Skip to content

The people behind LumaVista

Why should you trust me with everything you know?

You shouldn’t have to. Here is every reason I can give you, weakest first — and the last one doesn’t need you to believe me at all.

01the weakest proof

There is one person to hold responsible, and you can look him up.

My name is on the legal record. LumaVista AI is a Spanish sociedad de responsabilidad limitada, incorporated in the EU and subject to EU law, and its public legal notice names exactly one managing director. That is me. 1

It is not a promise. It is a filing.

entity
LUMAVISTA AI, S.L.
legal form
Sociedad de Responsabilidad Limitada
register
Registro Mercantil de Santa Cruz de La Palma
hoja
TP-0003807
euid
ES38004.000275449
managing director
Gösta von Stebut

None of that is a claim I am making. It is a filing you can check, in a register I do not control.

EUID ES38004.000275449 Registro Mercantil de Santa Cruz de La Palma

02an incentive you can reason about

A family business. Self-employed my whole working life. No investor has ever put money into this company, and no advertiser or data broker ever will.

LumaVista is a family business — owned by my wife and me, and nobody else. No investors, no board, no outside seat. No capital increase has ever been registered against this company, which is a public fact you can check in a register I do not control. 2

That shape has consequences you can reason about without trusting me. There is no investor to answer to and no exit to engineer, so there is no pressure to change the deal later. There is no advertising business and no data business, because there is nothing else to sell — the subscription is the product’s whole relationship with you.

Twenty-five years of contract work — banks, a mobile carrier, a police operations-control system, logistics platforms, personalisation backends answering in under five milliseconds. I have spent my whole working life building other people’s systems. This is the first one that is mine, and it is the last one I intend to build.
see exactly what you pay for EUID ES38004.000275449 — the filings themselves (opens in a new tab)

03the proof that doesn’t need you to believe me

I built myself out of the ability to betray you.

Your account key is generated on your own device and stays there. There is no escrow on our side and no copy of that key, so while you are signed out your account is closed to me — not under pressure, not if I changed my mind about you. An always-on space is different, if you switch one on: a court can order us to open it. If we are ever made to open a space, we record it in that space's access log, unless the law forbids us to. 3

It has to read your work to do the work. When you sign out, your account closes to it, except an always-on space you switch on. No escrow on our side, and no copy of your account key. 4

That sentence concedes something most privacy pages skip: while your session is unlocked, the service does process your content, because researching and grounding and indexing it is the job. What it never acquires is a copy of your account key. And every model that processes your work runs on European infrastructure, with no US-headquartered company doing that processing — search reaches public indexes that may sit outside the EU, with the query redacted first and your documents never sent. 5

Twenty years ago I spent a stretch as a solution designer on lawful-interception infrastructure for a mobile carrier. I know exactly what it looks like when a system is built so that someone else can read what passes through it. That is why I built this one so that I cannot.

I have also held a German government confidentiality clearance for police documents — Verschlusssache – Nur für den Dienstgebrauch, at T‑Systems, expired 2023. I am not telling you that to sound impressive. I am telling you because I have seen the inside of the systems that read other people’s traffic, and it is the reason this one is shaped the way it is.

The code is written so you don’t have to trust me.

how the keys work the technical detail set up your own encryption

04and if I stop?

The fair question about a company this size: what happens to everything I have put in, if you stop?

Your data leaves in open formats

Reports, notes and knowledge export as Markdown, HTML, PDF or JSON — plain files that open anywhere.

A shipped feature you can run today, long before you ever need it. Try it now and you never have to wonder.

Privacy survives the company

After a shutdown, sale or seizure, the content of your encrypted account stays closed while you are signed out, except an always-on space you switched on and older workflow data that has not yet moved under your key.

There is no copy of your account key to hand over. That key was never mine to give. An always-on space is different: our servers keep a wrapped key for it, and switching the space off destroys that key.

Erasure is real, and a restore cannot undo it

Deleting your account destroys your live data at once; copies that survive in backups and rotating logs age out within thirty days.

Every erasure is recorded as a marker that identifies no one, kept away from the backups themselves — so restoring an old backup re-erases you automatically, and the restore is aborted rather than finished if it cannot.

‘Immediately’ is easy to say and hard to mean. Deleting your account destroys your live data at once. Copies that survive in backups and rotating logs age out within thirty days — the outer limit the law allows, and I aim to beat it. Here is the part that matters more: every erasure is recorded as a marker that identifies no one, kept away from the backups themselves. Restore a backup from before you left and it re-erases you. If it can’t, the restore is aborted rather than finished. 6

And the honest comparison. Big-company products are retired by strategy changes far more often than revenue-funded one-person shops disappear. The failure you are actually worried about — a silent change of priorities against your interests — is the one this shape of company structurally cannot afford.

If I disappear tomorrow, you lose a tool — not your knowledge, and never your privacy.

getting work out how your data is protected deletion survives a restore the 30 day window, in the policy

05the only proof that keeps updating

Everything above is a snapshot. This is the part you can keep checking.

