Privacy policy

Who we are

The studio is operated under the trade name LumipixLabs by Yash Patel (“we”, “us”), with its registered office at 1, Dungarpura, Shri Amirgadh, Banaskantha, Gujarat 385130, India. For the Digital Personal Data Protection Act, 2023, that legal entity is the data fiduciary for account and photograph data processed in the studio.

The grievance officer is Yash Patel. You can reach that officer at help@lumipixlabs.com or at the phone number on the contact page. GSTIN: 24EJAPP0985E1Z9.

Information we collect

We collect only what the studio needs to run an account, keep your projects, and record credit use.

• Account data: email address, display name, mobile number, and a salted hash of your password. We ask for the mobile number when you create the account. We do not store the password itself.
• Session data: a session record and a cookie named so the browser stays signed in. Signing out deletes that session.
• Photographs: the files you upload and the edited versions the studio saves. These are stored as private objects, not on a public gallery.
• Edit instructions: the text of your prompt, pin positions, the edit type, credit cost, status, and error information if a job fails.
• Project organisation: project names, folder names, and version history.
• Credit ledger: balance, reservations, and committed charges for completed edits.
• Voice input: if you record an instruction, the audio is sent for transcription and the text is placed in the prompt field. The audio file is not saved.
• Support messages: whatever you send to the support email, including a payment reference you choose to include.

Google Ads measures visits and a completed credit purchase. We do not buy marketing lists. We do not ask for Aadhaar, PAN, or a government ID to use the studio.

Payments

Credit packs are priced in INR on the pricing page. Cashfree Payments collects the card or UPI details and tells us whether the payment succeeded. Checkout does not ask for a mobile number. We store the fact of the purchase, the pack, the amount, the mobile number already on your account, and a payment reference so we can add credits and handle a refund. We do not store your full card number, expiry, or CVV on LumipixLabs servers.

Do not type a card number into a support email. Enter card, UPI, or netbanking details only on the Cashfree checkout screen.

How we use information

• To create and secure your account, and to show you your projects and credit balance.
• To run the edit you asked for, including sending the photograph and the instruction to the image provider that generates the result.
• To reserve and release credits, including returning credits when a generation fails.
• To deliver a purchased pack into the account that paid, and to investigate a duplicate charge or a missing balance.
• To answer a support or grievance request, and to keep a record of that request.
• To enforce the terms, prevent abuse, and respond to a lawful request from a competent authority.

We do not sell personal data. We do not use your photographs to advertise the studio, and we do not put them in a public portfolio unless you publish the file yourself.

Photographs and AI processing

An edit cannot run on our servers alone. The source image and your instruction are sent to the configured image provider so it can return a new image. A voice note is sent to a transcription service and is not kept after the text is returned. Those providers process the content to perform the request. Their own terms apply to that processing step.

You should upload only photographs you have a right to use. Do not upload a photograph of someone if you do not have a lawful reason to edit it. Prompts and images may be processed outside India by the provider. That transfer is limited to performing the edit or transcription you started.

Cookies

The studio sets a first-party session cookie, lumipix_session, to recognise the signed-in account. It is required for projects, uploads, and the credit balance. Google Ads may set its own cookies so a completed purchase can be matched to an ad click. You can sign out, or delete cookies in your browser. Deleting the session cookie ends the session in that browser.

Who we share data with

• Cloudflare, which hosts the application, the database, and the private file storage.
• The image and transcription provider used to perform an edit or a voice prompt.
• The payment gateway, when you buy a pack, for the payment and any refund.
• Google, for advertising measurement: the pages you visit, and for a completed purchase the order reference, the amount, and the currency. Photographs are not sent to Google.
• A professional adviser or authority when we must disclose information to comply with law, or to protect the studio, a customer, or another person from harm.

We do not share your photographs with other customers.

How long we keep it

Account records, the credit ledger, and project metadata stay while the account is open. Photographs and edited versions stay until you delete the project. Deleting a project removes the image files we hold for it. Some operational database rows, such as the fact that a job ran and how many credits it used, can remain after the file is gone so the ledger stays consistent.

There is no button in the studio that deletes the whole account. To close an account and ask for erasure of personal data, email help@lumipixlabs.com from the account address. We will delete or anonymise the account data we are not required to keep. We may retain a payment and credit record for as long as tax, accounting, or dispute rules require it. Voice audio is not retained. Support emails are kept long enough to resolve the request and to show what was decided.

Security

Passwords are stored as salted hashes. Photographs are stored in a private bucket and are served only to the signed-in owner. No method of transmission or storage is perfect. Use a unique password, and do not share your session. Tell us at help@lumipixlabs.com if you believe your account has been accessed without permission.

Your rights

Subject to the Digital Personal Data Protection Act, 2023 and the Information Technology Act, 2000, including the rules on intermediaries and grievance redressal, you may ask us to:

• Confirm whether we hold personal data about you, and for a summary of what we hold.
• Correct your display name or email. You can change the display name in the studio account page. An email change is handled through support so we do not attach the account to the wrong person.
• Erase personal data, or nominate someone to exercise your rights, by writing to the grievance officer.
• Withdraw consent where processing is based on consent. If you withdraw consent to process a photograph, delete the project or ask us to delete it. Credits already spent on a completed edit are not refunded for that reason. The refund policy explains the cases we do refund.
• Make a complaint to the grievance officer. If you are not satisfied, you may approach the Data Protection Board of India once that route is available for your complaint, or any other authority that has jurisdiction.

We may need to confirm that the request comes from the account holder. We will not ask you to re-upload a full client gallery in order to identify the account.

Children

The studio is for people who are 18 or older. We do not knowingly create accounts for children. If you believe a child has given us personal data, email help@lumipixlabs.com and we will delete the account.

Changes to this policy

If we change this policy, we will update the date at the top of the page. Continued use of the studio after the new date means the updated policy applies to new uploads and new purchases. A change does not reduce a deletion request you have already sent.

Contact

Privacy requests go to help@lumipixlabs.com, addressed to Yash Patel. The postal address and phone number are on the contact page.