Privacy Policy for Luminous Whisper

1. Information We Collect

We collect the following categories of information:

A. Information you provide

• Account information (if you create an account): email address, username, password (hashed).
• User-generated content and inputs: text prompts, images, audio, or other content you submit to generate AI outputs.
• Communications: messages you send to support or feedback.
• Payment information (if applicable): processed by third-party payment providers; we do not store full payment card details.

B. Information collected automatically

• Device and technical data: device type, operating system, unique device identifiers, IP address, browser type, language settings.
• Usage data: features used, generation history (prompts and outputs), session duration, crash logs, performance metrics.
• Cookies and similar technologies (on web versions or related sites): for functionality, analytics, and preferences.

C. Information from third parties

• Analytics and infrastructure providers (e.g., cloud hosting, crash reporting).
• AI model providers (when your inputs are processed by external AI services).

We do not intentionally collect sensitive personal data (e.g., health, biometric, precise location, or special-category data under GDPR) unless you voluntarily include it in prompts. Please avoid submitting such information.

2. How We Use Your Information

We use personal information for the following purposes and legal bases (where GDPR/LGPD apply):

• To provide and improve the Service (contract performance / legitimate interests): process your prompts to generate AI outputs, maintain account functionality, and deliver the core features of the App.
• AI processing: Your inputs are sent to AI model providers to generate content. We may use aggregated or anonymized data to improve our Service.
• Security and fraud prevention (legitimate interests / legal obligation).
• Analytics and product improvement (legitimate interests): understand usage patterns to enhance features and performance.
• Communications (consent or legitimate interests): respond to support requests or send important service notices.
• Legal compliance (legal obligation).

AI-specific disclosures

• We use third-party AI providers to power generation features. Your prompts and related data are processed under our agreements with those providers.
• We do not use your personal prompts or outputs to train or improve general foundation models unless you explicitly opt in (where such an option is offered).
• Outputs may be stored temporarily to provide history or continuity features; you can delete them.
• Automated processing occurs to generate content. This does not involve automated decision-making that produces legal or similarly significant effects on you under GDPR Article 22.

3. How We Share Your Information

We do not sell your personal information. We may share data only in these limited circumstances:

• Service providers / processors: Cloud hosting, AI model providers, analytics, payment processors, and customer support tools, under data processing agreements that require them to protect your data and use it only for our instructions.
• Legal requirements: When required by law, court order, or to protect rights, safety, or property.
• Business transfers: In connection with a merger, acquisition, or sale of assets (with notice where required).
• With your consent: For any other sharing you approve.

4. International Data Transfers

Your information may be processed in countries outside your residence (including the United States or other locations where our service providers operate). When transferring personal data from the EEA, UK, or other regions with transfer restrictions, we use appropriate safeguards such as Standard Contractual Clauses (SCCs), the EU-U.S. Data Privacy Framework (where applicable), or equivalent mechanisms, and conduct transfer impact assessments as required.

5. Data Retention

We retain personal information only as long as necessary for the purposes described above, or as required by law:

• Account data: for the life of your account + a reasonable period after deletion for backup/legal purposes.
• Generation history / prompts: typically retained while your account is active or until you delete it; temporary caches are shorter.
• Analytics and logs: generally retained for a limited period (e.g., 12–24 months) in aggregated or anonymized form where possible.
• Legal or security-related records: as required by applicable law.

You may request deletion at any time (see Section 7).

6. Security

We implement appropriate technical and organizational measures to protect personal information, including encryption in transit (TLS), access controls, secure storage, and regular security reviews. No method of transmission or storage is 100% secure; we cannot guarantee absolute security.

7. Your Rights and Choices

Depending on your location, you may have the following rights:

GDPR / UK GDPR / LGPD (and similar laws)

• Access, rectification, erasure (“right to be forgotten”), restriction of processing, data portability, objection to processing based on legitimate interests, and withdrawal of consent.
• Right not to be subject to solely automated decision-making with legal or similarly significant effects.

CCPA/CPRA (California residents)

• Right to know categories of personal information collected, sources, purposes, and third parties.
• Right to delete personal information.
• Right to correct inaccurate information.
• Right to opt out of “sale” or “sharing” of personal information (we do not sell or share for cross-context behavioral advertising).
• Right to nondiscrimination for exercising rights.
• Right to limit use of sensitive personal information (we do not use sensitive data for purposes requiring this).

Other jurisdictions may provide additional rights (e.g., under PIPEDA, Australian Privacy Principles, India’s DPDP Act, etc.).

How to exercise rights

Email us at [email protected]. We will verify your identity and respond within the timeframes required by applicable law (generally 30–45 days, with possible extensions). You may also contact your local data protection authority if you believe we have not adequately addressed your request.

Opt-out options

• Account deletion and data export features (where available in the App).
• Cookie / tracking preferences (on web interfaces).
• Marketing communications opt-out (if we send any).

8. Children’s Privacy

The App is not directed to children under 13 (or under 16 in the EEA/UK where parental consent is required). We do not knowingly collect personal information from children under these ages. If we learn we have collected such information, we will delete it. Parents or guardians who believe their child has provided information may contact us at [email protected].

9. Cookies and Tracking Technologies

We (and our partners) may use cookies, local storage, and similar technologies for essential functionality, analytics, and preferences. You can manage cookies through your browser or device settings. Disabling certain cookies may affect App functionality.

10. Third-Party Links and Services

The App may contain links to third-party websites or services. This Policy does not apply to those third parties. We encourage you to review their privacy policies.

11. Changes to This Privacy Policy

We may update this Policy from time to time. We will post the revised version with an updated “Last Updated” date and, where required by law, provide additional notice (e.g., email or in-App notice) for material changes. Continued use of the Service after changes constitutes acceptance of the updated Policy.

12. Contact Us

For questions, requests, or complaints regarding this Privacy Policy or our data practices:

Email: [email protected]