Privacy Policy

1. Data we process

• Account data (email, name, user id) — via our auth provider Clerk.
• Photos you upload and the enhanced outputs we generate.
• Payment data — handled by Creem (our Merchant of Record). We do not see or store full card details.
• Usage and technical data (e.g. job status, basic logs) and essential cookies.

2. Why we process it (purposes & legal bases)

• To provide the service and process your photos — performance of our contract with you.
• To take payment and grant credits — performance of contract / legal obligation.
• To secure, maintain and improve the service — our legitimate interests.
• To comply with law and handle disputes — legal obligation / legitimate interests.

3. Sub-processors

We share data only with the processors needed to run the service. Your images are transmitted to AI providers for processing:

• Clerk — authentication & account management.
• Creem — payments, invoicing and tax (Merchant of Record).
• Google (Gemini) — AI image-processing infrastructure used to enhance your uploads.
• Anthropic (Claude) — automated quality-review infrastructure for edits.
• Cloudflare R2 — storage of images.
• Supabase / PostgreSQL — application database.
• Hosting infrastructure — OVHcloud (OVH SAS), 2 rue Kellermann, 59100 Roubaix, France.

4. International transfers

Some processors are located outside the EU/EEA. Where that is the case, transfers are covered by an adequacy decision or appropriate safeguards such as the EU Standard Contractual Clauses.

5. Retention

We keep your account data while your account is active. Uploaded originals and enhanced outputs are retained while your account is active so you can access your history, and are removed when you delete a result, on request, or when you close your account. You can delete individual results or ask us to erase your data at any time.

6. Your rights

You have the right to access, rectify, erase, restrict and port your data, and to object to certain processing. Where processing relies on consent, you may withdraw it at any time. To exercise these rights, contact support@stayluma.net. You may also lodge a complaint with the French data-protection authority (CNIL) or your local supervisory authority.

7. Security & children

We use reasonable technical and organisational measures to protect your data. StayLuma is not intended for anyone under 18, and we do not knowingly collect data from children.

8. Cookies & changes

We use only essential cookies — see our Cookie Policy. We may update this policy; material changes will be notified in-product or by email.