Privacy policy
> [INIT] Loading Global Privacy Standard v4.0.1...
> [SCAN] Jurisdiction Mapping: EU_GDPR | US_CCPA | IND_DPDP | UK_DPA
> [STATUS] Compliance Field: ACTIVE
> [LAST_UPDATE] 2026-10-11
>
> =================================================================================
> SYSTEM_HEADER
> =================================================================================
> Document .............. Global Data Privacy Framework
> Controller ............ Softpiper Solutions LLP
> Jurisdiction .......... Republic of India
> DPO Contact ........... dpo@luxelensai.com
> Privacy Inquiries ..... privacy@luxelensai.com
> Reference ............. #PRIV-GLOBAL-2026-v4.0.1
>
> 1.0 // OVERVIEW
> ---------------------------------------------------------------------------------
> This Privacy Protocol describes how LuxeLens AI Studio ("Service", "Platform",
> "we", "us") collects, processes, stores, and protects your personal data.
>
> We operate in compliance with applicable data protection laws, including:
>
> - GDPR (General Data Protection Regulation) — European Union
> - CCPA/CPRA (California Consumer Privacy Act) — United States
> - DPDP (Digital Personal Data Protection Act) — India
> - UK DPA (Data Protection Act 2018) — United Kingdom
>
> This Protocol explains your rights and our obligations. Where we require your
> consent for specific processing activities, we will request it separately.
>
> 2.0 // DATA_INGESTION_INVENTORY
> ---------------------------------------------------------------------------------
> We process the following categories of data to operate the Neural Rendering Engine:
>
> [2.1] ACCOUNT_VECTORS (Identity & Access)
>
> > Purpose .......... Authentication, License Verification, Fraud Prevention
> > Legal Basis ...... Contract Performance (GDPR Art. 6(1)(b))
> > Retention ........ Lifetime of Account + 2 Years (Legal Archival)
> > Fields ........... Hash IDs, Encrypted Credentials, Billing Geography
>
> | Data Type | Examples | Required |
> |-----------|----------|----------|
> | Identity Data | Name, username, profile image | Yes |
> | Contact Data | Email address, billing address | Yes |
> | Credential Data | Hashed passwords, OAuth tokens | Yes |
> | Preference Data | Language, timezone, UI settings | No |
>
> [2.2] NEURAL_INPUTS (User Content)
>
> > Purpose .......... Image Synthesis & Model Enhancement (if opted-in)
> > Legal Basis ...... Contract Performance / Consent (for training)
> > Retention ........ Uploaded images: until their job finishes; outputs: until you delete them
> > Security ......... AES-256 Encryption at Rest | TLS 1.3 in Transit
>
> | Data Type | Processing | Retention |
> |-----------|------------|-----------|
> | Uploaded Images | Processed for AI generation | Deleted when the job that uses them finishes; images uploaded but never used are deleted within 3 days |
> | Uploaded Audio | Used in your video projects | Kept for reuse until you close your account |
> | Generated Outputs | Stored for user access | Until you delete them in History or close your account |
> | Prompts & Parameters | Stored with the render they produced | Deleted with that render; a video project keeps its own until you close your account |
>
> IMPORTANT: User-uploaded content is **never** used for model training unless you
> explicitly opt-in via Account Settings. Free-tier users may be prompted to
> contribute anonymized data; this is always optional.
>
> [2.3] TELEMETRY_STREAM (Analytics & Performance)
>
> > Purpose .......... System Optimization, Debugging, Threat Detection
> > Legal Basis ...... Legitimate Interest (GDPR Art. 6(1)(f))
> > Retention ........ 90 days (aggregated); 30 days (raw logs)
> > Logic ............ Anonymized aggregation; no PII in analytics
>
> | Data Type | Examples | Identifiable |
> |-----------|----------|--------------|
> | Usage Patterns | Features used, session duration | No |
> | Device Info | Browser type, OS, screen resolution | No |
> | Performance Data | Load times, error rates | No |
> | IP Address | Truncated/hashed for geolocation | Pseudonymized |
>
> [2.4] TRANSACTION_RECORDS (Billing)
>
> > Purpose .......... Payment Processing, Tax Compliance, Fraud Prevention
> > Legal Basis ...... Contract Performance / Legal Obligation
> > Retention ........ 7 years (tax/legal requirements)
> > Security ......... PCI-DSS compliant payment processors
>
> We do **not** store complete credit card numbers, CVVs, or bank account details.
