Privacy & Cookie Policy

BOZAN LUMERA LTD ("LUMÉ", "we", "us"), registered in England and Wales under company number 17479474 with its registered office at 71-75 Shelton Street, Covent Garden, London, WC2H 9JQ, United Kingdom, is the data controller for LUMÉ. This policy explains what personal data we collect, why, and how it's protected, in line with the UK GDPR and Data Protection Act 2018.

1. What we collect

Account details (email, name), photos you upload for face analysis and virtual try-on, beauty preferences you provide, and usage data (which features you use, subscription status). If you subscribe to Pro or Plus, Stripe processes your payment details directly — we never see or store your full card number.

2. Your photos

Uploaded selfies are stored privately and are never made public or shown to other users. A selfie is biometric data, so we only process it with your explicit consent, asked for separately before your first upload. It is used only to provide the Service to you (analyzing skin tone, generating looks, virtual try-on); the face points used for try-on are computed on your device. You can withdraw consent in Settings at any time, which deletes your photos and the analyses made from them. See our biometric data notice.

3. How we use your data

To provide and improve the Service, including passing your photos and preferences to our AI providers (Anthropic) solely to generate your personalized results — never to train their models on your data. To process payments (via Stripe) and communicate with you about your account.

4. Sharing

We share data only with the service providers needed to run LUMÉ — our hosting and database provider, our AI provider, and Stripe for payments — each under their own data protection obligations. We do not sell your personal data.

5. Cookies

LUMÉ always uses strictly necessary cookies (to keep you signed in and remember your settings). With your permission only — via the cookie banner, changeable any time in Settings — we also use the Meta and TikTok advertising pixels to measure which ads bring people to LUMÉ (page views, sign-up, checkout and purchase events), and we remember which campaign you arrived from. When you buy, the purchase is also reported to Meta from our server (its Conversions API) with technical identifiers only: Meta's own browser cookie IDs, your IP address and browser type, and a one-way hashed account number. Meta never receives your photos, your face analysis, your name or your email. If you choose "Only essential", none of this happens: no advertising cookies are set and nothing is sent to Meta.

6. Your rights

You can access, correct, or delete your personal data at any time — deleting your account from Settings permanently removes your profile, looks, and uploaded photos. You can also contact us at lumebeautybozan@gmail.com to exercise any UK GDPR right (access, erasure, portability, objection).

7. Data retention

We retain your data for as long as your account is active. If you delete your account, your data is permanently removed, except where we're required to retain certain records (e.g. billing history) for legal or tax purposes.

8. Contact

Questions about this policy? Reach us at lumebeautybozan@gmail.com or see our Contact page. You also have the right to lodge a complaint with the UK Information Commissioner's Office (ico.org.uk).