Privacy Policy

This policy explains how Lumen Labs ("we") collects, uses, shares, and protects your personal information when you use the Lumen service.

Please read it carefully before using the Service. If you do not agree to this policy, please stop using the Service.

Information you provide

• Registration information: email address
• Profile (optional): avatar, display name, bio
• Creation input: prompts, uploaded source images, parameter settings
• Payment information: order records (actual card/account details are handled by third-party payment providers; we do not store full card numbers)
• Feedback and communication: the content of messages you send to support

Information collected automatically

• Device and environment: browser type, operating system, screen resolution, language preference
• Network information: IP address (city-level precision), internet service provider
• Usage logs: pages visited, action times, generation request records (used for anti-fraud, billing reconciliation, and performance optimization)
• Cookies and local storage (see Section 5)

What we do not collect

• Your real name, ID number, or biometric information (unless explicitly required by law)
• Your contacts, precise location coordinates, or microphone/camera data
• Your activity on third-party platforms

We use your information only for the following purposes:

• Providing and maintaining core features (account management, image generation, content storage, credit settlement)
• Improving the product experience (anomaly monitoring, performance optimization, new feature testing)
• Account security and anti-fraud (abnormal login detection, preventing abuse and gaming)
• Customer support and troubleshooting
• Complying with laws and regulations (cooperating with law enforcement, responding to judicial orders)

We will not use your prompts or generated images to train AI models other than Lumen, nor will we sell them to third parties.

We will only share your information with third parties in the following cases:

• Service providers: cloud computing, object storage, payment, email delivery, and other providers; we share only the necessary data and require them to observe equivalent confidentiality obligations
• With your authorization: when you choose to share your work to the community or third-party platforms
• Legal requirements: in response to lawful requests from law enforcement or courts
• Corporate changes: in the event of a merger, acquisition, or asset transfer, we will notify you in advance and require the successor to continue to fulfill the obligations of this policy

We will describe the list of core service providers on this page or within the Service, and update it when we add a provider that significantly affects your rights.

We use cookies and similar technologies to maintain login state, remember preferences, and measure visit data. Cookies fall roughly into three categories:

You can manage these options through your browser settings or our Cookie preferences panel. We do not use cross-site tracking cookies or behavioral advertising cookies.

Storage location

By default, your data is stored on servers in our current deployment region. We protect data with transport-layer encryption (TLS) and storage-layer encryption.

Retention period

• Basic account information: for the life of the account + 30 days after closure
• Creation history: for the life of the account (you can delete it at any time)
• Payment orders: retained for 5 years as required by regulations
• Access logs: automatically cleared after 180 days

Security measures

We adopt industry-standard access control, the principle of least privilege, encryption, intrusion detection, and other layered protections. Nonetheless, internet transmission and storage are never absolutely secure; in the event of a data breach, we will notify affected users and report to regulators within 72 hours.

Regarding your personal information, you have the rights to access, correct, delete, export, withdraw consent, restrict processing, and lodge complaints.

To exercise your rights, contact us via our support email [email protected], and we will respond within 15 business days.

The Service is not directed at children under 14. We do not knowingly collect children's personal information. If you are a child's guardian and discover that your child provided us information without consent, please contact us and we will delete the relevant data immediately.

If operating the Service requires transferring your data outside the current deployment region, we will adopt protective measures such as standard contractual clauses (SCC) and data export security assessments as required by applicable law.

You can learn the scope and basis of specific cross-border transfers via our support email [email protected].

We may update this policy due to changes in law or product evolution. We will notify you of major changes (such as new ways of using data) via email or in-app notice and seek necessary consent. We recommend revisiting this page periodically for the latest version.

If you have any questions, suggestions, or complaints about this document, please contact us in the following ways:

• User support:[email protected]
• Data Protection Officer (DPO):[email protected]