> All payment processing is handled by PCI-DSS Level 1 certified processors.
>
> 3.0 // LEGAL_BASIS_MATRIX
> ---------------------------------------------------------------------------------
> Under GDPR and equivalent regulations, we process data under the following
> legal bases:
>
> | Processing Activity | Legal Basis | Your Rights |
> |---------------------|-------------|-------------|
> | Account creation & authentication | Contract Performance | Access, Portability |
> | AI image generation | Contract Performance | Access, Deletion |
> | Model training (opt-in only) | Explicit Consent | Withdraw anytime |
> | Analytics & optimization | Legitimate Interest | Object, Restrict |
> | Marketing communications | Consent | Withdraw anytime |
> | Fraud prevention & security | Legitimate Interest | Object |
> | Legal compliance & tax | Legal Obligation | Access |
>
> 4.0 // SUB_PROCESSOR_NETWORK
> ---------------------------------------------------------------------------------
> We partner with certified infrastructure providers to deliver the Service.
> All sub-processors are contractually bound to equivalent data protection standards.
>
> > CLOUD_INFRASTRUCTURE ..... [Region: Multi-Geo] ...... Hosting & Edge Compute
> > DATABASE_SERVICES ........ [Region: USA/EU] ......... Encrypted Data Persistence
> > AUTH_PROVIDERS ........... [Region: USA/EU] ......... Identity & OAuth Management
> > PAYMENT_GATEWAYS ......... [Region: Global] ......... PCI-DSS Transactions
> > AI_COMPUTE_GRID .......... [Region: Global] ......... GPU Neural Processing
> > ANALYTICS_ENGINES ........ [Region: USA] ............ Anonymized Usage Metrics
> > EMAIL_SERVICES ........... [Region: USA/EU] ......... Transactional Communications
>
> Sub-Processor Standards:
> - All infrastructure providers maintain SOC 2 Type II certification
> - Cloud providers hold ISO/IEC 27001 certification
> - Payment processors are PCI-DSS Level 1 compliant
> - AI compute providers adhere to responsible AI frameworks
>
> A complete list of sub-processors is available upon request at: privacy@luxelensai.com
>
> 5.0 // CROSS_BORDER_DATA_TRANSMISSION
> ---------------------------------------------------------------------------------
> Data traversing regional boundaries is protected via approved transfer mechanisms:
>
> > [EU → Non-EU Transfers]
> > Mechanism: Standard Contractual Clauses (SCCs) - EC Approved 2021
> > Supplementary Measures: Encryption, Access Controls, Pseudonymization
> >
> > [US Transfers]
> > Framework: EU-US Data Privacy Framework (DPF) adherence
> > Certification: Sub-processors self-certified under DPF
> >
> > [India Localization]
> > Status: Compliant with DPDP Act requirements
> > Storage: Critical data mirrored in Indian data centers where mandated
>
> Transfer Safeguards:
>
> | Destination | Mechanism | Additional Protections |
> |-------------|-----------|------------------------|
> | United States | SCCs + DPF | Encryption in transit/rest |
> | European Union | Adequacy (intra-EU) | GDPR-native compliance |
> | United Kingdom | UK SCCs | UK GDPR alignment |
> | India | DPDP Compliance | Local data residency options |
> | Other | SCCs + Risk Assessment | Case-by-case evaluation |
>
> 6.0 // USER_ROOT_PRIVILEGES (Data Subject Rights)
> ---------------------------------------------------------------------------------
> You hold command authority over your data profile. Rights vary by jurisdiction
> but we honor the highest standard globally:
>
> > /access_request ........ Retrieve full export of stored personal data
> > /correction ............ Rectify inaccurate or incomplete records
> > /forget_me ............. Irreversible deletion (Right to Erasure)
> > /restrict .............. Halt processing during disputes
> > /portability ........... Receive data in machine-readable format
> > /obj_marketing ......... Sever all marketing communications
> > /obj_profiling ......... Opt-out of automated decision-making
> > /withdraw_consent ...... Revoke previously granted consent
>
> How to Exercise Your Rights:
>
> | Method | Details | Response Time |
> |--------|---------|---------------|
> | Email | privacy@luxelensai.com | 30 days (GDPR) |
> | In-App | Settings → Privacy → Data Rights | Immediate to 30 days |
> | Mail | Softpiper Solutions LLP, India | 30 days |
>
> Verification: We may require identity verification to process requests. This
> protects your data from unauthorized access.
