Last updated: January 3, 2026
Effective Date: January 3, 2026 | Version 2.4.1
This Privacy Policy ("Policy," "Privacy Policy," or "Statement") describes how ALYA Technologies Ltd., together with its subsidiaries, affiliates, parent companies, and related entities (collectively referred to herein as "ALYA," "Company," "we," "us," or "our"), collects, uses, processes, stores, shares, transfers, discloses, and protects information, including but not limited to personal data, personally identifiable information ("PII"), sensitive personal information, and any other data as defined under applicable data protection laws and regulations, obtained from or about individuals ("you," "your," "User," "Users," "Customer," "Customers," or "Data Subject") who access, use, browse, interact with, or otherwise engage with our lighting design intelligence platform, websites, mobile applications, application programming interfaces ("APIs"), software development kits ("SDKs"), and any related services, products, features, content, or functionalities (collectively, the "Service," "Services," "Platform," or "ALYA Platform").
By accessing, browsing, registering for, subscribing to, downloading, installing, or otherwise using any part of our Services, you expressly acknowledge that you have read, understood, and agree to be legally bound by this Privacy Policy in its entirety, as well as our Terms and Conditions, Cookie Policy, and any other applicable policies, guidelines, or agreements referenced herein or made available on our Platform. If you do not agree with any provision of this Policy, you must immediately discontinue all use of our Services and refrain from providing any personal information to us.
ALYA reserves the right, at its sole and absolute discretion, to modify, amend, update, revise, supplement, or otherwise change this Privacy Policy at any time, with or without prior notice, subject to applicable legal requirements. Any such modifications shall become effective immediately upon posting of the revised Policy on our Platform, unless otherwise specified. The "Last Updated" date at the top of this Policy indicates when the most recent revisions were made. Your continued use of any Services following the posting of changes constitutes your binding acceptance of such changes. We encourage you to periodically review this Policy to stay informed about our information practices.
This Privacy Policy is designed to comply with applicable data protection and privacy laws, including but not limited to the General Data Protection Regulation (EU) 2016/679 ("GDPR"), the California Consumer Privacy Act of 2018 ("CCPA"), the California Privacy Rights Act ("CPRA"), the Virginia Consumer Data Protection Act ("VCDPA"), the Colorado Privacy Act ("CPA"), the Connecticut Data Privacy Act ("CTDPA"), the Utah Consumer Privacy Act ("UCPA"), the Personal Information Protection and Electronic Documents Act ("PIPEDA"), the Australian Privacy Act 1988, the Brazilian General Data Protection Law ("LGPD"), the UK Data Protection Act 2018, and any other applicable international, federal, state, provincial, or local privacy laws and regulations. Where specific jurisdictional requirements apply, additional provisions may supplement or supersede portions of this Policy as set forth in the jurisdiction-specific addenda attached hereto or incorporated by reference.
For the purposes of this Privacy Policy, the following definitions shall apply:
"Aggregated Data" means data that has been combined from multiple sources and processed in such a manner that individual Data Subjects cannot be identified directly or indirectly from the resulting dataset.
"Anonymized Data" means personal data that has been processed in such a manner that the Data Subject is no longer identifiable, taking into account all means reasonably likely to be used for identification, whether by the controller or by any other person.
"Biometric Data" means personal data resulting from specific technical processing relating to the physical, physiological, or behavioral characteristics of a natural person, which allows or confirms the unique identification of that natural person, including but not limited to facial recognition data, fingerprint data, iris scans, voiceprints, and keystroke dynamics.
"Cookies" means small text files, pixel tags, web beacons, clear GIFs, or similar technologies placed on your device by websites or applications to store information and facilitate various functionalities.
"Data Controller" means the natural or legal person, public authority, agency, or other body which, alone or jointly with others, determines the purposes and means of the processing of personal data.
"Data Processor" means a natural or legal person, public authority, agency, or other body which processes personal data on behalf of the Data Controller.
"Data Subject" means an identified or identifiable natural person whose personal data is being processed.
"Device Information" means information about the device you use to access our Services, including but not limited to hardware model, operating system and version, unique device identifiers, browser type and version, mobile network information, IP address, device settings, and crash data.
"Personal Data" or "Personal Information" means any information relating to an identified or identifiable natural person, including but not limited to name, identification number, location data, online identifier, and one or more factors specific to the physical, physiological, genetic, mental, economic, cultural, or social identity of that person.
