lists the website preference record and explains how to change it.

Optional website measurement

If you allow measurement, Vercel Web Analytics and Speed Insights process website usage and performance information, such as page paths, referral information, approximate region derived from the connection, browser/device characteristics and loading or interaction timings. We do not attach your app account, private notes or support message to these events. Our integration removes query strings and fragments from the event page URL before sending it.

Web Analytics does not set an analytics cookie or create a cross-site advertising identifier. That does not make all connection or measurement information non-personal. The service uses limited technical information to produce aggregated reports. We do not attempt to re-identify visitors from those reports.

Your choice is specific to this browser and website, and separate from app settings. Global Privacy Control or Do Not Track, when exposed to the site as enabled, keeps optional website measurement off even if a previous browser preference allowed it.

Information we do not ask for

The current app does not ask for precise GPS location, Health records, contacts, calendar content, microphone recordings or advertising identifiers. Its authentication service uses a vendor device identifier and IP-derived approximate location as described above. We have no active general-purpose app analytics SDK; operational authentication records are separate from optional website measurement. An analytics preference in the app does not by itself mean an analytics service is running.

We do not sell personal information, rent contact lists, or share information for cross-context behavioural advertising. We do not offer a payment or discount in exchange for selling your information. We do not use your private notes or support correspondence to train a general-purpose AI model. Prerecorded soundscapes are not an AI conversation service.

Purposes and legal bases

Where UK GDPR or EU GDPR applies, we need a legal basis for each use of personal information. The basis depends on the purpose, not simply on whether you have accepted product terms. This table describes our current purposes; it is not a blanket permission for unrelated future uses.

Legitimate interests and your objection

Our legitimate interests include maintaining a reliable service, preventing unauthorised access, investigating errors, responding to non-contractual enquiries and resolving genuine disputes. We consider whether the purpose can be achieved with less information and balance it against the impact on you, your reasonable expectations and available safeguards.

You can object to processing based on legitimate interests for reasons relating to your situation. Where the law requires, we will stop unless we demonstrate overriding grounds or a relevant legal-claims exception. We do not use legitimate interests to override a required consent choice for optional website measurement.

What happens if you do not provide information

You can browse the website, decline measurement and use local app listening without social sign-in. Account authentication information is necessary for account access; purchase and entitlement records are necessary to provide or restore Royal. If those records cannot be verified, the associated feature may be unavailable even though free listening remains a separate offering.

Fit ratings, private notes, optional diagnostics and website measurement are not prerequisites to buying Royal. We may be unable to investigate a report or disclose an account record if you do not provide enough relevant information or proportionate verification. We explain the missing information rather than requiring unrelated data.

Consent and changes of purpose

Where processing relies on consent, you may withdraw it at any time using the relevant control or by contacting us. Withdrawal does not make earlier lawful processing unlawful, and it does not automatically erase information retained on another valid basis. Refusing optional measurement does not reduce the website’s listening or reading features.

We assess compatibility before using existing information for a new purpose. Where the purpose is incompatible, or the law requires a fresh permission or notice, we obtain that permission or provide the required notice before proceeding. Publication of a revised policy is not consent to a new use.

Providers and other recipients

Access is limited to people and providers who need information for the relevant service, support, security or legal purpose. A provider acting on our instructions is different from an independent service, such as your payment or identity provider, which has its own obligations and notice. No provider receives permission through this policy to sell your information for advertising.

Legal disclosures and business changes

We may disclose relevant information where required by law, a valid court order or a competent authority, or where lawfully necessary to investigate fraud, protect safety or establish, exercise or defend legal claims. We assess the request and seek to limit disclosure to what is necessary. A request from a third party does not automatically entitle it to your account records.

A proposed investment, reorganisation or business transfer may require limited information to be assessed under appropriate confidentiality restrictions. If responsibility for your information changes, we provide notice where required and require the recipient to respect applicable data-protection duties. A sale of a business is not permission to abandon the purposes described here.

International processing and safeguards

We are based in the United Kingdom. Providers and their authorised personnel may process information in other countries, including the United States, whose rules may differ from those where you live. The availability of an app in a country does not mean all related information remains in that country.

For a restricted UK or EEA transfer, the applicable transfer requirements must be met. Depending on the destination and recipient, the mechanism may be an adequacy decision or approved contractual safeguards, such as EU standard contractual clauses and the applicable UK addendum or international data transfer agreement, with additional measures where necessary. We do not claim that every provider is certified under a particular framework or that a framework covers every transfer.

You can ask which safeguards apply to your information and request a copy or meaningful explanation. We may redact confidential commercial or third-party information without preventing you from understanding the protection. Contact us if a transfer concern affects your decision to use an account feature.

How long information stays

We keep personal information only for as long as needed for its stated purpose, a relevant legal obligation or a justified dispute or security need. There is no single period covering a local note, a purchase record and a support complaint. The criteria below explain the differences; they are not a promise that every record disappears immediately when you sign out.