>
> Exceptions: Certain requests may be denied where we have legitimate grounds
> (e.g., legal retention requirements, fraud prevention).
>
> Jurisdiction-Specific Rights:
>
> California Residents (CCPA/CPRA):
> - Right to know what personal information is collected
> - Right to delete personal information
> - Right to opt-out of sale/sharing (we do not sell your data)
> - Right to non-discrimination for exercising rights
> - Right to limit use of sensitive personal information
>
> EU/UK Residents (GDPR/UK GDPR):
> - All rights listed above
> - Right to lodge complaint with supervisory authority
> - Right to withdraw consent at any time
>
> Indian Residents (DPDP):
> - Right to access and correction
> - Right to erasure
> - Right to grievance redressal
> - Right to nominate (data inheritance)
>
> 7.0 // SECURITY_INFRASTRUCTURE
> ---------------------------------------------------------------------------------
> We implement enterprise-grade security controls to protect your data:
>
> > ==========================================================================
> > SECURITY POSTURE // INFRASTRUCTURE TRUST LAYER
> > ==========================================================================
> >
> > [ENCRYPTION]
> > > At Rest ............. AES-256 encryption for all stored data
> > > In Transit .......... TLS 1.3 minimum for all connections
> > > Key Management ...... Hardware Security Modules (HSM)
> >
> > [ACCESS_CONTROL]
> > > Authentication ...... Multi-factor authentication available
> > > Authorization ....... Role-based access control (RBAC)
> > > Monitoring .......... Real-time anomaly detection
> >
> > [INFRASTRUCTURE]
> > > Hosting ............. SOC 2 Type II certified providers
> > > Database ............ SOC 2 Type II certified providers
> > > AI Processing ....... ISO 27001 certified compute
> > > Payments ............ PCI-DSS Level 1 processors
> >
> > [CERTIFICATIONS_INHERITED]
> > > SOC 2 Type II ....... Via infrastructure providers
> > > ISO/IEC 27001 ....... Via cloud providers
> > > ISO/IEC 27017 ....... Cloud security controls
> > > ISO/IEC 27018 ....... Cloud privacy controls
> > > PCI-DSS Level 1 ..... Via payment processors
> >
> > [OPERATIONAL_SECURITY]
> > > Penetration Testing .. Annual third-party assessments
> > > Vulnerability Scans .. Continuous automated scanning
> > > Security Training .... Mandatory for all personnel
> > > Incident Response .... Documented procedures & team
>
> Note on Certifications: The certifications listed above belong to our infrastructure
> providers. LuxeLens inherits these security controls through our architecture. We
> maintain documented security practices aligned with these standards and are pursuing
> independent certification as we scale.
