Privacy Policy

Last updated: May 2026 · Version 1.0

1. Data controller

The data controller responsible for your personal data is:

• Name: Lux AI
• Location: Spain, European Union
• Contact: helloluxai@gmail.com

We do not have a formal Data Protection Officer as we do not meet the thresholds requiring one under Article 37 GDPR. For all data protection matters, contact us directly at the email above.

2. What personal data we collect

Photos (biometric/health data — Article 9 GDPR)
When you upload a photo for skin analysis, it is transmitted securely (HTTPS) to Google's Gemini AI API for processing. Your full-resolution photo is never stored on our servers — it is deleted from memory immediately after your results are generated. However, the following photo data may be stored:

• Scan thumbnails — a small compressed version of your photo is stored locally on your device to display in your scan history. This never leaves your device unless you create an account.
• Progress photos — if you use the Progress Photos feature (Pro plan), photos you upload are stored on our servers (Supabase) to enable tracking over time. You can delete these at any time.

We never share your photos with advertisers, data brokers, or any third party other than the AI processor listed in section 5.

Email address
Collected only if you voluntarily create an account or save your progress. Used solely to send you a passwordless sign-in link and to restore your account across devices. We do not send marketing emails without your explicit consent.

Skin analysis results and usage data
Your skin score, skin type, routine, notes and scan history are stored locally in your browser (localStorage). If you create an account, this data is synced to our secure servers (Supabase) to enable cross-device access. This data is not sold or shared.

Payment data
All payments are processed by Stripe, Inc. We never receive, see or store your card number, CVV or full billing details. Stripe acts as an independent data controller for payment data. See Stripe's privacy policy.

Technical data
We use Upstash Redis for rate limiting (IP-based, not stored beyond the rate limit window). We do not use advertising cookies, tracking pixels or third-party analytics.

3. Legal basis for processing (Article 6 and 9 GDPR)

• Photos: Explicit consent (Article 6(1)(a) and Article 9(2)(a)). You provide this via the consent screen before any upload. To withdraw consent and request deletion of your data, contact helloluxai@gmail.com. Your full-resolution photo is never stored on our servers. A compressed thumbnail may be saved on your device for scan history, and progress photos (Pro plan) are stored on our servers if you use that feature.
• Email / account data: Performance of a contract (Article 6(1)(b)) — necessary to provide sign-in and account features you requested.
• Payment processing: Performance of a contract (Article 6(1)(b)) and legal obligation (Article 6(1)(c)).
• Rate limiting (IP address): Legitimate interests (Article 6(1)(f)) — preventing abuse of the service.

4. Data retention

• Photos: Full-resolution analysis photos are never stored on our servers — deleted immediately after analysis. Scan thumbnails are stored locally on your device. Progress photos (Pro plan) are stored on our servers until you delete them or your account.
• Email and account data: Retained until you request deletion or delete your account.
• Skin history and results: Retained until you delete your account or request erasure.
• Payment records: Retained for 7 years as required by Spanish and EU tax law.
• IP addresses (rate limiting): Retained for a maximum of 24 hours.

5. Third-party processors

We share data with the following processors, all bound by GDPR-compliant data processing agreements:

• Google LLC (Gemini API) — photo processing for AI analysis. Transfers outside EU covered by Google's Standard Contractual Clauses.
• Supabase, Inc. — account and data storage. EU region available and used.
• Stripe, Inc. — payment processing. GDPR compliant, Privacy Shield successor framework.
• Resend, Inc. — transactional email (magic link sign-in). GDPR compliant.
• Upstash, Inc. — Redis rate limiting. IP addresses only, short retention.
• Amazon Associates Programme — product recommendation affiliate links. Clicking these may earn us a commission at no cost to you. Amazon may set cookies on their site. This does not influence our AI recommendations.

6. International transfers

Some processors are based in the United States. All transfers outside the EU/EEA are carried out under appropriate safeguards, including Standard Contractual Clauses (SCCs) as required by Chapter V GDPR.

7. Local storage and cookies

We use browser localStorage (not cookies) to store your skin history, quiz answers and settings on your device. This is for functionality only — we do not use it for tracking or advertising. Under Spain's LSSI (Ley de Servicios de la Sociedad de la Información), localStorage used solely for functionality does not require cookie consent. We do not use advertising cookies or third-party tracking cookies.

8. Children and minors

Our service is intended for users aged 13 and over. Under Spanish law (LOPDGDD Art. 7) and GDPR, users under 14 in Spain require verifiable parental consent. If you are aware of a child under 14 using this service without parental consent, contact us at helloluxai@gmail.com and we will delete their data immediately.

9. Your rights under GDPR

As a data subject you have the following rights, exercisable by emailing helloluxai@gmail.com:

• Right of access (Art. 15) — obtain a copy of your personal data
• Right to rectification (Art. 16) — correct inaccurate data
• Right to erasure (Art. 17) — request deletion of your data
• Right to restriction (Art. 18) — limit how we process your data
• Right to data portability (Art. 20) — receive your data in machine-readable format
• Right to object (Art. 21) — object to processing based on legitimate interests
• Right to withdraw consent (Art. 7(3)) — at any time, without affecting prior processing

We will respond to all requests within 30 days. We may need to verify your identity before processing requests.

10. Right to lodge a complaint

If you believe we have not handled your data correctly, you have the right to lodge a complaint with the Spanish data protection authority:

You may also complain to the data protection authority of your country of residence if you are based outside Spain.

11. Security

We implement appropriate technical and organisational measures to protect your data, including HTTPS encryption for all data in transit, secure cloud infrastructure with access controls, and minimal data collection by design.

12. Changes to this policy

We may update this policy. For significant changes, we will notify you by email (if you have an account) or by displaying a notice in the app. The version date at the top of this page indicates when it was last updated.

Contact

helloluxai@gmail.com
Lux AI — Spain, European Union