# Data Deletion

**Last Updated: 23 October 2026**

This page explains how to have everything a Lumman account holds deleted, what that destroys, and what survives it.

## 1. How to Delete Everything

Sign in at lumman.co, open the connector page at lumman.co/mcp, open **Account**, then **Settings**, and use **Delete account**. You are asked to confirm, and the account closes the moment you do. Nothing else is needed from you afterwards.

## 2. What Closing the Account Does

From that moment the account does nothing: no AI client reaches it, no AI client can be approved on it, nothing can be bought on it, and no plan on it can be changed. The connector page tells you what has happened and what is still to finish.

Then, without anything further from you:

- every subscription the account pays for is stopped with our payment provider, and the period already paid for runs out;
- every authorisation we can withdraw is withdrawn - each Gmail account connected with Google sign-in and each Google calendar account at Google, and every other connected provider that offers a withdrawal at its own. Microsoft offers no way for an application to end its own authorisation, so a Microsoft mailbox's stored credential is destroyed here and you remove Lumman at Microsoft yourself; a mailbox's app password - iCloud's, Fastmail's or Gmail's - is destroyed here too, and keeps working at Apple, Fastmail or Google until you delete it there;
- everything held here that names you is destroyed: the stored credentials, the connections, the AI-client approvals, the record of what a connector was asked to do, and finally the account itself.

The account is removed only when all three are confirmed. Until then it stays closed and holds nothing you can use, and the connector page names each one that is still owed. A part that could not be finished leaves the account closed and the deletion owed - it is never reported as done.

This cannot be undone: nothing lifts a closure.

## 3. What We Never Held

We keep no copy of your mail. Messages, threads, attachments and drafts are read from each mailbox's provider when you or your AI client ask for them, and nothing read that way is stored here, so there is nothing of that kind left to delete.

A clear-out of a mailbox records which messages each of its groups counted - by the provider's identifiers for them and, for a mailbox connected with an app password, each message's own Message-ID, which often names the domain it was sent from, the folder or label each came from and what the clear-out did with it, never a subject, a sender or a recipient - so that what it moved can be put back for seven days after the clear-out is applied; the record is destroyed within minutes of that, or of an hour after its preview where it is never applied. It is destroyed at once when you disconnect the mailbox, and with the account's other records once the account's deletion is carried out.

## 4. What Survives, and For How Long

Two records survive, and neither names anybody.

The first is about payment: for each subscription the account held, a one-way digest of that subscription's own identity at our payment provider and the moment the deletion completed, and beside it one line per notification our payment provider sent about it - that notification's identifier, when it arrived and whether we accepted it. It exists so that a late notification about a closed account can be recognised and refused rather than acted on. Nothing in it can be turned back into your name, your address or your account, and all of it is destroyed thirteen months after that moment - a line for a notification that reaches us later is destroyed thirteen months after it arrives.

The second is about Google, and exists only if you ever gave Lumman access to a Gmail account - even where the mailbox itself was never connected, because Google counts the account the moment you approve it: a one-way fingerprint of the Google account that authorised it, and when it was counted. Google's preview admits a limited number of accounts over the lifetime of our Google application for Gmail and gives none of them back when an authorisation is withdrawn, so this record has to outlive the mailbox, the connection and the account - it is the only way we know how much room is left. The fingerprint is computed with a key our database never holds, so nothing in it can be turned back into your address or your account, and it is kept for as long as that preview lasts.

Beside them, a file your AI client uploaded for a draft or a message and still held when the account closes is deleted within the hour of its upload, as every such file is.

## 5. If You Cannot Sign In

Deleting everything is an act on the account itself, so it is taken while you are signed in and by nobody else. We never carry a deletion out on a request that reaches us any other way: an email proves control of a mailbox, not of the account, and a deletion cannot be undone. An address that still receives mail can sign in with a code sent to it, unless the account has turned the emailed code off. Where it has, there is one way to close the account without signing in: the email a code request gets offers to start over, and confirming it asks for the account to be closed, which happens seven days later exactly as if you had closed it yourself, unless someone signs in to it first. If you have lost access, write to us at in [at] lumman [dot] co and we will help you get back into the account, and the deletion is then yours to make.

## 6. Contact Us

- Email: in [at] lumman [dot] co
- Address: Lumman Ltd, 86-90 Paul Street, London, EC2A 4NE, United Kingdom