PRIVACY POLICY (Luminel)

Last updated: 2026-01-18

This Privacy Policy explains how Hunter & Prize GmbH (“Hunter & Prize”, “we”, “us”) collects, uses, shares, and protects personal data when you use Luminel (the “Brand”), the website at luminel.ai, and related services including our web platform, subscriptions, and integrations (including our Adobe Photoshop plugin) (collectively, the “Services”).

1. WHO WE ARE (DATA CONTROLLER)

2. SCOPE

This Privacy Policy applies to:

• Website visitors (luminel.ai)
• Registered users of the platform and subscriptions
• Users of our Adobe Photoshop plugin/integration
• API customers

3. PERSONAL DATA WE COLLECT

A. Information you provide

• Account Information: Email address, name (optional), password (stored as a secure hash), and billing address.
• Inputs for Processing: Text prompts, images, reference images, masks, and other files you upload for editing or generation (“Inputs”).
• Support Communications: Messages, attachments, and metadata you send to us via email or support forms.

B. Information collected automatically

• Usage & Billing Metadata: To manage your credit usage and subscription, we log specific generation events linked to your account (e.g., model/provider used, credit cost, status, timestamp).
• Service Telemetry (pseudonymized where possible): We collect technical logs such as request identifiers, image dimensions, settings toggles, error codes, and latency to operate, debug, and improve the Services. We do not log text prompts or store image content in telemetry logs, and we do not create thumbnails, hashes, or partial image captures for logging.
• Device Data: IP address, browser type, operating system, plugin version, and referral URLs.

C. Information from third parties

• Payment Information: We receive payment status, invoice details, and subscription updates from our payment processor (Stripe). We do not store full credit card numbers; these are handled directly by Stripe.
• Adobe ecosystem (Photoshop plugin): If you install or use the plugin through Adobe’s systems (e.g., marketplaces, licensing, or related services), Adobe may process certain data independently under Adobe’s own policies and terms.

4. HOW WE USE PERSONAL DATA

We use personal data to:

• Provide, operate, and maintain the Services (including routing requests to AI providers).
• Process billing, track credit usage, and manage subscriptions.
• Authenticate users and prevent unauthorized access.
• Monitor, debug, and improve performance (using telemetry).
• Comply with legal obligations (e.g., tax and accounting laws).
• Enforce our Terms of Service and prevent abuse (e.g., use that violates applicable law or our policies).

5. COOKIES & SIMILAR TECHNOLOGIES

We use cookies and similar technologies (e.g., local storage) only where they are strictly necessary to provide the Services you request and to protect the Services against abuse and attacks.

What we use them for:

• Security & bot protection (Cloudflare): to help protect the website and Services, detect abusive traffic, and mitigate attacks.
• Authentication & session management (Clerk): to keep you signed in, maintain your session, and secure account access.

Your choices: You can delete or block cookies in your browser settings. If you do so, parts of the Services (especially login and account features) may not function.

6. AI PROCESSING & SUB-PROCESSORS

A. How we process Inputs

When you use the Luminel plugin or platform:

1. Direct Transmission: Your Inputs are transmitted from your device to our systems.
2. External AI Providers: To perform image generation or editing, we transmit your Inputs (and strictly necessary parameters) to third-party AI providers (“Sub-processors”).
3. List of providers and service vendors: A current list of our sub-processors (including AI providers as well as infrastructure vendors such as hosting, storage, authentication, database, and logging/monitoring providers), including processing locations, is available at: https://luminel.ai/legal/subprocessors.
4. Updates: We may update our sub-processors from time to time and will keep the list current.

B. Content Safety & Moderation

We may use automated tools (provided by sub-processors listed on our sub-processor page) to scan Inputs and/or Outputs solely to enforce our Terms of Service, prevent abuse, and detect content that may be illegal or prohibited under our usage policies.

C. Images of people

Inputs may include images of people. We do not use Inputs for facial recognition, identification, or to create biometric templates for identifying individuals. We process Inputs only to provide the requested editing/generation result.

7. MODEL TRAINING & DATA USAGE

A. Our use (Hunter & Prize)

We do not use your Inputs or Outputs to train our own proprietary AI models. Your content is processed by us primarily to route it to the appropriate AI provider and to deliver the resulting content back to you.

B. Third-party use

We utilize third-party AI providers to generate or edit content. Some providers may use submitted content (Inputs and/or Outputs) to improve their services or train models, depending on the provider and model used.

For transparency, our sub-processor page specifies, for each AI provider/model, whether the provider states that it uses submitted content for training/improvement and whether controls or opt-outs are available (if any). We encourage you to review that information before choosing a provider/model.

8. LEGAL BASES (GDPR)

We process personal data based on:

• Contract performance (Art. 6(1)(b)): To provide the Services, including image generation/editing, account management, subscriptions, and billing.
• Legitimate interests (Art. 6(1)(f)): To secure the Services, prevent fraud/abuse, maintain reliability, and improve the Services through telemetry and debugging.
• Legal obligation (Art. 6(1)(c)): To comply with tax/accounting requirements and other applicable laws.

Where processing is based on your consent (e.g., optional cookies where required), you may withdraw consent at any time via the relevant settings/controls.

9. PAYMENT PROCESSING (STRIPE)

We use Stripe as our payment processor. When you subscribe or buy credits, payment data is processed directly by Stripe. Hunter & Prize GmbH does not have access to your full card number or CVC. Stripe may act as an independent controller for certain processing (e.g., fraud monitoring and compliance). Please review Stripe’s privacy information for details.

10. INTERNATIONAL TRANSFERS

Our sub-processors may process personal data in countries outside the EEA/UK. Processing locations for each sub-processor are listed on our sub-processor page.

Where personal data is transferred outside the EEA/UK, we rely on appropriate safeguards such as:

• EU Standard Contractual Clauses (SCCs), and/or
• the EU-U.S. Data Privacy Framework (where the recipient is certified), and/or
• other legally recognized transfer mechanisms where applicable.

11. SECURITY

We use technical and organizational measures designed to protect personal data, including encryption in transit (TLS), access controls, private storage buckets, and time-limited signed URLs for file access.

12. DATA RETENTION

We retain personal data only as long as necessary:

• Account Data: While your account is active.
• Inputs & Outputs (Images): We retain Inputs and generated Outputs for a limited period (currently up to 7 days, possibly shorter) to facilitate delivery, downloads, and troubleshooting. After this period, they are deleted from our active systems. Important: AI providers and other sub-processors may retain and process data under their own terms as described on our sub-processor page.
• Billing Records: Retained for 10 years as required by German tax law (GoBD).
• Server Logs: Retained for up to 180 days for security and debugging.

If we introduce optional features such as “History” or “Gallery,” we will describe the related retention choices in the Services at the time those features are offered.

13. YOUR RIGHTS

Under the GDPR, you have the right to:

• Access and obtain a copy of your data.
• Rectify (correct) inaccurate data.
• Erase (delete) your data, subject to retention obligations (e.g., tax records).
• Restrict processing.
• Object to processing (where based on legitimate interests).
• Data portability.

To exercise these rights, contact us at info@luminel.ai. You also have the right to lodge a complaint with a supervisory authority (e.g., the Landesbeauftragte für Datenschutz und Informationsfreiheit Nordrhein-Westfalen).

14. CHILDREN

The Services are not intended for individuals under 18. We do not knowingly collect personal data from children.

15. CHANGES TO THIS POLICY

We may update this Privacy Policy to reflect changes in our Services or legal requirements. We will update the “Last updated” date and, where appropriate, provide notice through the Services or by email.