Privacy Policy

Last updated: October 9, 2026

This policy covers the website lumina-seo.com with its tools and dashboards, the Lumina proxy that many of those tools call, and the Chrome extension "Lumina – SEO & GEO". Lumina is run by Julien El-Bahy as a private individual in Austria (see the imprint). He is the controller for everything described here.

The short version

• The extension's on-page checks run in your browser.
• Features that need an outside service (AI answers, keyword and SERP data, PageSpeed, live crawler checks, fetching a URL you enter) go through Lumina's proxy on Cloudflare, which forwards the request.
• The proxy keeps your IP address only inside counters for the free daily credits and the spending cap. Those entries delete themselves after 24 or 48 hours.
• API keys you add are stored only in your browser. They travel with the requests that need them and are never stored on a server.
• The website counts visits with Cloudflare Web Analytics, which sets no cookies, and with Google Analytics, which sets cookies only after you accept.

Hosting

Cloudflare serves the website (Cloudflare Pages). To deliver a page and protect it against attacks, Cloudflare processes your IP address, the requested URL, the referrer and your browser's user agent. Cloudflare may also ask your browser to report requests that failed (Network Error Logging). Legal basis: legitimate interest in running a secure website (Art. 6(1)(f) GDPR). Details are in Cloudflare's privacy policy.

Visitor statistics

Cloudflare Web Analytics counts page views without cookies. Cloudflare adds a small script to every page for this. Legal basis: legitimate interest in knowing which pages are used (Art. 6(1)(f) GDPR).

Google Analytics 4 runs in Consent Mode. Until you make a choice, every consent signal is set to "denied": Google Analytics sets no cookies, but Google still receives cookieless measurements with the page URL, the referrer, browser and device data, your IP address and events such as starting a tool. The script only loads when you scroll, click or tap, press a key or move the mouse on the page. Some tools put the URL or keyword you analyse into the address bar, so it reaches Google Analytics as part of the page URL. If you accept, Google Analytics sets its _ga cookies and can recognise your next visit.

Your choice is stored in your browser (localStorage, key lumina_consent). To change it or withdraw your consent, click "Cookie settings" at the bottom of the page: Google Analytics goes back to "denied", its _ga cookies are deleted and the banner asks again. Google may process the data in the USA and is certified under the EU-US Data Privacy Framework. Legal basis: your consent for cookies and recognition (Art. 6(1)(a) GDPR); for the cookieless measurements before a choice, legitimate interest in basic reach measurement (Art. 6(1)(f) GDPR). See Google's privacy policy.

The Lumina proxy

Many tools can't call outside services straight from your browser. They send the request to Lumina's proxy, a Cloudflare Worker at lumina-proxy.julien-elbahy.workers.dev, which forwards it:

• AI features to OpenAI
• keyword, SERP, competitor, local and AI-visibility data to DataForSEO, which for AI Visibility asks ChatGPT, Claude, Gemini and Perplexity
• PageSpeed checks to Google PageSpeed Insights
• URL fetches, redirect and header checks and live crawler checks to the website you name, partly through Cloudflare Browser Rendering
• city searches in Local Geogrid to OpenStreetMap Nominatim, favicons to Google's favicon service
• Google sign-in tokens to Google (see the Google section below)
• requests of the Bing dashboard to Microsoft, with your own API key (see the Bing section below)

The proxy doesn't pass on your IP address, cookies or browser identity. The websites it fetches see Cloudflare, not you. It stores the following in Cloudflare's key-value store:

• your IP address inside the counters for the free daily credits (deleted 24 hours after your last counted request of the day), inside a 60-second lock against double clicks, and inside the daily DataForSEO spending cap (48 hours)
• search volumes per keyword for 30 days and some DataForSEO answers for 24 hours to 7 days, with no link to you. Another visitor asking the same question gets the stored answer.
• a daily cost record per tool, without IP addresses, for 40 days

API keys and Google tokens only pass through; the proxy stores neither and writes no request log. Cloudflare processes these requests as the hosting provider. Legal basis: providing the feature you asked for (Art. 6(1)(b) GDPR) and legitimate interest in preventing abuse and limiting cost (Art. 6(1)(f) GDPR).

