Draft. Fields marked [like this] must be filled in, and the text must be reviewed by a lawyer before launch.
Privacy Policy
1. Who is responsible
The controller for Luma Slides (lumaslides.com and app.lumaslides.com, the "Service") is [Operator: full legal name or company name], [street, postal code, city, country], email privacy@lumaslides.com.
2. What data we process and why
| Data | Purpose | Legal basis (GDPR) |
|---|---|---|
| Email, password hash, name and profile photo (optional), sign-in with Google | Your account and sign-in | Art. 6(1)(b) — contract |
| Topics, answers, outlines, slides; text of tables you attach | Creating your presentations | Art. 6(1)(b) — contract |
| IP address, time of requests, error logs | Security, abuse prevention, free-plan limits | Art. 6(1)(f) — legitimate interest |
| Email on the Pro waitlist | Telling you when Pro launches | Art. 6(1)(a) — consent |
| Date of birth (optional), marketing email setting | Discounts and news, only if you opt in | Art. 6(1)(a) — consent |
Before a spreadsheet leaves your browser, Luma removes columns that look like personal data (names, phone numbers, emails, addresses). Please do not put other people's personal data into topics or files.
3. Who receives data
- Hosting: [Namecheap, Inc., USA] — servers in the USA.
- AI model provider: [provider name and country] — receives the text needed to create slides and does not use it to train models [confirm in the provider's terms].
- Email delivery: [provider name and country] — sign-in codes and service emails.
- Google — only if you choose "Continue with Google".
Processors act under a data processing agreement (Art. 28 GDPR).
4. Transfers outside the EU
Our servers and some providers are in the USA. Transfers rely on the EU–US Data Privacy Framework where the recipient is certified, otherwise on the European Commission's Standard Contractual Clauses (Art. 46 GDPR).
5. How long we keep data
- Account and presentations — until you delete your account (Profile settings → Delete account).
- Unfinished presentations — up to 7 days.
- Security logs — up to [30] days.
- Waitlist — until Pro launches or until you ask us to remove you.
6. Cookies
We use one essential cookie to keep you signed in and a short-lived one during sign-in with Google. We do not use analytics or advertising cookies.
7. Your rights
You have the right to access, rectify and erase your data, to restrict or object to processing, to data portability and to withdraw consent at any time (Art. 15–21 GDPR). Write to privacy@lumaslides.com. You may also lodge a complaint with a supervisory authority in your EU country.
8. US users
We do not sell personal information or share it for cross-context behavioral advertising. California residents may exercise the rights above by writing to the same address.