Privacy Policy

Introduction

Luma AI Ltd. and its related entities (“Luma AI”, “we”, “our” or “us”) provide the websites located at https://luma.ai/ (“Website”) and all of their subdomains, subpages and successor sites thereof through which the Luma AI Services are provided (together – the “Services”).

Luma AI is dedicated to protecting your privacy rights and making our practices regarding your personal data more transparent and fairer. Please read this policy, as it includes important information in respect of your personal data.

This Privacy Policy (“Policy”) is designed to help you understand how we collect, store, use and share your personal data. This Policy applies whenever you visit our Website or otherwise access or use any of our Services.

We strongly urge you to read this Policy and make sure that you fully understand and agree to it. If you do not agree to this Policy, please discontinue and avoid using our Services. You have the right to cease using our Services at any time.

This Policy is integrated into and forms part of our Terms and Conditions.

For any questions or concerns, please contact us via our email address: help@luma.ai.

This Policy describes the following –

1. What types of personal data we collect

2. Tracking technologies

3. Why we process your personal data

4. With whom we share your personal data

5. Your privacy rights

6. Transfer of personal data

7. How we protect your data

8. Minors

9. Retention

10. Updates to this Policy

11. Controlling version

12. Contact us

1. What types of personal data do we collect?

We collect personal data about you, which refers to any information that could potentially identify you through reasonable means (such as email address or name). This section outlines how and when we collect and process personal data about you.

1.1. Account information:

When you register or sign in, we process your email address, authentication details and profile information you provide, such as your name or avatar.

1.2. Payment and Usage information:

When you use our Services, we collect information about your interaction with our Services. Such information includes purchase history and data pertaining to your activities on our Services, as well as information generated when you interact with our Website (for instance, how and when you use our Website).

1.3. Identifiers and technical information:

Our web service and connected-assistant endpoints process technical information such as IP address, browser and device information, connection information, language and timestamps. This supports authentication, security, troubleshooting and usage analytics.

1.4. Communication information:

When you contact us via email or through the support channels on our Website, we collect the personal data you provide, which include your name, email address, and any other information you choose to provide.

Prompts, uploads and support messages may contain personal or sensitive information. Submit only content you have the right to use and avoid information that is not needed for your request.

1.5. Creative content, connected assistants and safety records

When you create or edit media, we process your prompts, uploaded photos, videos or audio, generation settings, source-media references, generated results and job status. Generation records include your account identifier, feature, model and credit cost so we can provide the service, show your creations and manage your balance.

Connecting an assistant through OAuth creates account-linked authorization records. We store connection and client information and hashed authorization codes, tokens and client secrets. Tool audit records include account and connection identifiers, outcomes, an argument digest and limited, redacted arguments. The connection does not automatically grant Luma access to your full conversation history, but a client may include conversation content in a prompt or tool request it sends to Luma.

Safety processing may include prompts, images, moderation excerpts, classification results and reasons for a decision. These records support content-policy enforcement and investigation of misuse.

2. Tracking technologies

When you visit or access our Services, we use cookies, pixels, beacons, local storage and similar technologies ("Tracking Technologies"). These Tracking Technologies allow us to automatically collect information about you, your device, and your online behavior, in order to enhance your navigation in our Services, improve our Services' performance, perform analytics, customize your experience and offer you, for example, tailored content that better correspond with your interests. You can learn more about our use of Tracking Technologies by visiting our Cookie Policy.

PostHog analytics may include browser session recordings. Depending on the recording settings, these may capture prompts you type and media you upload. Recording is disabled on Luma admin routes. See our Cookie Policy for tracking information.

2.1. What types of Tracking Technologies do we use?

When you use or access our Services, we use the following categories of Tracking Technologies:

(a) Strictly necessary Tracking Technologies: these Tracking Technologies are automatically placed on your computer or device when you access or take certain actions on our Services. These Tracking Technologies are essential to enable you to navigate around and use the features of our Services.

(b) Functionality Tracking Technologies: these Tracking Technologies allow our Services to remember choices you make (such as your language) and provide enhanced and personalized features. For example, these Tracking Technologies are used for authentication (to remember when you are logged-in) and support other features of our Services; and

(c) Performance Tracking Technologies: these Tracking Technologies collect information about your online activity (for example the duration of your visit on our Services), including behavioral data and content engagement metrics. These Tracking Technologies are used for analytics, research and to perform statistics (based on aggregated information).

