Privacy Policy

(Previous versions of this policy are available upon request)

AT A GLANCE: SUMMARY OF KEY POINTS

• What personal information do we collect? We collect your name, email address, profile picture (if using Google/GitHub sign-in), billing status, technical usage data, and the content you upload or prompt to generate characters.
• Do we process any sensitive personal information? No. We do not collect or process sensitive personal information like biometric data, precise geolocation, or financial account numbers (payments are handled entirely by Paddle).
• Do we collect information from third parties? Yes, we receive basic profile information if you choose to sign in via Google or GitHub, and subscription status from our payment processor, Paddle.
• How do we use your information? We use your data primarily to provide the Lumorig service—generating and animating characters via AI, managing your workspaces, and maintaining the security of our platform.
• Who do we share your personal information with? We share data only with essential service providers who help run our platform, such as our cloud host (Vultr), AI provider (Anthropic), transactional email provider (Resend), and merchant of record (Paddle). We never sell your personal data.
• What are your privacy rights? You have the right to access, correct, delete, and port your data, as well as the right to opt out of certain processing.
• How can you contact us? You can reach us anytime regarding your privacy at hello@lumorig.com.

---

1. INTRODUCTION#

Welcome to Lumorig. We build tools—including our web app, REST API, MCP server, and CLI—that help businesses, developers, and designers create rigged, animated vector mascots and characters using artificial intelligence.

We believe that great tools should come with straightforward, honest privacy practices. This Privacy Policy explains how we collect, use, and protect your personal information when you use our services. We have written this policy to be as clear and transparent as possible, avoiding heavy legal jargon where plain English does the job better.

If you have any questions about this policy or how we handle your data, please reach out to us at hello@lumorig.com.

2. WHAT WE COLLECT & WHY#

We only collect the information we actually need to provide and improve Lumorig. We organize this data into three categories:

Information You Give Us Directly#

• Account Information: When you register, we collect your email address, workspace details, and team membership. We need this to create your account and manage your access. (Legal basis: Contract)
• User Content: We collect the images, reference videos, prompts, and instructions you upload or write, as well as the generated characters, animations, and exports (GIF/MP4/WebM/Lottie/SVG/sprite files). This is the core of our service. (Legal basis: Contract)
• Developer Data: If you use our API or webhooks, we collect your webhook URLs and store your API keys (which are strictly hashed for security). (Legal basis: Contract)

Information Collected Automatically#

• Usage and Job Records: We track credits used, job timestamps, and generation history so you can access your past work and we can accurately manage your subscription limits. (Legal basis: Contract & Legitimate Interest)
• Technical Data: We collect your IP address, browser user agent, and server logs. This helps us ensure our platform is secure, diagnose bugs, and prevent abuse. (Legal basis: Legitimate Interest)
• Cookies: We set only strictly necessary cookies required to keep you logged in and secure. We do not use analytics, advertising, or tracking cookies. (Legal basis: Legitimate Interest)

Information From Third Parties#

• Authentication Data: If you choose to sign in using Google or GitHub, we receive your name, email, and profile picture from them to create your Lumorig profile. (Legal basis: Consent)
• Billing Status: While our merchant of record (Paddle) handles all your actual payment card details, they send us your billing status and subscription records so we can grant you access to paid features. (Legal basis: Contract)

3. HOW WE USE YOUR INFORMATION#

We use your information with specific, limited purposes in mind:

• Core Service Delivery: To authenticate you, process your prompts and uploads, generate your animated characters, and provide access to your exports.
• Service Improvement: To understand how our API and web app are performing, fix bugs, and optimize our infrastructure.
• Communication: To send you essential transactional emails, such as secure sign-in links, team invites, and important account notices.
• Security and Fraud Prevention: To monitor for suspicious activity, enforce rate limits, and protect our servers from unauthorized access.
• Legal Compliance: To maintain accurate tax and billing records as required by law.