Clearing data and requesting deletion

In Settings → Account, choose Delete account to request deletion of Apexflow account data. Verify the request with the code sent to your account email and choose immediate or scheduled deletion. The app shows processing until the service confirms completion. Eligible local clearing is a separate privacy control. You can also email support@lumenapexflow.com, including if you cannot sign in or receive the verification code. You do not need to know our systems to make a valid request.

Submitting a request is not instant erasure. Completed product deletion removes your Apexflow profile and associated listening sessions, ratings, song preferences, product support reports and product chat records. It also requests deletion of the relevant Clerk identity and RevenueCat customer record where they are not needed by another Lumenshore product. Shared provider records, independent provider records and lawful retention exceptions are assessed separately; a completed product request is not a claim that every record held by every provider has disappeared.

Clearing local data does not automatically remove server records. Removing server records does not remotely wipe every device or backup. Other Lumenshore products and your independent Apple or Google account are not automatically deleted. Deleting the app or account does not cancel Royal: manage renewal through Apple to avoid a further charge.

What can remain after an account is removed

Some information may lawfully remain for financial obligations, security incidents, a legal claim or evidence that a request was handled. The deletion workflow retains limited request and outcome metadata, including verification and processing dates, deletion scope and provider results. A protected completion receipt allows the app to check the outcome after sign-in access is removed. The email recipient is kept encrypted while the completion notice is pending and cleared after that step. Separate email correspondence and records needed by another Lumenshore product may require their own assessment; account-linked Apexflow product reports are included in the product deletion.

Residual backup copies can persist until replaced or removed through the relevant backup lifecycle. They are not a reason to keep using deleted account information for ordinary product purposes. If information is restored for recovery, the relevant deletion or restriction must be reapplied. We do not promise a fixed backup purge deadline that has not been established for the affected service.

Where a provider acts independently, it may need to respond to you under its own notice. We remain responsible for addressing information processed on our behalf and explaining who is responsible, what has been removed, and what cannot yet be removed and why.

Security and incident handling

We use technical and organisational safeguards appropriate to the service, including encrypted connections, authenticated access to account features and limits on access to information. No online service, storage system or device can be guaranteed completely secure. A website preview is public content; an account token or private support message is not.

Protect your device and sign-in provider, install security updates and do not share access codes. Tell us promptly if you suspect unauthorised access, without including a password or live token. We assess suspected incidents, take appropriate containment steps and notify affected people or authorities where the applicable legal threshold and timeframe require it. We do not promise that every technical error is a reportable breach.

Your privacy rights

Rights depend on the law that applies to you and the processing concerned. You may request confirmation of processing and a copy of your information; correction of inaccurate or incomplete information; erasure; restriction; an objection to certain processing; and, where applicable, a portable copy of information you provided. You can also withdraw consent and complain to a regulator.

These rights are not all absolute. For example, access must respect another person’s privacy, and a valid legal obligation may require retention of a transaction record. We explain a restriction or refusal and the available challenge rather than treating a product setting as your only route. A request is not conditional on holding Royal or maintaining an account.

Access, correction and portability

Tell us what you want to access or correct and, if useful, the dates or account involved. You do not have to specify a legal article. An access response may include the information itself and an explanation of purposes, recipients, retention and rights. If you disagree with a subjective support assessment, we can record the correction request without pretending the original correspondence never existed.

Where portability applies to automated processing based on consent or contract, you can request eligible information in a structured, commonly used, machine-readable form and ask for direct transmission where technically feasible. This does not require disclosure of another person’s information, confidential security controls or protected content licences. Access to information is distinct from a licence to redistribute audio.

Restriction, objection and withdrawal

You can ask us to restrict relevant processing while accuracy or an objection is considered, or in other circumstances recognised by applicable law. Restriction may preserve information for a legal claim without using it for ordinary features. Explain which use you want limited so we can apply the request accurately.

Object to legitimate-interest processing by explaining your circumstances; withdraw consent using the related control or contact route. If we ever introduce direct marketing, the applicable right to object to that marketing is not subject to a balancing test. This notice does not announce a marketing mailing list or enrol you in one.

Making a request and verifying identity

Email support@lumenapexflow.com or write to our registered office. Include “LumenApexflow privacy request”, the relevant account email or other identifying context, and the result you want. If you no longer control an account email, say so; we will consider an appropriate alternative. A person without an account can still make a request about correspondence or website information.

We use proportionate verification to avoid disclosing or deleting another person’s information. We may ask for information that matches existing records, proof of authority for a representative or clarification of the scope. We do not routinely require a full identity document. If a document is genuinely needed, we explain why and how to minimise it. Verification information is used for handling and safeguarding the request, not unrelated profiling.

Response periods, fees and appeals

For UK or EEA rights requests, the usual response period is one month. Where the applicable law permits an extension for complexity or multiple requests, we explain the reason and extension within the initial period; the GDPR extension can be up to two further months. We apply any lawful rules concerning necessary identification or clarification, not an open-ended support queue in place of a statutory deadline.