AI features

An AI feature sends OpenAI the text it needs: what you type or paste, and for a page analysis the page's URL, title, description, headings, structured data and up to 8,000 characters of its text. If you ask about Search Console or Analytics data, those rows go along. On the website, a request with your own OpenAI key goes through the proxy with your key. The extension up to version 3.0.1 sends it to OpenAI directly; from version 3.1 it uses the proxy as well. OpenAI processes the data under its privacy policy. Legal basis: Art. 6(1)(b) GDPR.

DataForSEO and PageSpeed Insights

Keyword research, SERP checks, competitor analysis, Local Geogrid and AI Visibility send DataForSEO the keywords, domains, locations and prompts you enter. PageSpeed sends Google the URL you test. With your own DataForSEO key, the request carries your key through the proxy; the extension up to 3.0.1 sends it to DataForSEO directly. See DataForSEO's privacy policy. Legal basis: Art. 6(1)(b) GDPR.

Google Search Console and Google Analytics connections

The dashboards, some tools and the extension can read your Search Console and Analytics data after you sign in with Google. They ask for read-only access only (webmasters.readonly, analytics.readonly) and cannot change anything in your accounts.

• Website: access and refresh tokens are stored in your browser (localStorage). For a new access token your browser sends the refresh token to the proxy, which exchanges it with Google and keeps nothing. The data itself comes from Google straight to your browser.
• Extension: the access token sits in the extension's session storage, which is cleared when the browser closes; the refresh token sits in its local storage. Up to version 3.0.1 the extension exchanges tokens with Google directly; from 3.1 it uses the proxy like the website.
• Disconnecting deletes the stored tokens. To revoke Lumina's access at Google too, open the third-party access page of your Google account.

Lumina's use of information received from Google APIs adheres to the Google API Services User Data Policy, including the Limited Use requirements. Legal basis: Art. 6(1)(b) GDPR.

Bing Webmaster Tools (dashboard and extension)

If you save a Bing Webmaster Tools API key in the website's settings, the Bing dashboard asks Microsoft's Bing Webmaster API for the sites verified in your Bing account and, for the site you pick, its traffic, search queries, pages, crawl data, crawl issues, sitemaps and the URL submissions you have left. Bing's API doesn't accept requests straight from a web page, so these requests go through the Lumina proxy, which passes your key and the site's address to Microsoft and stores neither them nor the answers. "Submit to Bing" sends the addresses you enter to Bing for crawling, and only when you click it. The key stays in your browser's local storage; deleting it in the settings ends all of this.

If you save a Bing Webmaster Tools API key in the extension's settings, the extension asks Microsoft's Bing Webmaster API directly, not through the proxy: for the sites verified in your Bing account, and for the page you open its search queries, clicks, impressions, index status and the URL submissions you have left. "Submit to Bing" sends the page's address to Bing for crawling, and only when you click it. Each request carries your key and the site's and page's address. The key stays in the extension's local storage; deleting it in the settings ends all of this in the extension. A copy on lumina-seo.com (see below) goes with the website's settings. Microsoft processes the data under its privacy statement. Legal basis: Art. 6(1)(b) GDPR.

Other services your browser contacts

• OpenStreetMap map tiles in Local Geogrid and SERP Checker
• Google's favicon service in SERP Checker, SERP Preview and OG Preview and in the extension's SERP preview
• the images of the page you analyse, loaded from that website in Image SEO Checker and OG Preview
• Cloudflare DNS over HTTPS in Tech Stack
• Web3Forms, which receives your name, email address, topic and message when you use the contact form and forwards them to Julien by email

Each of these receives your IP address, as any web server does.

The Chrome extension

Only in your browser:

• It reads the page in the active tab to analyse it.
• After each page load it checks whether the page is indexable, to colour the toolbar icon.
• It notes status codes, redirects and security headers of the pages you load and keeps them until you close the tab.
• From version 4.0, on Google's results pages, it numbers the organic results and marks the domains you listed in its settings, reading the search term from the page's address. You can switch this off in the bar above the results or in the settings.

