Privacy Policy

This Privacy Policy explains how Lumen Brain (lumenbrain.app) processes personal data. The data controller is [operator legal name, registered address, company registration number] (“we”, “us”). You can reach us about privacy at privacy@lumenbrain.app [replace with your live address].

We process personal data in accordance with the EU General Data Protection Regulation (GDPR) and applicable national law.

• Account data — email address, display name, password hash (or your Google account identifier if you sign in with Google), plan and role.
• Content you create and upload — prompts; images you attach for editing or as video references; everything you store in the Brain (images, folder names, folder notes, tags, file names); generated images, clips, voiceovers and transcripts; audio you upload for transcription and text you submit for speech; recordings you upload to clone a voice, with the record of your confirmation that the voice is yours or that you have the speaker's permission; descriptions you write to design a voice; and the moods you describe for the AI to direct a script.
• Usage and billing records — your credit balance, credit transactions, generation history (model, options, credits spent, timestamps) and run states.
• Technical data — IP address, device and browser information, and server logs collected for security and troubleshooting.
• Cookies and local storage — strictly necessary items that keep you signed in and remember your session. We do not use advertising cookies.

Please do not upload special-category data (for example health or biometric data) or other people's personal data without a lawful basis — you are responsible for the content you submit.

• to operate the Service: authentication, the studios, the Brain, the gallery;
• to run the generations you request, which requires sending your prompt and any attached or referenced media to the relevant AI model provider;
• to meter credits, manage plans and process payments;
• to secure the Service, prevent abuse and enforce our Terms;
• to support you and communicate service messages; and
• to understand aggregate usage of the platform (for example totals of generations, credits and per-model economics in our internal admin dashboard).

We do not sell your personal data and we do not use your content to train AI models.

When you generate, the data needed for that generation (your prompt, plus any image or audio input) is transmitted to the third-party provider operating the selected model — currently Google (Gemini models), OpenAI (GPT image models), MiniMax (Hailuo video, and voices cloned from a recording or designed from a description there), fal.ai (ElevenLabs speech, voice cloning and voice changing, Whisper transcription, Kling and Seedance video, GPT Image 2 and Qwen Image 3), Anthropic (Claude, which writes AI designs and directs voiceover scripts) and Replicate (Qwen Image) — via our AI gateway. Providers process this data to return your output, under their own terms and API data-use policies, which for API traffic generally exclude use of your inputs for model training.

When you connect an AI assistant over MCP, that assistant (and the company operating it, for example Anthropic for Claude) processes the data it reads from your account — your Brain contents, generation results, balance — under its own privacy terms. Connect only clients you trust.

• Performance of a contract — operating your account, running generations, storing your Brain, billing (Art. 6(1)(b));
• Legitimate interests — service security, abuse prevention, aggregate service analytics and defending legal claims (Art. 6(1)(f));
• Legal obligation — accounting and tax records (Art. 6(1)(c));
• Consent — where we ask for it separately, for example optional marketing emails; you can withdraw consent at any time (Art. 6(1)(a)).

• Processors that run our stack — application hosting and the AI gateway (Lovable), database, authentication and file storage (Supabase), and, when payments are enabled, our payment processor. Processors act on our instructions under data-processing agreements.
• AI model providers — as described in Section 4, to perform the generations you request.
• Authorities — where the law requires disclosure, or to report child sexual abuse material.
• Business transfers — if we are involved in a merger or acquisition, data may transfer with the business under equivalent protections.

Some of our processors and model providers are located outside the European Economic Area, primarily in the United States. Where personal data is transferred out of the EEA, we rely on adequacy decisions (including the EU-U.S. Data Privacy Framework where the recipient is certified) or the European Commission's Standard Contractual Clauses, together with additional safeguards where needed.

• Account data, Brain contents and your generation gallery are kept while your account exists. Content you delete is removed from the live systems promptly and from backups on their rotation schedule.
• Credit and billing records are kept for as long as applicable accounting and tax law requires (typically 5–10 years depending on jurisdiction).
• Security logs are kept for a short rolling period.
• Generated media download links are time-limited signed URLs (typically 1–24 hours); the underlying files remain in your private storage until deleted.

We protect data with encryption in transit, access controls and row-level authorisation (your content is only readable by your account and the connections you authorise), time-limited signed URLs for media, and the principle of least privilege for internal access. No system is perfectly secure; if a breach affects your rights, we will notify you and the supervisory authority as the GDPR requires.

Under the GDPR you can, at any time:

• request access to the personal data we hold about you, and a copy of it;
• have inaccurate data corrected;
• have your data erased — deleting your account removes your profile, Brain and gallery, subject to records we must keep by law;
• receive your data in a portable format;
• object to processing based on legitimate interests, and restrict processing;
• withdraw any consent, with effect for the future.

To exercise these rights, email privacy@lumenbrain.app. You also have the right to lodge a complaint with the data protection supervisory authority of your place of residence, place of work or the place of the alleged infringement.

The Service is not directed at children and may not be used by anyone under 16 (or the higher minimum age of your country). We do not knowingly collect children's data; if you believe a child has created an account, contact us and we will delete it.

We will update this policy as the Service and the law evolve. For material changes we will notify you in the app or by email before they take effect. The “Last updated” date above always shows the current version.

Privacy questions and rights requests: privacy@lumenbrain.app [replace with your live address], or by post at [operator legal name and registered address].