4. WHEN WE SHARE YOUR INFORMATION#

We are not in the business of selling your data. We state this clearly: We never sell your personal data. We only share your information in the following limited circumstances:

• Essential Service Providers: We share data with trusted vendors who provide infrastructure to run Lumorig. This includes Anthropic (for AI generation), Paddle (for payments and invoicing), Resend (for transactional emails), Vultr (for cloud hosting), Cloudflare (for DNS), and Let's Encrypt (for TLS certificates).
• Legal Requirements: We may disclose your information if we are legally required to do so by a valid subpoena, court order, or other legal obligation.
• Business Transitions: If Lumorig is involved in a merger, acquisition, or sale of assets, your information may be transferred as part of that transaction. We will notify you before your personal data is transferred and becomes subject to a different privacy policy.
• With Your Consent: We will share your information in any other way only if you explicitly tell us to do so.

5. AI PROCESSING & YOUR CONTENT#

Because Lumorig relies on artificial intelligence to generate characters, it is important that you understand how your content is processed:

• Third-Party AI Providers: Your prompts, uploaded images, and reference videos are sent to Anthropic (Claude AI) via API to generate and animate your characters.
• No Model Training: Your content is not used to train Anthropic's AI models. We use Anthropic's commercial API, under which customer inputs and outputs are not used for model training by default. You can verify this in Anthropic's commercial terms.
• Data Retention by AI Providers: Anthropic retains API inputs and outputs only for a limited period, as described in its commercial data retention policy (for example, for trust and safety review), after which they are deleted from its systems.
• Accuracy Disclaimer: AI generation can sometimes produce unexpected or inaccurate results. You are responsible for reviewing all generated characters and animations before using them in your own projects or embedding them on your sites.

6. YOUR PRIVACY RIGHTS#

Depending on where you live (including under the GDPR and CCPA), you have specific rights regarding your personal data. We extend these rights to all our users, regardless of location:

• Access: You can request a copy of the personal data we hold about you.
• Correction: You can update or correct inaccurate information directly in your account settings.
• Deletion: You can request that we delete your account and associated personal data.
• Portability: You can request your data in a structured, commonly used, and machine-readable format.
• Withdraw Consent: Where we rely on consent (like Google/GitHub sign-in), you can disconnect these services at any time without affecting the legality of prior processing.
• Lodge Complaints: You have the right to complain to a data protection authority about our collection and use of your personal data.

To exercise any of these rights, please email us at hello@lumorig.com. We will respond to your request within 30 days.

7. DATA SECURITY#

We take the security of your data seriously and have implemented robust measures to protect it:

• Encryption & Access: All traffic is encrypted via HTTPS/TLS. We do not store passwords; instead, we use secure email links or OAuth (Google/GitHub). Sign-in links, session tokens, and API keys are stored only as cryptographic hashes.
• Infrastructure: We use firewalled servers with automatic security updates, enforce rate limiting, and maintain strict role-based access controls within workspaces.
• What We Don't Claim: While we follow industry best practices, no system connected to the internet is 100% secure. We cannot guarantee absolute security.
• Your Role: You are responsible for keeping your email account secure (since it acts as your login method) and protecting your API keys.
• Breach Notification: In the unlikely event of a data breach that compromises your personal information, we will notify you and the relevant authorities without undue delay, and within the timeframes required by applicable law.

8. DATA RETENTION#

We keep your data only as long as necessary to fulfill the purposes outlined in this policy:

• Active Account Data: We retain your workspace data, generated characters, and account details for as long as your account is active.
• Account Deletion: If you delete your account, all associated account data is permanently deleted from our primary servers within 30 days.
• Server Logs: Technical and server logs are retained for up to 30 days for security and debugging purposes.
• Backups: Our system backups rotate and are overwritten within 14 days.
• Financial Records: Billing and subscription records are retained for as long as required by applicable tax and accounting laws (typically 7 years).

9. COOKIES & TRACKING#

Lumorig uses only "strictly necessary" cookies. These are tiny text files essential for the web app to function—specifically, to keep you logged in securely and route your requests properly. See our Cookie Policy for the full list.

