Privacy Policy

Our service processes the photos you upload to generate videos. When a photo contains a face, the generation pipeline may treat that face as biometric data under laws such as the Illinois Biometric Information Privacy Act (BIPA), the Texas CUBI law, the Washington My Health My Data Act, and the EU General Data Protection Regulation (GDPR) (special-category data under Article 9).

We only process face data after you give explicit consent — the create flow requires you to tick a consent checkbox before any photo is submitted for rendering. Consent is specific, informed, and freely given: we tell you exactly what is processed (your uploaded image), why (video generation), and how long it is kept.

You may withdraw consent at any time from your account page. Withdrawing consent stops all future processing; previously generated renders are handled under the retention and deletion terms below.

Account data (email, name, password hash), usage data (jobs, credits, API keys), and the media you upload. Passwords are hashed with PBKDF2-SHA256 (120,000 iterations) and session tokens are stored only as SHA-256 hashes. Payment card details are never stored by us — payments are processed by Stripe.

Uploaded source images are retained for 30 days after your last generation unless you delete them sooner. Generated videos are retained until you delete them or your account is deleted. Social OAuth tokens are retained until you disconnect the platform or delete your account. Credit ledger entries are retained for accounting compliance for 24 months. API keys are retained until revoked.

You can delete your entire account — including all uploads, renders, creations, social connections, API keys and sessions — from the account page. Deletion is permanent and propagates to our object storage and database within 30 days. You can also request export of your data before deletion. To make a request, contact privacy@lumavatar.com.

If you are in the EEA/UK, you have the right of access, rectification, erasure, restriction, portability, and objection regarding your personal data, including biometric data. Under BIPA and similar US state laws, you have the right to know what biometric data is collected, how long it is kept, and to request its deletion; we never sell biometric data, and we do not use it for advertising or profiling. To exercise any right, contact privacy@lumavatar.com and we will respond within 30 days.

Media is stored in Cloudflare R2, metadata in Cloudflare D1, and both are encrypted at rest. Generation runs inside Cloudflare Workers with the provider you configure (mock, Replicate or fal.ai). Where a third-party video provider receives your image, it acts as a processor solely to return your video, and the image is not used for training.