"Processing" means any operation or set of operations performed on personal data, whether or not by automated means, including collection, recording, organization, structuring, storage, adaptation, alteration, retrieval, consultation, use, disclosure by transmission, dissemination, alignment, combination, restriction, erasure, or destruction.
"Profiling" means any form of automated processing of personal data consisting of using personal data to evaluate certain personal aspects relating to a natural person, in particular to analyze or predict aspects concerning that person's performance at work, economic situation, health, personal preferences, interests, reliability, behavior, location, or movements.
"Pseudonymization" means the processing of personal data in such a manner that the data can no longer be attributed to a specific Data Subject without the use of additional information, provided that such additional information is kept separately and subject to technical and organizational measures.
"Sensitive Personal Information" or "Special Categories of Data" means personal data revealing racial or ethnic origin, political opinions, religious or philosophical beliefs, trade union membership, genetic data, biometric data, data concerning health, or data concerning a natural person's sex life or sexual orientation.
"Third Party" means any natural or legal person, public authority, agency, or body other than the Data Subject, Data Controller, Data Processor, and persons who, under the direct authority of the Controller or Processor, are authorized to process personal data.
In this Policy, unless the context otherwise requires: (a) words importing the singular include the plural and vice versa; (b) words importing a gender include every gender; (c) references to persons include natural persons, corporations, partnerships, trusts, unincorporated associations, governmental authorities, and other legal entities; (d) references to "including" or "includes" shall be construed as illustrative and not limiting; (e) headings are for convenience only and shall not affect interpretation; (f) references to any statute, regulation, or law include all amendments, modifications, and re-enactments thereof.
We collect information that you voluntarily provide to us in various contexts, including but not limited to:
When you create an account, register for our Services, or update your profile, we may collect: full legal name; preferred name or nickname; email address(es); telephone number(s), including mobile and landline; mailing address, including street address, city, state/province, postal code, and country; date of birth; gender; profile photograph or avatar; username and password (stored in encrypted form); professional title and job function; employer or organization name; industry sector; years of professional experience; professional certifications and credentials; educational background; language preferences; time zone preferences; and any other information you choose to provide in your profile or account settings.
When you use our lighting design platform, we collect: project names, descriptions, and specifications; lighting designs, layouts, and configurations; fixture selections and specifications; floor plans, architectural drawings, and CAD files; room dimensions, ceiling heights, and spatial data; material and surface specifications; color temperature preferences and lighting calculations; energy consumption data and power requirements; budget information and cost estimates; client information associated with projects; project timelines, milestones, and deadlines; notes, comments, and annotations; revision history and version control data; export and rendering preferences; and any other design-related information you input into the Platform.
When you communicate with us or through our Platform, we collect: email correspondence content and metadata; chat messages and instant messaging communications; support ticket submissions and related communications; survey responses and feedback submissions; forum posts, comments, and community contributions; voice recordings and transcripts (with appropriate consent); video conference recordings and transcripts (with appropriate consent); and any attachments, files, or media shared in communications.
When you make purchases or subscribe to paid Services, we or our payment processors collect: billing name and address; payment card information (card number, expiration date, CVV/CVC, processed by PCI-compliant third-party processors); bank account information for direct debit or ACH payments; PayPal or other digital wallet identifiers; billing history and transaction records; invoice details and purchase orders; tax identification numbers (where required); currency preferences; and subscription tier and billing cycle preferences.
When you access or use our Services, we automatically collect certain information, including:
Hardware model, manufacturer, and specifications; operating system type, version, and configuration; unique device identifiers (UDID, IDFA, IDFV, Android ID, IMEI, MAC address); browser type, version, and configuration; browser plug-ins, extensions, and settings; screen resolution, color depth, and display settings; installed fonts and language settings; graphics card and driver information; available storage space; battery level and charging status; device orientation and motion sensors data; Bluetooth and Wi-Fi connection status; and network operator and carrier information.
Internet Protocol (IP) address, including IPv4 and IPv6; access dates, times, and time zone; referring URL and exit pages; pages and features viewed or accessed; click patterns, scrolling behavior, and mouse movements; time spent on pages, features, or sessions; search queries and filter selections; feature usage frequency and patterns; error logs, crash reports, and diagnostic data; API calls and responses; download and upload activity; session identifiers and session duration; authentication events and login history; and system event logs.
