Privacy Policy
Last updated: October 13, 2026
This policy explains what personal information Lumo collects, how we use it and the choices you have. It applies to the Lumo website, app and Claude connector. For anything about your data, write to supportbylumo@gmail.com.
What we collect
- Account details: your name, email address and password (stored only as a secure hash). If you sign in with Google, we receive your name, email and profile picture from Google.
- Your content: footage, audio, images, brand kits, prompts, Studio chat messages and the videos Lumo makes. Footage may show or record you and other people.
- Billing details: your plan, credit balance and order history. Card and payment details are entered on Polar’s checkout and never reach our servers.
- Technical data: IP address, browser and device type, and logs of requests and errors, which our hosting providers record automatically.
- Connected apps: if you connect Claude to Lumo, we store the access tokens that let it act on your projects.
How we use it
- To run the service: sign you in, store your projects, plan and render your videos, and keep your credit balance.
- To take payments and keep the billing records the law requires.
- To keep Lumo secure, prevent abuse and fix problems.
- To email you about your account, such as confirmation links, password resets, billing and important changes. We don’t send marketing emails without your consent.
We use your data because we need it to provide the service you asked for, to meet legal duties, and for our legitimate interest in keeping Lumo secure and working. We don’t sell your personal information, and we don’t use it for advertising.
AI processing
To edit your videos, we send the parts of your content an edit needs, such as prompts, transcripts and still frames, to Anthropic’s Claude models. Under Anthropic’s commercial terms, this data is not used to train their models. Speech transcription and face detection run on our own render servers. Face detection is used only to frame shots. It doesn’t identify who someone is, and we don’t build face profiles.
Who processes your data
We share data only with the service providers that help us run Lumo, and only what each one needs:
| Provider | Purpose | Data |
|---|---|---|
| Supabase | Accounts, sign-in, database and file storage | Name, email, projects, uploads, billing status |
| Cloudflare R2 | Storing uploads and finished videos | Your files and renders |
| Vercel | Hosting the website and app | Requests, IP address, technical logs |
| Anthropic (Claude) | AI planning, writing and editing | Prompts, project details, transcripts and frames needed for the edit |
| ElevenLabs | AI voiceover, when you use it | The script being voiced |
| Polar | Checkout, subscriptions, invoices and tax (merchant of record) | Email, plan, payment details (handled by Polar, not by us) |
| Sign in with Google, if you choose it | Your Google name, email and profile picture | |
| Dropbox | Attaching files from Dropbox, if you choose it | Only the files you pick |
We may also share information if the law requires it, to protect people’s safety or our rights, or as part of selling or merging the business, in which case this policy would continue to apply.
Cookies and local storage
Lumo uses only what it needs to work. We don’t use advertising or analytics cookies, and we don’t track you across other websites, so there is nothing to opt in to. If that ever changes, we will ask for your consent first.
| Name | Type | Purpose | Kept |
|---|---|---|---|
| Supabase auth cookies (sb-…) | Cookie | Keep you signed in and secure your session | Until you sign out or the session expires |
| lumo:theme | Local storage | Remember light or dark mode | Until you clear it |
| lumo:sidebar | Local storage | Remember whether the sidebar is collapsed | Until you clear it |
| lumo:tour | Local storage | Remember where you are in the welcome tour | Until the tour ends |
Google and Dropbox may set their own cookies when you use their sign-in or file picker windows. You can clear cookies and local storage in your browser at any time, but you will be signed out.
How long we keep it
We keep your account and content while your account is open. You can delete projects and files yourself in the app. When you ask us to delete your account, we delete your personal information and content within 30 days. Copies in backups are removed as the backups expire. Billing and tax records are kept for as long as the law requires.
Your rights
Depending on where you live, you can ask to see the personal information we hold about you, correct it, delete it, receive a copy of it, or object to or limit how we use it. Email supportbylumo@gmail.com from the address on your account and we will reply within 30 days. You can also complain to your local data protection authority, such as the Privacy Protection Authority in Israel or the supervisory authority in your EU country.
International transfers
Our providers may store and process data in countries other than yours, including the United States. Where the law requires it, these transfers are covered by safeguards such as the European Commission’s standard contractual clauses.
Security
Data is encrypted in transit. Each workspace is private and isolated at the database level, and uploads and renders are stored privately and shared only through short-lived links. No system is perfectly secure, so please use a strong, unique password.
Children
Lumo is not directed at children under 13, and we don’t knowingly collect their personal information. If you believe a child has given us personal information, contact us and we will delete it.
Changes
If we change this policy in a way that matters, we will tell you by email or in the app before it takes effect. See also our Terms of Service.