When you open it on a page, it also:

• fetches that site's robots.txt and sitemap directly
• runs the GEO check, which fetches the page itself and other addresses on the same site directly, such as llms.txt and security.txt
• sends the page URL to the proxy for the live crawler check, which requests the page once per crawler with that crawler's user agent
• loads the site's favicon through Google's favicon service
• loads the page's search data from Google, if you connected Search Console
• loads the page's search data and index status from Bing, if you saved a Bing Webmaster Tools key (from 4.2)

Everything else starts only when you start it: AI, keyword and SERP data, PageSpeed, link checks and screenshots. That includes the button above Google's results, which sends the search term and market to DataForSEO through the proxy. Links into the Lumina web tools carry the page's URL or keyword in the address, so the tool opens filled in and, where you asked for a result, starts right away. They also say that they come from the extension (utm_source=lumina-extension), so the website's analytics can count which of these links people use. lumina-seo.com handles all of this as described above. If you click "Use my keys on lumina-seo.com" in its settings, it copies your saved OpenAI, DataForSEO and Bing keys into lumina-seo.com's storage in this same browser, so the web tools and the Bing dashboard use them too; nothing is sent anywhere for that. The extension contains no analytics or tracking.

Permissions it asks for:

• storage: settings, API keys and tokens on your device
• activeTab, tabs: read the current page and open pages you ask it to check
• scripting: run the analysis and on-page highlights inside the page
• webRequest: read status codes, redirects and response headers
• sidePanel (from 4.0): show Lumina in Chrome's side panel when you choose to
• declarativeNetRequestWithHostAccess (from 4.0, optional, asked for only when you use it): load one tab with another User-Agent, such as Googlebot, and an extra header you type, until you reset it or close the tab
• access to all sites (<all_urls>): analyse whatever page you are on, fetch its robots.txt, llms.txt and sitemap, and number Google's results
• identity: the Google sign-in
• clipboardWrite, downloads: copy results and save screenshots and CSV files

What is stored in your browser

• Website (localStorage): your consent choice, theme, API keys, Google tokens, the selected property and Bing site, credit counters, cached Ask AI results (6 hours) and table settings. They stay until you clear the site data.
• Extension (chrome.storage): API keys, Google tokens, keyword lists per URL (30 days), cached page data (30 minutes, until the browser closes), the live crawler check's answers per URL (10 minutes, from 4.0), the list of your Bing sites (one day) and Bing's answers per URL (6 hours, until the browser closes; from 4.2), redirect and header data per tab (until the tab closes), how often the popup has opened and since when, so it can ask once for a review in the Chrome Web Store (from 4.4), and settings. Removing the extension deletes all of it.

Recipients and transfers outside the EU

Data goes to Cloudflare, Google, OpenAI, DataForSEO, Microsoft (Bing, only with your own key, in the Bing dashboard and the extension), the OpenStreetMap Foundation and Web3Forms as described above, and to nobody else. Nothing is sold or used for advertising. Some of these providers process data outside the EU, including in the USA. Each provider's policy describes the safeguards it uses for such transfers: Cloudflare, Google, OpenAI, DataForSEO, Microsoft, OpenStreetMap Foundation, Web3Forms.

How long data is kept

• Proxy: credit counters with your IP 24 hours after your last counted request of the day, the double-click lock 60 seconds, the spending cap 48 hours; cached search volumes 30 days, cached DataForSEO answers 24 hours to 7 days, cost records without IP 40 days.
• Google Analytics: according to the retention set in the property, at most 14 months.
• Cloudflare hosting and statistics data: according to Cloudflare's policy.
• Contact messages: Web3Forms keeps submissions according to its settings, by default up to three years; the email copy stays as long as needed to answer.
• Your browser: until you delete the site data or remove the extension.

Your rights

Under the GDPR you can ask for access, rectification, erasure, restriction of processing and data portability, you can object to processing based on legitimate interest, and you can withdraw a consent at any time with effect for the future. Most of the data described here sits in your own browser, where you can delete it. For anything else, write to the address below. You can also complain to a supervisory authority; in Austria that is the Datenschutzbehörde.

Children's privacy

Lumina is not directed at children under 13 and does not knowingly collect information from them.

Changes to this policy

This policy was rewritten on September 30, 2026. It now covers the website and the proxy as well as the extension, and it describes the proxy, which earlier versions left out. When the extension's data handling changes, the extension announces it with the update. On October 1, 2026 it was extended for version 4.0 of the extension: Google's results pages, the side panel and loading a tab as a crawler.

Contact

Questions about this policy or about your data: julien.elbahy [at] gmail.com