Depending on your device settings and permissions, we may collect: precise geolocation data derived from GPS, Wi-Fi, Bluetooth, or cellular triangulation; approximate location derived from IP address; city, region, and country-level location data; postal or ZIP code; time zone information inferred from location; location data associated with projects or designs; and location history over time (where permitted and consented).
We use cookies, web beacons, pixel tags, local storage, session storage, and similar technologies to collect: session management data and authentication tokens; user preferences and settings; shopping cart and wishlist contents; analytics and performance metrics; advertising identifiers and campaign attribution; A/B testing and feature flag assignments; fraud prevention and security tokens; social media integration tokens; and cross-device identification data. For detailed information about our use of cookies, please refer to our Cookie Policy, which is incorporated herein by reference.
We may receive information about you from various third-party sources, including:
When you choose to link, connect, or log in using third-party platforms (such as Google, Microsoft, Apple, LinkedIn, Facebook, or other OAuth providers), we may receive: your public profile information; email address associated with the third-party account; profile photograph; friends or connections list (only with explicit consent); and other information you have made publicly available or authorized the third party to share with us.
We may receive information from: lighting fixture manufacturers and distributors; architectural and design software providers; customer relationship management platforms; marketing and advertising partners; data enrichment and verification services; credit reporting agencies and fraud prevention services; analytics and market research providers; and professional associations and industry organizations.
We may collect information from: public records and government databases; professional directories and registries; news articles, press releases, and media publications; publicly accessible websites and social media profiles; industry publications and conference materials; and patent and trademark databases.
We process your personal data for the following purposes:
To create, maintain, and administer your account; to provide, operate, maintain, and improve our lighting design platform and related Services; to process and fulfill your requests, orders, and transactions; to provide customer support, technical assistance, and troubleshooting; to personalize your experience and deliver customized content; to enable collaboration features and project sharing; to generate reports, exports, and deliverables; and to fulfill our contractual obligations to you. Legal basis: Performance of a contract (GDPR Article 6(1)(b)).
To respond to your inquiries, comments, and requests; to send service-related communications, including confirmations, invoices, technical notices, updates, security alerts, and administrative messages; to provide information about your account, subscription, or transactions; to conduct surveys and collect feedback; and to facilitate communication between users of our Platform. Legal basis: Performance of a contract; legitimate interests.
Subject to your preferences and applicable law, to send promotional communications about our products, services, features, offers, and events; to deliver targeted advertising and personalized recommendations; to conduct market research and analyze marketing effectiveness; to administer contests, promotions, and sweepstakes; and to develop and improve our marketing strategies. Legal basis: Consent (GDPR Article 6(1)(a)); legitimate interests.
To analyze usage patterns, trends, and user behavior; to conduct statistical analysis and generate aggregated insights; to develop new products, services, features, and functionalities; to improve existing Services and user experience; to test and evaluate new features through A/B testing and experimentation; to train and improve machine learning models and AI systems (using anonymized or aggregated data); and to conduct academic and industry research (with appropriate safeguards). Legal basis: Legitimate interests; consent (where required).
To protect the security, integrity, and availability of our Services and infrastructure; to detect, investigate, and prevent fraudulent, unauthorized, or illegal activities; to verify user identity and authenticate access requests; to monitor for and respond to security incidents and vulnerabilities; to enforce our Terms and Conditions and other policies; to protect the rights, property, and safety of ALYA, our users, and the public; and to comply with legal obligations related to security and fraud prevention. Legal basis: Legal obligation; legitimate interests.
To comply with applicable laws, regulations, legal processes, and governmental requests; to respond to subpoenas, court orders, and legal demands; to establish, exercise, or defend legal claims; to protect the rights, privacy, safety, or property of ALYA, our users, or third parties; to enforce our agreements and policies; and to cooperate with law enforcement and regulatory authorities. Legal basis: Legal obligation (GDPR Article 6(1)(c)); legitimate interests.
For users in the European Economic Area, United Kingdom, and other jurisdictions requiring a lawful basis for processing, we rely on the following legal grounds: (a) your explicit consent, where you have given clear consent for us to process your personal data for specific purposes; (b) contractual necessity, where processing is necessary for the performance of a contract with you or to take pre-contractual steps at your request; (c) legal obligation, where processing is necessary for compliance with a legal obligation to which we are subject; (d) vital interests, where processing is necessary to protect someone's life; (e) public interest, where processing is necessary for the performance of a task carried out in the public interest; and (f) legitimate interests, where processing is necessary for our legitimate interests or those of a third party, except where such interests are overridden by your interests, rights, or freedoms.