Requests are normally free. A charge or refusal is considered only where the applicable law permits it, for example a manifestly unfounded or excessive request, with an explanation. Other jurisdictions may prescribe a different response period or appeal process; those rules take precedence for a request to which they apply.

If you disagree with our response, reply asking for a privacy review or appeal and explain the issue. This internal route does not restrict a regulatory complaint or court remedy. Where a statutory appeal applies, we follow its applicable response and escalation requirements.

Profiling and automated decisions

Apexflow does not make decisions that produce legal or similarly significant effects about you solely through automated processing. Remembering a chosen state, validating a purchase entitlement or showing content in response to your selection is not a clinical or employment assessment.

We do not infer a medical diagnosis from your listening or use it to decide insurance, credit or employment eligibility. If a future feature introduces materially different profiling, we will describe its data use and provide any required safeguards before it is used.

Children and sensitive information

Apexflow is a general listening service, not a child-directed service. Account and purchase eligibility must also comply with applicable law and the requirements of Apple and the chosen sign-in service. An App Store content age rating is not, by itself, parental consent for processing personal information.

We do not knowingly seek children’s personal information in circumstances requiring parental authorisation without that authorisation. A parent or guardian who believes a child supplied information inappropriately should contact us so we can investigate and take the appropriate action. Do not send the child’s identity documents or sensitive details unless we explain why they are necessary.

We do not ask for special-category information such as medical history, religion or biometric identification. If you voluntarily include sensitive information in correspondence, we limit its handling to what is necessary and lawful for the issue, and may ask for a redacted version. A listening state is not an invitation to disclose a diagnosis.

United Kingdom and European Economic Area

Where UK GDPR or EU GDPR applies, the controller, purposes, legal bases, recipients, international transfers and retention criteria are described above. You may complain to the UK Information Commissioner’s Office or the competent supervisory authority, including in the EEA country where you live or work or where the alleged infringement occurred. You do not have to complete our internal process first.

Contact Lumenshore directly for a request or question about representation for your location. This notice does not designate an unnamed EU representative or data protection officer, or imply a local establishment where one has not been identified. Any additional legally required contact information must be provided where the relevant obligation applies.

United States and California

US state privacy rights depend on residence, statutory thresholds, exemptions and the particular processing. Where a state law applies, you may have rights to access, correct, delete and obtain portable information, to opt out of specified uses and to appeal a refusal. We do not treat this section as a claim that every state privacy statute applies to Lumenshore.

For California where the CCPA applies, the inventory above describes identifiers, commercial information, internet/technical activity and information you choose to provide, their sources, purposes and recipient categories. We do not sell personal information or share it for cross-context behavioural advertising, and do not use sensitive information to infer characteristics about you. You can make an applicable request directly or through an authorised agent without creating an account; we do not penalise you for exercising a protected right.

Use the request and verification routes above. We apply the response and extension periods required for the particular state right and explain a refusal and available appeal. Enabled Global Privacy Control is respected by keeping optional website measurement off. It does not erase past records or manage independent Apple or Google accounts.

If you live elsewhere

Local mandatory privacy rules may give you additional rights or impose different conditions on consent, international transfers, retention, complaints or response times. We assess a request under the rules applicable to the person and processing, rather than assuming that a UK address removes rights in another jurisdiction.

Tell us your country or region when it is relevant to your request. We can explain the responsible contact and the applicable complaint route. Nothing here requires you to give up a mandatory right, accept a foreign court as your only privacy remedy, or contact us before approaching an authority that is competent to hear your complaint.

Changes and previous versions

Version 3.1, effective 10 October 2026, corrects the description of authentication device identifiers and approximate location, explains the current account-deletion scope, and updates free listening, welcome access and Royal. This is a clarification of the current app and its providers; it does not introduce advertising, website sign-in or website checkout. Earlier published versions remain available in the policy history.

We update the notice when the relevant service or legal requirements change and use additional notice or seek a fresh choice where required. A revised privacy notice is not permission to reuse previously collected information for an incompatible purpose. A summary or translation cannot remove a mandatory right.

Contact Lumenshore

Email support@lumenapexflow.com for support, privacy requests, accessibility barriers or legal correspondence concerning LumenApexflow. You do not need an app account or an active subscription to contact us. In-app Support remains available for product reports.

Lumenshore Limited, company number 09607326, registered in England and Wales. Registered office: Windsor House, Troon Way Business Centre, Humberstone Lane, Leicester, England, LE4 9HA, United Kingdom.

Please identify LumenApexflow, the relevant page or feature and the outcome you are requesting. For a privacy request, identify the account or information concerned without sending passwords, sign-in codes, full card details or unnecessary medical information. An authorised representative can contact us with evidence of their authority.

Routine support messages do not create a guaranteed reply or resolution deadline. Statutory privacy, consumer and accessibility duties, including applicable response periods, remain unaffected. A complaint to a regulator or a request for urgent legal relief does not require our permission.