>
> 8.0 // INCIDENT_RESPONSE_PROTOCOL
> ---------------------------------------------------------------------------------
> In the event of a confirmed security breach affecting personal data:
>
> > [DETECTION] ........... T-0
> > > Automated monitoring triggers alert
> > > Security team assesses scope and severity
> >
> > [CONTAINMENT] ......... T+0 to T+4 hours
> > > Isolate affected systems
> > > Preserve forensic evidence
> > > Engage incident response procedures
> >
> > [AUTHORITY_NOTIFICATION] ... Within 72 hours
> > > EU: Relevant Data Protection Authority (DPA)
> > > UK: Information Commissioner's Office (ICO)
> > > India: CERT-In (as per DPDP Act)
> > > USA: State Attorneys General (as required)
> >
> > [USER_NOTIFICATION] ... Without undue delay
> > > Direct notification for high-risk breaches
> > > Clear description of incident and data affected
> > > Recommended protective measures
> > > Contact information for questions
> >
> > [REMEDIATION] ......... Ongoing
> > > Root cause analysis
> > > Security improvements implemented
> > > Documentation and reporting
>
> 9.0 // COOKIES_AND_TRACKING
> ---------------------------------------------------------------------------------
> For detailed information on cookies and tracking technologies, please refer to
> our separate **Cookie Policy**. Summary:
>
> | Category | Purpose | Consent Required |
> |----------|---------|------------------|
> | Essential | Security, authentication, load balancing | No (strictly necessary) |
> | Functional | User preferences, UI state | No (legitimate interest) |
> | Analytics | Performance monitoring, feature usage | Yes (opt-out available) |
> | Marketing | Conversion tracking, campaign optimization | Yes (opt-in required) |
>
> Manage preferences at: **[Footer] → "Manage Cookies"** or via browser settings.
>
> 10.0 // DATA_RETENTION_SCHEDULE
> ---------------------------------------------------------------------------------
> We retain data only as long as necessary for the purposes described:
>
> | Data Category | Active Retention | Post-Deletion Archive | Total Maximum |
> |---------------|------------------|----------------------|---------------|
> | Account Data | Lifetime of account | 2 years | Account + 2 years |
> | User Content (Uploaded Images) | Until the job finishes (unused uploads: up to 3 days) | Up to 7 days | 10 days |
> | User Content (Uploaded Audio) | Lifetime of account | Up to 7 days | Account + 7 days |
> | User Content (Outputs) | Until you delete them or close your account | Up to 7 days | Account + 7 days |
> | Transaction Records | 7 years | None | 7 years |
> | Analytics (Raw) | 30 days | None | 30 days |
> | Analytics (Aggregated) | 90 days | None | 90 days |
> | Support Communications | 3 years | 2 years | 5 years |
> | Security Logs | 1 year | None | 1 year |
>
> Deleted files and records can remain in encrypted storage and database backups for up
> to 7 days before they are purged.
>
> Account Deletion: Upon account deletion request, we will:
> 1. Immediately disable account access
> 2. Delete personal data within 30 days
> 3. Retain anonymized analytics and legally-required records
> 4. Purge backup systems within 90 days
>
> 11.0 // CHILDREN_AND_MINORS
> ---------------------------------------------------------------------------------
> > [AGE_RESTRICTION]
> > > Minimum Age: 16 years (EU/UK) | 13 years (USA) | 18 years (India)
> > > Verification: Self-declared during registration
> > > Policy: We do not knowingly collect data from minors
>
> If we become aware that we have collected personal data from a minor without
> appropriate consent, we will take steps to delete that information promptly.
> Parents or guardians may contact us at privacy@luxelensai.com to request deletion.
>
> 12.0 // AI_SPECIFIC_DISCLOSURES
> ---------------------------------------------------------------------------------
> As an AI-powered service, we provide additional transparency:
>
> > [MODEL_TRAINING]
> > > Default: User content is NOT used for training
> > > Opt-In: Users may voluntarily contribute anonymized data
> > > Withdrawal: Consent can be withdrawn at any time
> >
> > [AUTOMATED_DECISIONS]
> > > Content Moderation: AI filters for prohibited content
> > > Fraud Detection: Automated risk scoring
> > > Human Review: Available upon request for significant decisions
> >
> > [OUTPUT_ACCURACY]
> > > AI-generated content may contain errors or inaccuracies
> > > Users are responsible for reviewing outputs before use
> > > No guarantee of factual accuracy in generated content
>
> Right to Human Review: Where automated processing significantly affects you,
> you have the right to request human intervention, express your point of view,
> and contest the decision.
