This Privacy Policy explains how Lumvix ("we", "us") collects, uses, and shares personal data when you use the Service. It forms part of our Terms of Service. By using the Service you agree to this Policy.
1. Data we collect
- Account data — your email address, sign-in timestamps, and your acceptance of the Terms.
- Session data — IP address, user-agent string, and session tokens, used for authentication and security.
- Content data — prompts you submit, images you upload, and media generated for you, together with job metadata (model, cost, status, timestamps).
- Billing data — subscription plan, credit balance, and a full credit transaction history. We do not store card numbers; payments are handled by Stripe, which acts as an independent controller of your payment data (see Stripe's privacy policy).
- Communications — sign-in link emails we send you and any messages you send us.
We do not intentionally collect special-category data, and you should not include it in prompts or uploads.
2. How we use data
- To provide the Service: authentication, generation, credit accounting, and media storage/delivery.
- To process generations: your prompts and uploaded images are transmitted to our AI infrastructure provider (fal.ai) solely to produce your requested output.
- To bill you: subscription management and webhooks via Stripe.
- To secure and moderate: fraud and abuse prevention, enforcement of the Acceptable Use Policy, rate limiting, and legal compliance.
- To communicate service messages such as sign-in links and billing notices.
Where GDPR or similar law applies, our legal bases are performance of a contract (providing the Service), legitimate interests (security, abuse prevention, service improvement), consent (where specifically requested), and compliance with legal obligations.
3. Sharing
We share personal data only with:
- Processors that host and operate the Service: Cloudflare (hosting, database, storage, email delivery), fal.ai (AI generation), and Stripe (payments);
- Authorities where required by law, court order, or to report illegal content (including mandatory reporting of child sexual abuse material);
- Successors in connection with a merger, acquisition, or asset sale, subject to this Policy.
We do not sell personal data and do not use your content to train AI models ourselves.
4. Retention
- Account and ledger data: for the life of the account and as required for tax/accounting records.
- Uploaded images and generated media: stored until you delete them, your account is deleted, or we remove them under our storage and moderation policies.
- Session logs: retained for a limited period for security purposes.
5. Your rights
Depending on your jurisdiction, you may have the right to access, correct, export, restrict, object to the processing of, or delete your personal data, and the right to complain to a supervisory authority. To exercise any right, contact us at privacy@lumvix.xyz. Deleting your account removes your content and personal data, except records we must keep by law.
6. Cookies
We use only strictly necessary cookies: an authentication session cookie. We do not use advertising or cross-site tracking cookies.
7. International transfers
Our providers operate global infrastructure; your data may be processed outside your country. Where required, transfers are protected by appropriate safeguards such as standard contractual clauses implemented by our processors.
8. Security
We use industry-standard safeguards: encrypted transport (TLS), scoped access to stored media, hashed session tokens, and payment handling delegated to a PCI-DSS-compliant processor. No system is perfectly secure; you use the Service at your own risk.
9. Children
The Service is not directed to anyone under 18, and we do not knowingly collect data from them. If you believe a minor has provided us data, contact us and we will delete it.
10. Changes and contact
We may update this Policy; material changes will be notified via the Service or email, and the "Last updated" date above will change. Questions: privacy@lumvix.xyz.