2.2. How and by who are Tracking Technologies stored on your device?

We store Tracking Technologies on your device when you visit or access our Services – these are called "First Party Tracking Technologies". In addition, Tracking Technologies are stored by other third parties (for example, our analytics service providers, business partners and advertisers), who run content on our Services – these are called Third-party Tracking Technologies. Both types of Tracking Technologies may be stored either for the duration of your visit on our Services or for repeat visits.

You can block or remove cookies and stored site data through your browser settings. This may affect sign-in and other service features. Luma does not currently provide a cookie-settings tool or automatically apply browser Do-Not-Track signals. Contact help@luma.ai to make a privacy request.

Below is a list of useful links that can provide you with more information on how to manage your cookies:

(a) Google Chrome;

(b) Mozilla Firefox;

(c) Safari (Desktop);

(d) Safari (Mobile);

(e) Android Browser; and

(f) Microsoft Edge

3. Why we process your personal data

Any personal data we collect is being used in a way that is consistent with this Policy, and is used as follows:

4. With whom do we share your personal data?

We may share your personal data with:

4.1. Affiliated companies:

We may share Personal Data internally within our affiliated companies and subsidiaries, for the purposes described in this Policy.

4.2. Payment processors:

We share your payment information with third party payment processors, for the purpose of facilitating your payments when using our Services. These third parties may have access to your Personal Data so that they may perform these tasks on our behalf.

4.3. Service providers:

Service providers working on our behalf and who need access to certain personal data in order to provide their services to us. Supabase provides account authentication and application storage; Cloudflare R2 stores source and generated media; Vercel hosts the application; PostHog provides product analytics and session recording; and Resend delivers service emails. Vidom receives the generation parameters and media references needed to create or edit your media. OpenAI processes relevant text and images for moderation and safety review. Where configured, additional analysis of refused prompts uses TypeSafe's Jev through Vercel AI Gateway. Polar processes payments and subscriptions. The data sent to each provider depends on the feature you use and its purpose. Provider processing is subject to the relevant agreements and terms; this policy does not promise that all providers have the same retention or training practices.

4.4. Law enforcement agencies:

We may disclose some data about you to government or law enforcement officials or private parties. The disclosure will be made in our sole discretion, as we believe it necessary or appropriate to respond to claims and legal procedures (including but not limited to subpoenas), to protect our or a third-party’s property and rights, to protect the safety of the public or any person, or to prevent or stop any activity we consider to be, or to pose a risk of being, illegal, unethical, inappropriate or legally actionable. We also may be required to disclose an individual’s personal data in response to a lawful request by public authorities, including meeting national security or law enforcement requirements.

4.5. Auditors and advisers:

We share your data with our external auditors, advisors and professional service providers (e.g., lawyers, accountants, insurers etc.) to ensure our compliance with regulatory requirements and industry standards, auditing, managing disputes etc.

4.6. Mergers and acquisitions:

We may transfer or otherwise share your data in case of entering into a business transaction such as a merger, acquisition, reorganization, bankruptcy, or sale of some or all of our assets.

5. Your privacy rights

5.1. Depending on the jurisdiction in which you reside, you may have certain rights under relevant applicable laws regarding the collection and processing of your personal data. To the extent these rights apply and concern you, you can contact us via the contact details available below and ask to exercise the following rights.

5.1.1. Rights of access to your personal data:‍

You have the right to receive confirmation as to whether or not personal data concerning you is being processed, and access your stored personal data, together with supplementary information.

5.1.2. Right of data portability:

You have the right to request us to move, copy and transfer your personal data easily from one IT environment to another, in a safe and secure way, without affecting its usability.

5.1.3. Right of rectification:

You have the right to request rectification of your personal data in our control in the event that you believe the personal data held by us is inaccurate, incomplete or outdated.

5.1.4. Right of deletion/erasure:

You have the right to request that we erase or delete personal data held about you at any time.

5.1.5. Right to restriction or objection to processing:

You have the right to request that we restrict or cease to conduct certain personal data processes at any time.

5.1.6. Right to withdraw your consent:

To the extent we process personal data on the basis of your consent, you may have the right to withdraw your given consent at any time.

5.1.7. Right not to be subject to automated decision making:

You have the right not to be subject to a decision based solely on automated processing, including profiling, which produces legal effects or similarly significantly effects on you

5.1.8. Right to opt-out of the sale or share of personal data:

In the event that we sell or share your personal data for behavioral advertising purposes, you may have the right to submit a request to opt-out of the sale or share of your personal data. After you opt-out, we may continue disclosing some personal data to our partners to help us perform business-related functions such as, but not limited to, providing the Services, ensuring that the Services are working correctly and securely, providing aggregate statistics and analytics and preventing fraud.