Because we do not use analytics, advertising, or tracking tools, we do not use non-essential cookies. Therefore, you will not see a cookie consent banner on our site, as the cookies we do use are exempt from consent requirements under privacy laws.

10. CHILDREN'S PRIVACY#

Lumorig is designed for businesses, developers, designers, and individuals aged 16 and over. We do not knowingly collect personal information from children under 16. If you are a parent or guardian and believe your child has provided us with personal data, please contact us at hello@lumorig.com, and we will promptly delete the account and associated information.

11. INTERNATIONAL TRANSFERS#

Lumorig is hosted on Vultr servers located in the United States. If you are accessing our services from the European Economic Area (EEA), the UK, or other regions with laws governing data collection and use, please note that your personal data will be transferred to, stored, and processed in the United States.

Where required, we rely on recognized legal safeguards, such as the Standard Contractual Clauses (SCCs) offered by our service providers, when transferring data to our US-based infrastructure and service providers.

12. CATEGORIES TABLE (CCPA/CPRA)#

For residents of California and other applicable US states, the following table outlines the categories of personal information we have collected in the past 12 months, our purposes for collection, and our retention practices.

Note: We do not collect "Sensitive Personal Information" as defined by the CCPA, nor do we sell or share personal information for cross-context behavioral advertising.

13. AUTOMATED DECISION-MAKING#

Lumorig uses AI to generate images and animations based on your prompts. However, we do not engage in any automated decision-making or profiling that produces legal effects or similarly significant effects concerning you (as defined under GDPR Article 22).

14. PRIVACY SIGNALS#

We respect your privacy choices. Lumorig honors the Global Privacy Control (GPC) browser signal. Because we do not sell or share your data for advertising purposes anyway, broadcasting a GPC signal will simply reaffirm our default strict privacy stance regarding your account.

15. SUB-PROCESSORS#

To provide our services, we use the following third-party sub-processors:

• Anthropic (AI generation)
• Paddle (Merchant of Record / Payments)
• Resend (Transactional emails)
• Vultr (Cloud hosting)
• Cloudflare (DNS)
• Let's Encrypt (TLS certificates)

We maintain a current list of our sub-processors. Customers can request this list and subscribe to be notified before any new sub-processor is added by emailing hello@lumorig.com.

16. EU/UK REPRESENTATIVE#

EU/UK Representative: None currently appointed.

We manage GDPR and UK GDPR compliance directly. You may contact us at hello@lumorig.com with any inquiries.

17. SUPERVISORY AUTHORITY#

If you are located in the EEA or the UK and believe we have not adequately resolved a privacy concern, you have the right to lodge a complaint with your relevant supervisory authority. For users in the UK, this is the Information Commissioner's Office (ICO). For users in the EEA, this is the national Data Protection Authority (DPA) in your country of residence.

18. CONTROLLER AND PROCESSOR ROLES#

For business and enterprise customers, it is important to clarify our legal roles under data protection laws (such as the GDPR and CCPA):

• Data Processor (Service Provider): Lumorig acts as a Data Processor for the customer content (images, videos, prompts) that you input into our product. We process this data strictly on your behalf.
• Data Controller (Business): Lumorig acts as a Data Controller for the account, billing, and technical usage data we collect to manage your subscription and run our business operations.

These roles and our mutual obligations can be set out in a Data Processing Agreement (DPA), available to business customers upon request.

19. CHANGES TO THIS POLICY#

We may update this Privacy Policy from time to time to reflect changes in our technology, business practices, or legal requirements.

If we make material changes, we will notify you by sending an email to the address associated with your account and by updating the "Last Updated" date at the top of this page. Your continued use of Lumorig after these changes take effect means you agree to the new policy. Existing data will be treated in accordance with the policy in place at the time it was collected unless you consent otherwise.

20. CONTACT US#

If you have any questions, concerns, or requests regarding this Privacy Policy or your personal data, please reach out to us. We aim to respond to all privacy inquiries within a few business days.

Email: hello@lumorig.com
Website: https://lumorig.com