Privacy Policy

This policy explains what personal data Luma processes, why, and what your rights are. Luma is run by Ivan Jankovec, Hviezdoslavova 4241/45, 018 41 Dubnica nad Váhom, Slovakia, Company ID (IČO) 57928240, registered in the Trade Register of the District Office Trenčín, No. 350-54946.

1. Two kinds of data

Your data as a Luma user. For your account we decide how data is used: we are its controller.

Your fans' data. The chats and fan details Luma handles belong to your Fanvue and Telegram accounts. For them you are the controller and Luma processes them only on your behalf, to run the AI for you.

2. What we collect

• Account: your email, a scrambled (hashed) password or your Google account ID if you sign in with Google.
• Connections: the access Fanvue gives Luma when you click Allow, and your Telegram bot's token.
• Chats: fan names and usernames, messages, purchases and the short notes the AI keeps about a fan (for example his name or job), so it can reply well.
• Settings and content: the personality, scripts and photo descriptions you set up.
• Billing: your credits and payments. Card details go to Stripe directly; Luma never sees them.
• Bug reports: what you write, an optional screenshot, the page and the kind of device you used.
• Technical: logs and the cost of the AI per account, to keep Luma running and fair.

3. Why

To provide Luma under our Terms of Service (the contract with you): to log you in, read and answer chats, charge credits, fix bugs and keep the service secure. We do not sell personal data and do not use it for advertising.

4. Who else processes it

• AI providers, through OpenRouter: the recent messages of a chat and the fan notes are sent to write a reply.
• Fanvue and Telegram: to read and send the messages of the accounts you connect.
• Stripe: payments. Google: sign-in, if you use it.
• Our hosting provider, where Luma and its databases run.

Some of them are outside the EU; where they are, they work under the safeguards the GDPR requires (such as standard contractual clauses).

5. How long

As long as your account exists. When you delete it, your account and its chats, fans, settings and connections are removed. Payment records stay as long as accounting law requires, without the account's details.

6. Cookies

Luma uses one cookie, the one that keeps you logged in. No tracking or advertising cookies.

7. Your rights

You can ask to see, correct, export or delete your data, and object to or limit how it is used. You can also complain to your data protection authority (in Slovakia: Úrad na ochranu osobných údajov). A fan who asks about their data should ask the creator; we help the creator answer.

8. Security

Every account has its own separate database, passwords are stored hashed, connections use HTTPS, and only the account and the Luma admin can see an account's data.

9. Contact

Privacy questions: use Report a bug in the app.