Terms of Service

By creating an account or using Lume CRM (the "Service"), you agree to these Terms. If you are accepting on behalf of an organization, you represent that you have authority to bind that organization.

Lume CRM provides a multi-tenant customer relationship management platform including lead tracking, pipeline management, scheduling, invoicing, payments, messaging, and AI-assisted workflows.

• You are responsible for keeping your credentials confidential.
• You must notify us without delay of any unauthorized access.
• Two-factor authentication is strongly recommended for admin accounts.

You agree not to:

• use the Service for unlawful activity;
• import personal data you are not authorized to process;
• attempt to access another tenant's data or bypass security controls;
• reverse-engineer, resell, or white-label the Service without a written agreement;
• send spam or violate anti-spam laws (CAN-SPAM, CASL).

You retain ownership of the data you input. We process it on your behalf as a data processor and apply the safeguards described in our Privacy Policy. A Data Processing Agreement (DPA) is available on request for enterprise customers.

By using the Service, your organization entrusts us with personal information about its users, customers, and leads. This section constitutes the written mandate required by section 18.3 of Québec's Act respecting the protection of personal information in the private sector: Lume CRM acts as a service provider and commits to you as follows.

• Limited purposes: we use this information only to operate the Service, provide technical support, and secure the platform — never for other purposes, and never for our own account.
• Confidentiality: only authorized Lume personnel, bound by confidentiality obligations, may access it; every platform access to your workspace data is logged.
• Safeguards: encryption in transit and at rest, per-tenant isolation (row-level security), role-based access control, and audit logs — detailed in our Privacy Policy.
• Subprocessors: the list is published on our Subprocessors page; any addition is preceded by 30 days’ notice.
• Confidentiality incidents: we notify you without delay — at most 48 hours after becoming aware — of any incident affecting your information, and assist with your notification duties (register, regulators, affected persons).
• Data-subject requests: we assist you in responding to access, rectification, consent-withdrawal, and portability requests.
• End of contract: on termination, information is returned on request (export), then deleted or anonymized per the Termination section — we keep no copy beyond legal obligations.
• Verification: we make available the information reasonably needed to demonstrate compliance with these commitments; a detailed Data Processing Agreement (DPA) is available on request.

See also our Privacy Policy and our list of subprocessors.

Fees are billed monthly or annually, in advance, and are non-refundable except where required by law or under the guarantee below. Late payment may result in suspension after 14 days.

30-day money-back guarantee. If your organization's first paid subscription is an annual plan (paid upfront, in 2 installments or in 3 installments), you may request, within 30 days of your first payment, a full refund of the amounts paid on that subscription, taxes included. The account owner makes the request in Settings → Billing; the date of the request is what counts. The guarantee does not apply if your organization has already paid for a monthly or quarterly plan, or while a payment is disputed with your bank, and it can be used only once. Once the request is approved, the subscription is canceled immediately, remaining installments are not charged, access to the Service ends and your data is kept for 30 days, during which you may request a copy.

We target 99.5% monthly uptime. Scheduled maintenance is announced at least 48 hours in advance when possible.

You may close your account at any time. On termination, we retain anonymized records as required by law (tax, audit) and delete or anonymize personal data within 90 days unless a longer retention is legally mandated.

To the maximum extent permitted by law, our aggregate liability is limited to the fees you paid in the 12 months preceding the claim. We are not liable for indirect, incidental, or consequential damages.

These Terms are governed by the laws of Québec and the applicable laws of Canada. Any dispute shall be brought before the courts of the district of Montréal.

Material changes are announced in-product at least 30 days before taking effect.

The Service includes an AI-powered conversational assistant (“Lumi”) designed to answer questions about Lume and help you in your work. You agree to the following regarding it.

• For information only: Lumi’s answers are provided for general information. They are non-binding and are not a substitute for professional advice (accounting, tax, legal). For your rights and obligations, refer to this agreement and the official sources.
• AI is fallible: Lumi may occasionally provide inaccurate, incomplete, or outdated information. Verify any critical information independently before making a decision.
• Your inputs: the messages you submit to Lumi are processed to generate a response. Do not share sensitive information you do not need in the conversation. Processing occurs with our AI subprocessors, named on the Subprocessors page; the information needed for the answer, such as a customer’s name, is sent to them as is, without redaction.
• No determinative automated decision: Lumi does not make any decision producing legal effects on you or your customers; it assists you, and the final decision remains yours.
• Acceptable use: you agree not to use Lumi to generate unlawful, deceptive, or infringing content, nor to attempt to bypass its safety limits.
• Lumi credits: the Autopilot plan includes a number of Lumi credits per monthly billing period. Unused credits do not roll over. When the credits run out, the advanced AI assistant pauses until the renewal; the rest of the Service is not affected.