loralume
Legal

Privacy Policy

Effective July 5, 2026

This Privacy Policy describes how Loralume (“we”, “us”, “our”) collects, uses, discloses, and protects your personal information when you use our AI portrait service (the “Service”).

1. Information We Collect

1.1 Information you provide

  • Account information: email address, name (optional), password (hashed with bcrypt).
  • Uploaded photographs: the images you provide for training and any reference photos for verifying your person or pet.
  • Face-verification scans: a short video capture used to confirm the physical presence of the person at the time of consent. Face-scan frames are stored temporarily for the verification period.
  • Payment information: processed directly by our payment processor (currently Stripe). We do not store your full card details on our servers. We retain the last-four digits, brand, and payment intent identifier for reconciliation and refund purposes.
  • Communications: messages you send to us via support channels.

1.2 Information collected automatically

  • Usage data: pages visited, actions taken, order state transitions.
  • Device data: IP address, browser type, operating system, referring URL.
  • Cookies: we use session cookies to keep you signed in. We do not use third-party advertising cookies.

1.3 Information derived by our systems

  • Content-moderation results: classifier verdicts and reasoning traces from our automated safety system for each uploaded image.
  • Facial embeddings: mathematical representations of faces used during training and identity verification of generated images. Embeddings are not shared and are deleted when the underlying trained portrait is deleted.
  • Trained AI portrait model files: the personalized AI model produced from your uploads.

2. How We Use Your Information

  • Deliver the Service — train and generate portraits you order.
  • Verify the age and identity of human subjects before training.
  • Detect, prevent, and respond to prohibited content, including CSAM (reported to NCMEC as required by law).
  • Process payments and issue refunds.
  • Communicate with you about your orders, account, and product updates.
  • Enforce our Terms of Service and comply with legal obligations.
  • Improve the safety, reliability, and quality of the Service in aggregate, anonymized form.

We do not use your uploaded photographs to train models for any other customer. Your trained AI portrait model is trained only on your images, and the trained model is delivered to you.

3. How We Share Your Information

We share personal information only in the following limited circumstances:

  • Payment processors (Stripe) to process card payments and refunds.
  • Email service providers (transactional email — order confirmations, delivery notifications).
  • Cloud infrastructure providers (limited to hosting and processing, under confidentiality obligations).
  • Content-moderation partners — for CSAM detection, we may submit content hashes to Microsoft PhotoDNA (or an equivalent industry service). We report confirmed CSAM to NCMEC as required by law.
  • Law enforcement in response to valid legal process, or when we believe disclosure is necessary to prevent imminent harm.
  • Successors in the event of merger, acquisition, or sale of substantially all our assets, subject to equivalent privacy protections.

We do not sell your personal information, and we do not share it with advertisers.

4. Data Retention

We retain personal information only as long as necessary for the purposes for which it was collected.

  • Uploaded photographs: retained for 90 days after order delivery to support refund and dispute resolution, then permanently deleted from our systems.
  • Face-verification scans: retained for 90 days, then deleted.
  • Generated images: retained in your Library until you delete them or your account is closed.
  • Trained AI portrait model files: retained in your Library until you delete them or your account is closed.
  • Account records and payment metadata: retained for 7 years to comply with financial recordkeeping obligations.
  • CSAM-related evidence: retained as required by 18 U.S.C. § 2258A and shared with NCMEC.

5. Your Rights

Depending on your jurisdiction, you may have the following rights regarding your personal information:

  • Access: request a copy of the personal data we hold about you.
  • Correction: request that we correct inaccurate data.
  • Deletion: request that we delete your account and associated data.
  • Portability: receive your data in a portable format.
  • Opt-out: opt out of marketing communications.
  • Non-discrimination: we will not discriminate against you for exercising any of these rights.

To exercise any of these rights, email privacy@loralume.com. We aim to respond within 30 days.

Note: deletion requests do not apply to CSAM-related evidence that we are legally required to preserve.

6. Security

We implement industry-standard security controls, including encryption in transit (TLS), encryption at rest for uploaded content, access controls for personnel, and audit logging. No system is perfectly secure; if we become aware of a data breach affecting your information, we will notify you as required by applicable law.

7. International Transfers

Loralume operates primarily in the United States. If you are located outside the U.S., your information will be transferred to and processed in the United States. By using the Service, you consent to this transfer.

8. Children

The Service is not intended for use by anyone under the age of 18. We do not knowingly collect account-holder information from children. If you believe a child has provided us with personal information, contact privacy@loralume.com and we will delete it.

Uploaded photographs of the account holder's own minor children (subject to age verification and family-safe theme restrictions) are treated with heightened protection and never used with theme packs designated for adult subjects.

9. California Privacy Rights (CCPA/CPRA)

If you are a California resident, you have the specific rights described in Section 5 above, plus:

  • The right to know what personal information we have collected and shared.
  • The right to opt out of the sale or sharing of personal information — although we do not sell or share personal information for advertising purposes.
  • The right to limit the use of “sensitive personal information” (biometric identifiers, precise geolocation).

10. European Privacy Rights (GDPR)

If you are in the European Economic Area (EEA), United Kingdom, or Switzerland, you have the rights described in Section 5 above. Our lawful basis for processing is (a) your consent (for uploaded photos and face scans), (b) contract performance (to deliver the ordered service), and (c) legitimate interest (safety and fraud prevention).

11. Changes to This Policy

We may update this Privacy Policy from time to time. We will notify you of material changes via email or in-app notice. The “Effective” date at the top reflects the most recent revision.

12. Contact

Questions about this Privacy Policy or your data: