Privacy Policy

1. Introduction

Lummes ("we," "us," or "our") provides an AI-powered facial skincare companion. This Privacy Policy explains how we collect, use, disclose, and protect your information when you use our iOS and Android applications and related services.

2. Information we collect

• Account data: email, name (optional), preferences.
• Photos: facial images you upload for weekly analysis (LUM Day).
• Technical & usage data: device type/OS, app version, IP (truncated or anonymized where feasible), logs, crash reports, analytics events, in‑app interactions.
• Subscription & transactions: product tier, renewal status, region (processed by Apple/Google; we do not store full payment card data).
• Communications: emails or support requests you send us.

2.1. Face Data Collection and Processing

What face data we collect: When you upload facial images for skin analysis, we process facial features and skin characteristics from your photos to provide AI-powered skincare analysis and recommendations.

Why we collect face data: Face data is essential for our core service - providing personalized AI skin analysis, tracking your skin progress over time, and generating customized skincare recommendations.

Face data storage: Your facial images are stored locally on your device only. We do not store face data on our servers or in cloud storage systems.

Face data is not retained by us: We explicitly do not retain face data on our systems. All facial images remain on your local device under your control.

3. Purposes of processing

• Provide core features: AI analysis, weekly plans, LUM Mes progress tracking.
• Operate, maintain, and improve the app; personalize content and recommendations.
• Security, fraud prevention, diagnostics, and debugging.
• Communicate service updates, reminders (if enabled), and respond to support requests.
• Comply with legal obligations and enforce terms.

4. Legal bases (where applicable)

Depending on your region (e.g., GDPR), we rely on one or more legal bases: performance of a contract, legitimate interests (e.g., app improvement and security), consent (e.g., notifications, analytics where required), and legal obligations.

5. Sharing of information

• Processors: cloud hosting, analytics, crash reporting, email delivery — bound by confidentiality and data processing terms.
• App stores: subscriptions and payments are handled by Apple App Store or Google Play.
• Compliance & safety: to law enforcement or others where required by law, or to protect rights, privacy, and safety.
• Business transfers: as part of merger, acquisition, or asset sale, under appropriate safeguards.

5.1. Face Data Sharing with Third Parties

AI Analysis Service: We temporarily share face data with a third-party AI analysis service solely for the purpose of providing skin analysis. This service:

• Processes face data only to generate analysis results
• Does not retain face data after processing is complete
• Does not use face data for training or other purposes
• Does not share face data with any other parties

We do not share face data with: Advertising networks, social media platforms, marketing companies, or any other third parties for commercial purposes unrelated to providing skin analysis.

6. Data retention

We keep personal data only as long as needed for the purposes described, or as required by law. You can delete photos or your account at any time (see Section 9). Backups may persist for a limited period before being overwritten.

Face Data Retention Policy:

• Local Storage: Face data is stored locally on your device for as long as you choose to keep it.
• Our Systems: We do not retain face data on our servers or systems.
• Third-Party Processing: Face data sent to AI analysis service is not retained after processing is complete.
• User Control: You have full control over face data retention and can delete photos from your device at any time.

7. Security

We use technical and organizational measures to protect data, including access controls, secure storage, and monitoring. No method is 100% secure; please keep your credentials safe.

Face Data Security Measures:

• Local Storage: Face data remains on your device under your control and device security settings.
• Secure Transmission: When face data is sent for analysis, it is transmitted securely to prevent interception.
• No Server Storage: We do not store face data on our servers, reducing security risks.
• Third-Party Security: AI analysis service implements appropriate security measures during processing.

8. International transfers

Your information may be processed outside your country. Where required, we use appropriate safeguards (e.g., standard contractual clauses) to protect your data.

9. Your rights & choices

• Access, correction, deletion: manage data in the app or contact us.
• Consent withdrawal: disable analytics/notifications where available, or adjust device permissions (camera, photos).
• Portability/objection/restriction (where applicable under local law).
• Data deletion request: Account → Settings → Delete Account, or email info@lummes.app.

Face Data Rights:

• Local Control: You have full control over face data stored on your device and can delete it at any time.
• Processing Control: You can choose whether to use face analysis features in the app.
• No Server Data: Since we don't store face data on our servers, there is no server-side data to request or delete.
• Analysis Results: You can access and manage your skin analysis results through the app interface.

10. Children

Our services are not directed to children under 13 (or minimum age in your jurisdiction). We do not knowingly collect data from children without proper consent.

11. Third‑party links & SDKs

The app may include links or SDKs from third parties. Their practices are governed by their own policies; review them carefully.

12. Changes to this Policy

We may update this Privacy Policy periodically. We will notify you by updating the date, in‑app notice, or email. Continued use after changes means you accept the updated Policy.

13. Contact

• Email: info@lummes.app
• Address: Provided upon request