Privacy Policy

1. Who we are

Lumin is run by David Casey, a sole trader trading as Casey Photography and Lumin, based in Ovens, Co. Cork, Ireland. For privacy questions or requests, email support@lumin-app.com.

This policy explains what personal data Lumin holds about photographers, clients and visitors, why, and what rights you have. It should be read with our Terms of Use.

2. Our role, and the photographer's

• Lumin is the controller of account and billing data: who you are, your login, your plan and how you use Lumin. We decide how that data is used.
• Photographers are the controllers of their galleries. When a photographer uploads photos of their clients and guests, the photographer decides what is uploaded and who sees it. Lumin stores and delivers those photos on the photographer's behalf, as a processor. If you appear in a photographer's gallery and want a photo removed, please contact the photographer first. We will help if you can't reach them.
• Once a client saves a gallery to their own Lumin account, the client controls their copy. We keep it for them under our Terms of Use.

Photographers: the terms in Data processing terms for photographers form our data processing agreement with you.

3. What we collect

Account details: your name, email address, a securely scrambled (hashed) version of your password, your account type, and whether you have confirmed your email. Photographers can also add business details: business name, website, phone, address, country, time zone, VAT number, logo and brand colour.

Photos and gallery content: the photos you upload, the file details stored inside them (such as camera settings, date taken and, if your camera recorded it, location), gallery titles and settings, and share links. The thumbnails and web-sized copies that galleries show have those file details removed; only the original file keeps them.

Activity in galleries: comments (with the name and email you give), favourites, download requests, guest uploads (with the name the guest gives), and galleries you save to your account.

Billing: your plan, subscription status and payment history. Card details go straight to our payment provider, Stripe. We never see or store your full card number.

Technical and security data: your internet (IP) address and browser details in our server logs and security records, the IP address you signed up from (to stop duplicate free accounts), and a record of important account actions (for example, password changes and deletions).

Waiting list: if you join the Lumin Pro waiting list, your name, email address and, if you give it, the kind of photography you do. We use it only to invite you to Lumin Pro, and delete it on request.

Emails with us: if you email us, we keep the conversation so we can help you.

We don't use facial recognition, we don't use your photos to train AI, and we don't buy data about you from anyone.

4. Why we use it, and our legal basis

• To provide Lumin: your account, storing and delivering galleries, downloads, comments, guest uploads, and the emails that go with them (for example, password resets, “your download is ready” and new-comment notices). Legal basis: performing our contract with you.
• To take payments and keep accounting records. Legal basis: contract, and our legal obligations (tax law requires us to keep records).
• To keep Lumin safe and fair: preventing fraud and abuse, enforcing one free account per person, rate limits, and investigating reports of illegal content. Legal basis: our legitimate interest in protecting Lumin and its users.
• To tell you about important changes, such as changes to prices or these terms. Legal basis: contract and legitimate interest.
• Marketing: we don't currently send marketing emails. If we ever do, we will only send them with your consent or as the law allows, and every email will have an unsubscribe link.

In Brazil, the same purposes rely on the matching legal bases under the LGPD (contract, legal obligation and legitimate interest).

5. Who we share it with

We don't sell personal data. We share it only as far as needed with these service providers:

• Hetzner Online (Germany): the server that runs Lumin and its database.
• Cloudflare: stores and delivers photos (Cloudflare R2), and runs our domain's DNS.
• Stripe (Ireland): takes payments. Stripe is also responsible for the payment data it handles under its own privacy policy.
• Resend: sends Lumin's emails.
• Google Workspace: our own email, when you write to us.

Within Lumin: a photographer sees the comments, favourites and guest uploads in their galleries. A client sees the galleries shared with them. Anyone with a gallery link can see that gallery, unless the photographer has protected it with a password.

We may also share data if the law requires it (for example, a valid order from An Garda Síochána or a court), or to protect people's safety. If Lumin is transferred to a company that takes it over, your data would move with it under this policy, and we would tell you.

