jake/Lumotia
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity
Files
main
Lumotia/docs/brief/legal-compliance.md
Jake 26c7307607
Some checks failed
check / cargo check (macos-latest) (push) Has been cancelled
Details
check / cargo check (ubuntu-22.04) (push) Has been cancelled
Details
check / cargo check (windows-latest) (push) Has been cancelled
Details
check / svelte build + lint (push) Has been cancelled
Details
agent: lumotia-rebrand — docs, scripts, root config, residuals 
Phase 9 of the rebrand cascade. Sweep covers everything the Phase 8
frontend pass deliberately skipped: docs/, root markdown, scripts,
Cargo.toml descriptions, code comments that survived earlier
word-boundary sed, plus a handful of identifiers caught on the final
verify pass.

transcription-app changes:
- README.md, HANDOVER.md, KNOWN-ISSUES.md, run.sh — magnotia/Magnotia
  -> lumotia/Lumotia.
- docs/ — sweep across all subdirs except docs/handovers/ (preserved
  as immutable audit trail). Includes architecture-map references
  to magnotia_core::*, magnotia_storage::*, etc. now pointing at
  lumotia_*; dev-setup.md tracing output examples (lumotia_startup
  target); brief/ + superpowers/ + issues/ + whisper-ecosystem/ +
  audit/.
- Cargo.toml descriptions on 9 crates (core, audio, cloud-providers,
  hotkey, llm, mcp, plus referenced others).
- crates/core/src/{error,hardware,recommendation,paths}.rs +
  crates/audio/src/wav.rs + crates/llm/src/model_manager.rs +
  crates/cloud-providers/src/keystore.rs + crates/mcp/src/lib.rs —
  doc comments and a model-manager user-agent string.
- Caught on final pass: BroadcastChannel("magnotia_task_sync") -> ...
  ("lumotia_task_sync"); magnotia_locale i18n localStorage key
  renamed + migration shim added; CSS keyframe names
  magnotiaPulse / magnotiaBar / magnotiaFade renamed in the design-
  system kit; magnotia_viewer_item / magnotia_viewer_mode handoff
  keys renamed in HistoryPage + viewer/+page.svelte; src/assets/
  wordmark.svg text.
- src-tauri/src/lib.rs comment cleanup ("magnotia era" was sed'd
  to "lumotia era" earlier — restored).

Preserved (intentional):
- crates/core/src/paths.rs — keeps "magnotia" / "Magnotia" / ".magnotia"
  legacy detection strings in legacy_and_target_paths() so the
  migration shim can still find user data from the magnotia era.
- src/lib/stores/{page,focusTimer}.svelte.ts + src/lib/i18n/index.ts
  — migration call sites reference the legacy magnotia keys
  deliberately.
- docs/handovers/ — historical audit trail.

cargo build --workspace passes. npm run check: 0 errors / 0 warnings
(3958 files). cargo test --workspace: 339 pass / 0 fail.

Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>
2026-05-13 12:38:03 +01:00

3.2 KiB
Raw Permalink Blame History

6. Legal & Compliance

Code signing (non-negotiable for distribution)

  • macOS: Apple Developer Programme (£79/year) + notarisation mandatory. Unsigned apps trigger "damaged app" dialogue that most users cannot bypass.
  • Windows: Extended Validation certificate (£240–£480/year) for immediate SmartScreen bypass. Unsigned executables trigger warnings that destroy conversion.
  • Linux: Users more tolerant of unsigned software. Flathub + AppImage as primary formats.
  • Budget impact: ~£320–£560/year minimum for macOS + Windows signing. Non-optional cost.

GDPR position (local-only tier)

  • Jake is NOT a data processor. Lumotia runs entirely on-device. No data is transmitted, stored, or visible to the developer. Same legal position as distributing a word processor.
  • Special category data: Marketing targets neurodivergent users, but the app does not collect, store, or infer diagnosis information. Per ICO guidance, a "possible inference" is not special category data — only "reasonable certainty" triggers Article 9. Lumotia is on safe ground here.
  • Voice data: Processed locally by Whisper. Never leaves the device. No third-party processor involved.

GDPR position (cloud tier — when added)

  • Jake becomes a data processor when voice data hits an external API.
  • Requires: explicit consent before any audio is sent, data processing addendum, clarity on which AI provider and their retention policies.
  • Do not add cloud features until revenue justifies compliance overhead.

European Accessibility Act (EAA)

  • Enforceable from 28 June 2025. Applies to consumer-facing digital products sold in the EU, including apps.
  • Technical benchmark: EN 301 549 V3.2.1, incorporating WCAG 2.1 Level AA.
  • Applies to non-EU companies selling to EU customers (similar extraterritorial reach to GDPR).
  • Microenterprises (fewer than 10 employees, under €2M turnover) are currently exempt — Lumotia qualifies initially.
  • The UK has not adopted the EAA. UK relies on the Equality Act 2010 ("reasonable adjustments") with no specific technical standards enforced.
  • Competitive opportunity: Neither Tiimo nor Structured publishes a VPAT or formal accessibility conformance report. Publishing one first opens doors to government procurement, educational institutions, and enterprise contracts.
  • Build to WCAG 2.2 AA from day one — this aligns with Lumotia's design philosophy and creates a genuine compliance moat.

Required before paid launch

  • Privacy policy (no data leaves device, no telemetry, no identifying analytics)
  • Terms of service (licence terms, limitation of liability, AI accuracy disclaimer)
  • Cookie policy (if landing page/website uses any tracking)

Required before cloud tier launch

  • Data processing addendum
  • Explicit consent mechanism in-app
  • DPIA (Data Protection Impact Assessment) — recommended given voice data + neurodivergent audience
  • Review AI provider's data retention and training policies

Business structure

  • Personal project for now. No company entity required during beta.
  • Roll into CORBEL Ltd if/when revenue becomes meaningful.
  • Consult tax advisor at ~£500+/month revenue to determine optimal structure.
Reference in New Issue View Git Blame Copy Permalink