>
> 13.0 // THIRD_PARTY_LINKS
> ---------------------------------------------------------------------------------
> Our Service may contain links to third-party websites or services. We are not
> responsible for the privacy practices of these external sites. We encourage you
> to review their privacy policies before providing any personal data.
>
> 14.0 // CHANGES_TO_PROTOCOL
> ---------------------------------------------------------------------------------
> We may update this Privacy Protocol periodically. When we make material changes:
>
> - We will update the "Last Updated" date at the top
> - We will notify you via email and/or prominent notice on the Service
> - Continued use after notification constitutes acceptance
>
> Version History:
> | Version | Date | Summary |
> |---------|------|---------|
> | v4.0.1 | 2026-10-11 | Retention of uploads, outputs and prompts restated |
> | v4.0.0 | 2026-02-03 | Global compliance update; DPDP alignment |
> | v3.0.0 | 2025-06-15 | Added AI-specific disclosures |
> | v2.0.0 | 2025-01-01 | GDPR/CCPA alignment |
> | v1.0.0 | 2024-08-01 | Initial release |
>
> 15.0 // CONTACT_MATRIX
> ---------------------------------------------------------------------------------
> > ==========================================================================
> > CONTACT INFORMATION
> > ==========================================================================
> >
> > [DATA_CONTROLLER]
> > > Entity: Softpiper Solutions LLP
> > > Location: India
> >
> > [DATA_PROTECTION_OFFICER]
> > > Email: dpo@luxelensai.com
> > > Response: Within 5 business days
> >
> > [PRIVACY_INQUIRIES]
> > > Email: privacy@luxelensai.com
> > > Response: Within 30 days
> >
> > [GENERAL_SUPPORT]
> > > Email: support@luxelensai.com
> > > Response: Within 48 hours
> >
> > [SUPERVISORY_AUTHORITY_COMPLAINTS]
> > > EU: Your local Data Protection Authority
> > > UK: Information Commissioner's Office (ico.org.uk)
> > > India: Data Protection Board of India (once established)
>
> 16.0 // JURISDICTION_SPECIFIC_ADDENDA
> ---------------------------------------------------------------------------------
> California Privacy Rights (CCPA/CPRA):
>
> Categories of Personal Information Collected:
> - Identifiers (name, email, IP address)
> - Commercial information (transaction history)
> - Internet activity (usage data, cookies)
> - Geolocation data (approximate, from IP)
> - Inferences (preferences derived from usage)
>
> We Do Not:
> - Sell your personal information
> - Share your personal information for cross-context behavioral advertising
> - Use sensitive personal information for purposes beyond service delivery
>
> To Exercise Rights: Submit verifiable request to privacy@luxelensai.com or
> call [TBD toll-free number].
>
> European Economic Area & UK:
>
> Data Protection Authority Contacts:
> - Lead Authority: [To be determined based on main establishment]
> - UK: Information Commissioner's Office — ico.org.uk
> - EU: Your local DPA — edpb.europa.eu/about-edpb/board/members_en
>
> > ==========================================================================
> > [END OF PRIVACY PROTOCOL]
> > Hash: #PRIV-GLOBAL-2026-v4.0.1
> > Status: ACTIVE
> > ==========================================================================
> >
> > [SYSTEM] To execute Data Rights Commands: privacy@luxelensai.com
> > [SYSTEM] Document maintained by: Legal & Compliance Team
> > [SYSTEM] Next scheduled review: 2026-08-01
>
> This Privacy Protocol is effective as of February 3, 2026.
> © 2026 Softpiper Solutions LLP. All rights reserved.