6. Data outside the EU

Our main server is in Germany. Some providers (such as Cloudflare and Resend) are US companies, or may handle data outside the European Economic Area. When that happens, the transfer is protected by the European Commission's Standard Contractual Clauses or the EU–US Data Privacy Framework, as set out in each provider's data processing agreement.

7. How long we keep it

• Account details: while you have an account. When you delete your account, we remove or anonymise your personal details straight away.
• Photos: until they are deleted, following the rules in our Terms of Use. For example, galleries a client has saved stay with that client, and photos no one keeps are deleted 30 days after notice.
• Database backups: kept for 30 days, then deleted automatically. Something you delete may stay in a backup until that backup expires.
• ZIP downloads: deleted after 7 days.
• Server logs: kept for a short time for security and fault-finding, and overwritten automatically.
• Billing records: kept for 6 years after the end of the tax year, as Irish tax law requires.
• Sign-in links and codes: expire after 30 minutes (comment links), 1 hour (password resets) or 7 days (email confirmation).

8. Your rights

Under the GDPR (and, in Brazil, the LGPD) you have the right to:

• get a copy of your personal data. You can download it yourself any time in Settings → Your data;
• correct it. Most details can be changed in Settings;
• delete it. You can delete your account yourself in Settings;
• object to, or ask us to restrict, how we use it;
• take your data to another service (portability); and
• withdraw consent, where we rely on consent.

For anything you can't do in Settings, email support@lumin-app.com. We will reply within one month. We may need to confirm it is really you first.

You can also complain to the Irish Data Protection Commission (dataprotection.ie), to the data protection authority where you live, or in Brazil to the ANPD. We would appreciate the chance to put things right first.

9. Cookies

Lumin only uses cookies and browser storage that are needed for it to work. We don't use advertising or tracking cookies, or third-party analytics.

• Sign-in cookies (lumin_session, lumin_pro_session): keep you signed in. They last up to about 13 months, or until you sign out.
• Gallery password cookie: remembers that you entered a gallery's password, for 12 hours.
• Browser storage: remembers your view choices in a gallery (such as sort order). It stays on your device.

Because these are strictly necessary, we don't ask for cookie consent.

10. Keeping data safe

We use encrypted connections (HTTPS), scramble (hash) passwords, keep original photos in private storage reached only through short-lived signed links, limit who can access our systems, and back up our database every night. No system is perfectly secure. If a breach puts your data at risk, we will tell you and the Data Protection Commission as the law requires.

11. Children

Lumin accounts are for adults (18 and over). Children may appear in photos that photographers or parents upload. Those photos are the responsibility of whoever uploaded them, who should have the right permissions. If you believe we hold a child's data that shouldn't be here, contact us.

12. Data processing terms for photographers

When Lumin processes personal data in your galleries for you (photos of your clients and guests, and their comments, favourites and uploads), these terms apply under Article 28 of the GDPR:

• We process the data only to provide Lumin as described in our Terms of Use and as you set up your galleries, unless the law requires otherwise.
• Anyone at Lumin who can access the data is bound by confidentiality.
• We use appropriate security measures (see Keeping data safe).
• You authorise the service providers listed in Who we share it with. We will tell you before adding or replacing one, so you can object. We hold each of them to equivalent data protection terms.
• We help you respond to requests from people exercising their rights, and with security, breach notification and impact assessments, as far as is reasonable.
• We tell you without undue delay if we become aware of a personal data breach affecting your galleries.
• When you delete data, we delete it, apart from copies in backups until they expire, and galleries your clients have saved, which they then control.
• We give you the information you reasonably need to show you are complying, and answer reasonable questions about how we process data.

You are responsible for having a lawful basis, and any permission you need, for the photos and personal data you upload.

13. Changes to this policy

We will update this policy when Lumin or the law changes. For important changes, we will email account holders before they take effect. The date at the top shows when it was last updated.

14. Contact us

Email support@lumin-app.com. We are based in Ovens, Co. Cork, Ireland. If you need a postal address, for example to send a legal notice, email us and we will give you one.