We may share your personal data with the following categories of recipients:
We engage third-party companies and individuals to perform services on our behalf, including but not limited to: cloud hosting and infrastructure providers (e.g., Amazon Web Services, Google Cloud Platform, Microsoft Azure); content delivery networks and edge computing services; database management and data warehousing services; payment processors and billing services; email delivery and communication platforms; customer support and helpdesk software; analytics and business intelligence tools; marketing automation and advertising platforms; identity verification and fraud prevention services; legal, accounting, and professional advisory services; and software development and quality assurance contractors. All service providers are contractually bound to protect your data and may only process it for the purposes specified by us.
We may share data with: lighting fixture manufacturers for product catalog and specification data; architectural and design software partners for interoperability and data exchange; industry associations and professional organizations; co-marketing and co-branding partners; channel partners, resellers, and distributors; and integration partners whose services you choose to connect with our Platform. Such sharing is subject to appropriate contractual safeguards and, where required, your consent.
In the event of a merger, acquisition, reorganization, asset sale, financing, bankruptcy, or similar corporate transaction, your personal data may be transferred, sold, or otherwise disclosed to prospective or actual acquirers, successors, or assignees as part of the transaction, subject to standard confidentiality arrangements.
We may disclose your personal data to: government authorities, law enforcement agencies, and regulators in response to valid legal requests, subpoenas, court orders, or other legal process; regulatory bodies and industry watchdogs as required by applicable law; legal counsel, auditors, and consultants who need access to such information to advise us; and other parties when we believe disclosure is necessary to protect our rights, privacy, safety, or property, or that of our users or the public.
ALYA does not sell, rent, or lease your personal information to third parties for monetary consideration. We do not engage in the selling of personal information as defined under the California Consumer Privacy Act (CCPA) or similar state privacy laws. However, certain sharing activities for targeted advertising may constitute "sharing" under the CCPA, and you have the right to opt out of such sharing as described in Section 10 below.
Your personal data may be transferred to, stored in, and processed in countries other than your country of residence, including countries that may not provide the same level of data protection as your home jurisdiction. Such countries may include, but are not limited to, the United States, countries within the European Economic Area, the United Kingdom, Canada, Australia, Singapore, Japan, and other locations where we or our service providers maintain facilities.
When we transfer personal data across borders, we implement appropriate safeguards to ensure that your data remains protected in accordance with this Privacy Policy and applicable law, including: Standard Contractual Clauses (SCCs) approved by the European Commission; the UK International Data Transfer Agreement or Addendum; adequacy decisions by relevant data protection authorities; binding corporate rules for intra-group transfers; certification mechanisms such as the EU-U.S. Data Privacy Framework; your explicit consent, where appropriate; and other lawful transfer mechanisms as recognized under applicable data protection laws.
We retain your personal data only for as long as necessary to fulfill the purposes for which it was collected, including to satisfy any legal, regulatory, accounting, or reporting requirements. Retention periods vary depending on the context and our legal obligations. Generally: account information is retained for the duration of your account and for a reasonable period thereafter to allow for account reactivation and legal compliance; transaction records are retained for the period required by applicable tax, commercial, and financial regulations (typically 7-10 years); communication records are retained for the period necessary to resolve disputes and comply with legal requirements; usage data and analytics are retained in identifiable form for up to 24 months, after which they may be anonymized and retained indefinitely; and marketing preferences are retained until you withdraw consent or update your preferences.
When personal data is no longer needed for the purposes for which it was collected, or upon your valid deletion request, we will securely delete or anonymize such data, except to the extent retention is required or permitted by applicable law. Anonymized data, which cannot be used to identify you, may be retained and used indefinitely for research, analytics, and other business purposes.
We implement and maintain appropriate technical and organizational security measures designed to protect your personal data against unauthorized access, alteration, disclosure, or destruction. These measures include, but are not limited to: encryption of data in transit using TLS 1.2 or higher; encryption of data at rest using AES-256 or equivalent; secure hashing of passwords using bcrypt or similar algorithms; multi-factor authentication for account access; role-based access controls and least privilege principles; regular security assessments, penetration testing, and vulnerability scanning; intrusion detection and prevention systems; firewalls and network segmentation; security information and event management (SIEM); incident response and disaster recovery procedures; employee security training and awareness programs; background checks for personnel with access to sensitive data; physical security controls at data center facilities; and vendor security assessments and contractual requirements.
