Privacy Policy
This Privacy Policy explains how Lumenta AI ("we", "us", "our") collects, uses, and protects your personal data when you use lumenta.shop. We are committed to full compliance with the EU General Data Protection Regulation (GDPR) and applicable national data protection laws.
1. Data Controller
The data controller responsible for your personal data is:
Lumenta AI
Website: https://lumenta.shop
Contact e-mail: privacy@lumenta.shop
2. Personal Data We Collect
2.1 Account data
- E-mail address (required for registration and authentication)
- Password (stored as a bcrypt hash — never in plain text)
- Account creation date and last login timestamp
2.2 Billing data
- Subscription plan and status (Free / Pro / Business)
- Credit balance and usage count
- Stripe Customer ID and Subscription ID (no card numbers — Stripe handles those)
- Invoice and payment event metadata from Stripe webhooks
2.3 Usage data
- AI generation history: tool used, input text you provide, output generated, timestamp, credits consumed
- Application logs: anonymised IP address, browser / device type, pages visited, error logs
2.4 Data you provide to AI tools
When you use our AI generation tools you provide product names, descriptions, key features, and marketing preferences. This content is transmitted to the Anthropic API to generate results and is stored in your generation history.
3. Legal Basis for Processing (GDPR Art. 6)
| Processing activity | Legal basis |
|---|---|
| Creating and maintaining your account | Performance of a contract (Art. 6(1)(b)) |
| Providing AI generation services | Performance of a contract (Art. 6(1)(b)) |
| Processing subscription payments via Stripe | Performance of a contract (Art. 6(1)(b)) |
| Sending transactional e-mails (password reset, receipts) | Performance of a contract (Art. 6(1)(b)) |
| Security monitoring and fraud prevention | Legitimate interests (Art. 6(1)(f)) |
| Compliance with legal obligations (e.g. invoicing records) | Legal obligation (Art. 6(1)(c)) |
| Analytics cookies (if you consent) | Consent (Art. 6(1)(a)) |
4. How We Use Your Data
- Authenticate your access and maintain your account session
- Deliver AI-generated content in response to your inputs
- Track and enforce credit limits per subscription plan
- Process payments and manage subscription lifecycle via Stripe
- Send password-reset and account-related e-mails
- Detect abuse, prevent fraud, and ensure service security
- Comply with applicable tax and accounting obligations
- Improve service quality (using aggregated, anonymised statistics only)
5. Third-Party Service Providers
We share data only as necessary and under contractual data-processing agreements:
| Provider | Purpose | Data shared | Location |
|---|---|---|---|
| Anthropic, PBC | AI content generation | Your tool inputs (product text, preferences) | USA |
| Stripe, Inc. | Payment processing | E-mail, subscription metadata | USA / EU |
| Hostinger | VPS hosting & e-mail delivery | All service data at rest; outbound e-mails | EU (LT) |
| Google AdSense | Advertising on public pages | Cookies, device/browser metadata | USA |
Data transfers to the USA are covered by Standard Contractual Clauses (SCCs) or the EU-U.S. Data Privacy Framework where applicable.
6. Data Retention
- Account data: retained for the lifetime of your account, then deleted within 30 days of account deletion request.
- Generation history: retained for 12 months from the date of each generation, then automatically purged.
- Billing records: retained for 7 years to comply with tax and accounting obligations (even after account deletion).
- Security logs: retained for 90 days, then deleted.
7. Your Rights Under GDPR
You have the following rights regarding your personal data. To exercise any of them, contact us at privacy@lumenta.shop. We will respond within 30 days.
- Right of access (Art. 15): Request a copy of all personal data we hold about you.
- Right to rectification (Art. 16): Correct inaccurate or incomplete data.
- Right to erasure (Art. 17): Request deletion of your data ("right to be forgotten"), subject to legal retention obligations.
- Right to restriction (Art. 18): Ask us to limit how we process your data in certain circumstances.
- Right to data portability (Art. 20): Receive your data in a structured, machine-readable format.
- Right to object (Art. 21): Object to processing based on legitimate interests.
- Right to withdraw consent (Art. 7(3)): Withdraw any consent you have given at any time without affecting prior processing.
- Right to lodge a complaint: File a complaint with your national data protection supervisory authority (e.g., AZOP in Croatia, or the authority in your EU member state).
8. Cookies
We use cookies and similar technologies. Strictly necessary cookies are set without consent; other categories require your explicit consent. See our full Cookie Policy for details.
9. Security Measures
- All data in transit is encrypted via TLS 1.2+ (HTTPS)
- Passwords are hashed with bcrypt (never stored in plain text)
- PocketBase database is isolated and not publicly accessible
- API keys and secrets are stored as environment variables, not in source code
- Stripe handles all card data — we never see or store card numbers
10. Children's Privacy
Lumenta AI is not directed at children under 16 years of age. We do not knowingly collect personal data from children. If you believe we have inadvertently collected such data, contact us and we will delete it promptly.
11. Changes to This Policy
We may update this Privacy Policy from time to time. Material changes will be communicated via e-mail or a prominent notice on the website at least 14 days before they take effect. The "Last updated" date at the top of this page always reflects the current version.
12. Contact
For any privacy-related questions, requests, or complaints, contact us at:
privacy@lumenta.shop