Luma Cloud

Privacy Policy

Last updated: July 9, 2026

This Privacy Policy explains how Luma Cloud collects, uses, stores, and shares personal data when you use the website, dashboard, API, SuperCodex installer, and related services.

1. Data we collect

  • Account data: email address, account identifiers, login/session data, authentication events, and account settings.
  • Billing data: plan, subscription status, invoices, checkout metadata, payment status, and payment processor identifiers. Card details are handled by Stripe or another displayed payment processor.
  • API and usage data: API keys, request metadata, model selection, token counts, weekly quota usage, timestamps, status codes, request ids, and diagnostic traces.
  • Prompts, files, and outputs: prompts, code, files, tool calls, and model outputs may be processed to deliver the Service, debug failures, enforce abuse rules, and meter usage.
  • Device and technical data: IP address, browser or client type, operating system, installed SuperCodex version, logs, crash data, and security events.
  • Support data: messages you send to support, attachments, screenshots, logs, and related correspondence.

2. How we use data

We use data to provide the Service, authenticate users, process payments, issue and validate API keys, route requests, enforce quotas, prevent abuse, debug incidents, provide support, improve reliability, comply with law, and protect Luma Cloud, customers, and upstream providers.

3. AI processing and upstream providers

Requests may be transmitted to third-party AI model providers and infrastructure providers so they can generate responses or operate the Service. Do not submit secrets, credentials, regulated data, or sensitive personal data unless you have the right to do so and accept that it will be processed by the Service and relevant providers.

4. Payment processing

Payments are processed by Stripe or another displayed payment processor. Those processors receive payment and billing details needed to complete checkout, manage subscriptions, prevent fraud, and provide receipts. Their privacy notices apply to their processing of payment data.

5. Sharing and subprocessors

We may share data with service providers that help operate Luma Cloud, including hosting, database, analytics, logging, email delivery, payment, security, and upstream AI providers. We may also disclose data when required by law, to prevent abuse or security incidents, to enforce our terms, or as part of a merger, acquisition, financing, or sale of assets. We do not sell personal data.

6. Retention

We retain account, billing, quota, usage, security, and support records for as long as needed to operate the Service, comply with legal and accounting obligations, resolve disputes, prevent abuse, and enforce agreements. Prompt and output content may be retained for operational, debugging, safety, or billing purposes unless a shorter retention path is configured or required by law.

7. Security

We use technical and organizational measures such as encrypted transport, access controls, signed sessions, hashed or protected secrets, and operational monitoring. No system is perfectly secure, and you are responsible for protecting your devices, email account, sessions, and API keys.

8. International processing

Luma Cloud and its providers may process data in multiple countries. Where required, we use appropriate safeguards for cross-border transfers.

9. Your choices and rights

Depending on your location, you may have rights to access, correct, delete, export, restrict, or object to processing of your personal data. You may also have rights related to consent or complaints to a data protection authority. To make a request, contact info@lumaos.cloud. We may need to verify your identity before acting.

10. California privacy notice

We do not sell personal information. We use personal information for the business purposes described above, including providing the Service, payments, security, support, analytics, and abuse prevention. California residents may contact info@lumaos.cloud to exercise applicable rights to know, delete, correct, or opt out of certain sharing where applicable.

11. Children

The Service is not intended for individuals under 18. We do not knowingly collect personal data from children.

12. Changes

We may update this Privacy Policy. Material changes may be announced by email, in-product notice, or website update.

13. Contact

Privacy questions or requests: info@lumaos.cloud.