5.1.9. Right to non-discrimination:

You may have the right to be free from any discrimination for exercising your rights, such as offering you different pricing or products, or by providing you with a different level or quality of services, based solely upon your request.

5.1.10. Right to lodge a complaint:

All requests, complaints or queries may be addressed to us to the following email address: help@luma.ai. We will consider any requests, complaints or queries and provide you with a reply in a timely manner. We take our obligations seriously and we ask that any concerns be brought to our attention first, so that we can try to resolve them. If you are unsatisfied with our response, you can lodge a complaint with the applicable data protection supervisory authority.

Please note that these rights are not absolute and may be subject to our own legitimate interests and regulatory requirements. You are welcome to contact us for any questions or requests through our contact details below.

6. Transfer of personal data

Our hosting, storage, generation, safety, analytics, email and payment providers may process information in countries other than your country of residence. Processing locations depend on the provider and service. Different countries may have different data-protection laws. You can contact help@luma.ai for information about transfers relevant to your use of Luma and to exercise the rights described above.

7. How we protect your data

Luma uses HTTPS for its public service endpoints, account authorization checks and signed links for private media. Privileged application credentials stay on the server, and Luma OAuth authorization codes, access tokens, refresh tokens and client secrets are stored as hashes. Signed media links allow access while valid; keep them private. These controls do not make transmission or storage risk-free, and this policy does not claim end-to-end encryption.

8. Minors

We do not knowingly collect or solicit personal data from anyone under the age of 18 or under the local age of consent, unless consent is given by a parent or legal guardian. By accessing, using or interacting with our Services, you certify to us that you are not under the age of 18, or under the local age of consent, without parental consent to use our Services. In the event we learn that we have inadvertently gathered personal information from minors under the age of 18 (or under the local age of consent without parental consent), we will take reasonable measures to promptly delete such information from its records in a secure manner. If you believe that we may have any information from or about minors under the age of 18, please let us know at help@luma.ai.

9. Retention

The following describes the current cleanup rules. Eligibility for cleanup is not a guarantee that deletion completes at the exact cutoff; cleanup jobs retry failures.

You can revoke a connected assistant through Luma's connection controls. Revocation prevents future access through that connection; it does not erase existing media or records. You can request account deletion through account settings or help@luma.ai. An active subscription that can still bill must first be resolved. Account deletion schedules repeated media cleanup, including a 24-hour drain window for previously issued upload links and retries when removal fails. Account deletion does not itself delete analytics records held by a provider. Some records may remain for policy enforcement or the legal purposes described in this policy.

We will retain your personal data for as long as necessary to provide our Services, and as necessary to comply with our legal obligations, resolve disputes, and enforce our policies. Retention periods will be determined while taking into account the type of information that is collected and the purpose for which it is collected, bearing in mind the requirements applicable to the situation and the need to destroy outdated, unused information at the earliest reasonable time.

10. Updates to this Policy

From time to time, Luma AI reserves the right to modify the Policy through:

(i) posting a modified version on the Services. Such modified version will take effect immediately upon being posted and you agree to be bound by such modifications;

(ii) asking that you accept the modified Policy. Such modified version will take effect immediately upon your acceptance;

(iii) posting a notice about the modifications on the Services. Such modifications will take effect immediately upon the notice being posted and you agree to be bound by such modifications; or

(iv) sending you a notification via the e-mail address associated with your User Account at the time of such modification Such modification will take effect upon your continued use of the Luma AI Services.

If you do not agree to the modified Policy your sole remedy will be to terminate your User Account and immediately cease accessing and using the Services.

We reserve the right to change this Policy at any time. The most current version will always be posted through our Services (as reflected in the “Last Updated” heading). You are advised to check for updates regularly. By continuing to access or use our Services after any revisions become effective, you agree to be bound by the updated Policy.

11. Controlling version

This Policy has been drafted in English, serving as the original and controlling version of this Policy. Any translations of this Policy into other languages are provided for convenience only and shall not dictate the meaning or application of this Policy. In the event of any discrepancy between the meanings of any translated versions of the Policy and the English language version, the interpretation of the English language version shall prevail.

12. Contact us

If you have any questions about this Policy, please contact us at: help@luma.ai.