While we strive to protect your personal data, no method of transmission over the Internet or method of electronic storage is completely secure. We cannot guarantee the absolute security of your data. You are responsible for maintaining the confidentiality of your account credentials, using strong and unique passwords, enabling available security features such as multi-factor authentication, promptly notifying us of any unauthorized access or security breaches, and keeping your device and software up to date with security patches.
Depending on your jurisdiction, you may have some or all of the following rights regarding your personal data:
Right of Access: You have the right to request confirmation of whether we process your personal data and, if so, to access that data along with certain related information.
Right to Rectification: You have the right to request correction of inaccurate personal data and completion of incomplete personal data.
Right to Erasure (Right to be Forgotten): You have the right to request deletion of your personal data in certain circumstances, such as when the data is no longer necessary for the purposes for which it was collected.
Right to Restriction: You have the right to request restriction of processing of your personal data in certain circumstances, such as when you contest the accuracy of the data.
Right to Data Portability: You have the right to receive your personal data in a structured, commonly used, and machine-readable format and to transmit that data to another controller.
Right to Object: You have the right to object to processing of your personal data based on legitimate interests, including profiling, and to direct marketing.
Right to Withdraw Consent: Where processing is based on your consent, you have the right to withdraw that consent at any time without affecting the lawfulness of processing before withdrawal.
Right Not to be Subject to Automated Decision-Making: You have the right not to be subject to decisions based solely on automated processing, including profiling, which produce legal or similarly significant effects.
Right to Lodge a Complaint: You have the right to lodge a complaint with a supervisory authority in your jurisdiction.
To exercise any of these rights, please contact us using the information provided in Section 13 below. We will respond to your request within the timeframes required by applicable law (typically 30 days for GDPR, 45 days for CCPA). We may request additional information to verify your identity before processing your request. We will not discriminate against you for exercising your privacy rights.
If you are a California resident, you have additional rights under the California Consumer Privacy Act (CCPA) and California Privacy Rights Act (CPRA), including: the right to know what personal information we collect, use, disclose, and sell; the right to delete personal information; the right to opt-out of the sale or sharing of personal information; the right to correct inaccurate personal information; the right to limit use of sensitive personal information; and the right to non-discrimination for exercising your rights. To opt-out of the sale or sharing of your personal information, please contact us or use the "Do Not Sell or Share My Personal Information" link on our website.
If you are in the EEA or UK, you have the rights described in Section 9 above under the GDPR and UK GDPR. Our Data Protection Officer can be contacted at privacy@alya.design. You have the right to lodge a complaint with your local supervisory authority.
Additional rights may apply depending on your jurisdiction, including under the laws of Brazil (LGPD), Canada (PIPEDA), Australia, Virginia, Colorado, Connecticut, Utah, and other jurisdictions with comprehensive privacy legislation. Contact us to learn more about your rights under applicable law.
Our Services are not directed to, and we do not knowingly collect personal information from, individuals under the age of 16 (or the applicable age of digital consent in your jurisdiction). If you are a parent or guardian and believe that your child has provided personal information to us, please contact us immediately. If we become aware that we have collected personal information from a child under the applicable age without verification of parental consent, we will take steps to delete that information from our servers.
Our Services may contain links to third-party websites, services, applications, or resources that are not operated or controlled by us. This Privacy Policy does not apply to those third-party services. We encourage you to review the privacy policies of any third-party services you access. We are not responsible for the content, privacy practices, or security of third-party services.
If you have any questions, concerns, or requests regarding this Privacy Policy or our data practices, please contact us at:
ALYA Technologies Ltd.
Data Protection Office
Email: info@thelightco.ai
For EU/UK Data Protection matters:
Data Protection Officer
Email: info@thelightco.ai
© 2026 ALYA Technologies Ltd. All rights reserved. This Privacy Policy constitutes a legally binding agreement between you and ALYA Technologies Ltd. regarding the processing of your personal data. Document Reference: PP-2026-01-03-v2.4.1. This document was last reviewed by legal counsel on December 15, 2025.