Privacy Policy

1. Who we are

LOXA CAPITAL LTD ("we", "us") operates Maia Lumen and the website maialumen.com. We are the controller of the personal data described in this policy. We are a company registered in England and Wales under company number 14165664. Our address is 71-75 Shelton Street, Covent Garden, London, WC2H 9JQ, England.

For any question about this policy or your personal data, or to use your rights, email [email protected] or write to us at the address above.

2. What this policy covers

This policy covers the website maialumen.com and any contact you have with us while Maia Lumen is in development. No model or model access is offered yet. Before access opens we will publish an updated policy describing the service, including developer accounts, what is sent to the model, and how training data is chosen and reviewed.

3. The personal data we hold

• Emails and messages you send us: your name, email address, the content of your message and our reply.
• Technical data: when you visit the site, our hosting provider processes your IP address, browser type and the pages requested, so the site can be delivered and protected against attacks. We do not use this to identify you.

The website has no forms, no accounts, no analytics and no advertising cookies.

4. Why we use it and our lawful basis

• To answer your enquiry and keep a record of it: our legitimate interests in running and corresponding about our business (UK GDPR Article 6(1)(f)), or steps you ask us to take before entering into a contract (Article 6(1)(b)).
• To deliver and secure the website: our legitimate interests in keeping the site available and safe (Article 6(1)(f)).
• To meet legal obligations, for example keeping business records: Article 6(1)(c).

We do not sell your personal data, and we do not use it for automated decisions that have legal or similarly significant effects on you.

5. Who we share it with

We use service providers who process data on our behalf under contract: Cloudflare, Inc. (website hosting, security and email routing) and Google LLC (the mailbox that receives forwarded email). They may only use the data to provide their service to us. We may also disclose data where the law requires it, or to professional advisers bound by confidentiality.

6. International transfers

Our providers may process data outside the United Kingdom, including in the United States. Where they do, the transfer is covered by UK adequacy regulations (including the UK Extension to the EU-US Data Privacy Framework where the provider is certified) or by the International Data Transfer Addendum to the European Commission's standard contractual clauses.

7. How long we keep it

• Enquiries and correspondence: up to 2 years after our last contact, unless they lead to a contract, in which case they are kept for 6 years after it ends.
• Website technical logs: kept by our hosting provider for no longer than its standard security retention, usually a few days to weeks.

8. Your rights

Under UK data protection law you can ask for a copy of your personal data, ask us to correct or delete it, ask us to restrict how we use it, object to our use of it, and ask for it to be transferred to you or another organisation. Email [email protected]. We reply within one month, and there is normally no charge.

If you are unhappy with how we have handled your data, please tell us first so we can put it right. You can also complain to the Information Commissioner's Office (ICO), Wycliffe House, Water Lane, Wilmslow, Cheshire SK9 5AF, telephone 0303 123 1113, ico.org.uk.

9. Security

We use encrypted connections (HTTPS) for the website, restrict access to our mailboxes to the people who need it and use two-factor authentication on our accounts.

10. Changes to this policy

We will update this policy when model access opens or when the way we use personal data changes, and show the date of the latest version at the top of this page.