One architect with the right tools now ships what used to take a floor of engineers. This company is the evidence for its own product: a full research platform, three environments, around twenty thousand commits — built and operated by one person. If that sounds implausible, that is the point. It is what the tool does.

So I build in public. The Coding Triangle is the spine of it — a series about what actually happens when AI writes your code, who pays for it, and what it costs you later. It is the same argument this company is built on, worked out where you can read it.

  1. 01 Who Really Wins When AI Writes Your Code
  2. 02 The Developer's Bargain: You Pay, and You're the Product
  3. 03 The Company's Bargain: Subsidized Today, Metered Tomorrow
  4. 04 The Open-Weight Exit: AI Coding Without the Leash
the Coding Triangle

That is the whole case. The product is the part that has to earn its keep.

Start researching
Sources — every claim above, with where to check it

  1. LumaVista AI names exactly one managing director on its public legal notice: Gösta von Stebut. The company is LUMAVISTA AI, S.L., a Spanish sociedad de responsabilidad limitada entered in the Registro Mercantil de Santa Cruz de La Palma (Hoja TP-0003807, IRUS 1000474997077) and carrying the EU Unique Identifier ES38004.000275449, which makes the entry retrievable by any member of the public through the interconnected EU business registers (BRIS).

    LUMAVISTA AI, S.L. — public legal notice (Impressum), Art. 10 LSSI-CE / EU eCommerce Directive

  2. LumaVista AI is a family business: it is owned by its two founders, a married couple, and by nobody else. It has taken no venture capital, no institutional investment and no third-party equity, and no increase of share capital has been registered against the company since incorporation. Under Spanish company law a capital increase must be entered in the Registro Mercantil before the new shares can be transmitted (Ley de Sociedades de Capital, art. 34), so an outside funding round necessarily leaves a trace on the public register.

    European e-Justice Portal — Business registers: search for a company in the EU (BRIS); the filing history for EUID ES38004.000275449 is the primary record

  3. The account key is generated on the user's own device; LumaVista AI keeps no copy of it and holds no escrow of its own, so it cannot open the content of a locked, encrypted account; the exception is an always-on space the user chooses to switch on, for which LumaVista's servers keep a wrapped key so they can open that one space to run the user's automations, and every opening is written to that space's access log. An organisation may optionally enable escrow on a shared team workspace so that its own owners can recover that workspace's key; the escrow private key is generated in the browser and stored only in copies wrapped to those owners' devices, and it does not cover a member's personal account. Workflow data created before LumaVista's October 2026 custody change moves under the user's own key the next time they sign in; until then LumaVista's servers can still open it.

    LumaVista AI — device-held encryption keys, generated on your device; no provider-held escrow, optional org-owner-held escrow on shared workspaces

  4. The account key is generated on the user's device and LumaVista AI keeps no copy of it and holds no escrow of its own; the content of an encrypted account is encrypted at rest under keys the provider does not hold, except an always-on space the user chooses to switch on, for which LumaVista's servers keep a wrapped key so they can open that one space to run the user's automations, with every opening written to that space's access log. While a session is unlocked the service does process content in order to research, ground chat, index and embed it. Shared team workspaces may optionally enable an organisation escrow so that the organisation's own owners can recover a workspace key; that escrow's private key is held on those owners' devices, not by the provider. Workflow data created before LumaVista's October 2026 custody change moves under the user's own key the next time they sign in; until then LumaVista's servers can still open it.

    LumaVista AI — device-generated keys, no provider-held escrow (org escrow on shared workspaces is org-owner-held), no provider-held copy; session-locked architecture processes plaintext while unlocked

  5. LumaVista AI runs on European cloud infrastructure (Hetzner), and every model that processes a user's own content with the user's intent — research, chat and embeddings — runs on a European sovereign provider in Germany, France or Switzerland, so no US-headquartered company performs that processing. Three paths sit outside that statement and are named rather than implied. Speech synthesis (ElevenLabs, US) and image generation (Google Gemini, US; an opt-in ByteDance option) are disclosed by provider and country on the in-app data-handling page, are reached only by invoking those features, and are disabled outright when the account's trust floor is set to sovereign; replacing image generation with a self-hosted backend is tracked work. Web search is different in kind: to locate publicly available sources, redacted query fragments — never the user's documents — go to a public web index, which may be non-EU. That path is deliberately not consent-gated, because restricting search to EU-only indexes would degrade the sources the product can find.

    LumaVista AI — sovereignty positioning: European sovereign processing of user content (research, chat, embeddings) in Germany, France or Switzerland; named, in-app-disclosed exceptions for speech synthesis and image generation; redacted query fragments to public web indexes

  6. Getting your work out of LumaVista AI, and getting it deleted, are shipped product features rather than policy promises. Reports export from the report toolbar as Markdown, HTML, PDF or JSON, the Markdown export being a plain .md file that opens in any text editor. Deleting an account destroys the live user data on request; copies that survive in backups and rotating logs are removed within 30 days, which is the outer limit the GDPR allows and which the published privacy policy states as the commitment.

    LUMAVISTA AI, S.L. — published Privacy Policy, retention and deletion section