Datenschutzerklärung

01Who we are

This Privacy Policy explains how Luma AI Labs, LLC (“we”, “us”) collects, uses and protects personal data when you use PopNow, including the website at popnow.ai and related services (the “Service”).

Luma AI Labs, LLC is the controller of your personal data. Our address is 2261 Market Street STE 72933, San Francisco, CA 94114, United States. For anything about privacy, email support@popnow.ai with “Privacy” in the subject line.

02What we collect

• Account data: you sign in with Google or GitHub. We receive the basic profile information that provider shares with us: your name or username, email address, profile picture and an account ID. We never receive your Google or GitHub password.
• Your content: the prompts you write, the images, videos, audio and other files you upload, the results we generate for you, and the settings you choose.
• Purchase data: Paddle processes your payment. We receive your name, email address, country, the pack you bought, the amount and tax paid, and a transaction ID. We never receive or store your full card number.
• Usage and device data: IP address, browser and device type, operating system, language, the pages and features you use, the generations you run and the credits they use, timestamps and error logs.
• Communications: messages you send to our support team, feedback and survey answers.
• Cookies and similar technologies: see Cookies below.

03How we use it, and our legal bases

We use personal data only for the purposes below. If you are in the European Economic Area (EEA) or the United Kingdom, the last column shows the legal basis we rely on under the GDPR.

We do not use your prompts, uploads or results to train AI models.

Automated filters may block a prompt or upload that appears to break our Terms. If you think a filter got it wrong, contact us and a person will review it.

04Who we share it with

We share personal data only with the following recipients, and only as much as each one needs:

• Paddle. Paddle.com Market Limited and its affiliates are the Merchant of Record for our orders. Paddle processes your order, payment, taxes, invoices, refunds and fraud checks. Paddle is an independent controller for the data it collects at checkout, under Paddle’s Privacy Policy.
• AI model providers. To generate your results, we send your prompts and the files you attach to the AI model providers that run the model you choose. They receive only what is needed to produce your result.
• Service providers. Companies that host and run PopNow for us, such as cloud hosting, databases, file storage and delivery, email delivery, customer support, error monitoring and security. They process data on our behalf and under contract.
• Sign-in providers: Google or GitHub, whichever you use to sign in.
• Authorities and others where the law requires it, or where needed to protect the rights, property and safety of our users, the public or us. This includes reporting child sexual abuse material to the National Center for Missing & Exploited Children.
• A buyer or successor, if PopNow is involved in a merger, acquisition or sale of assets. We’ll tell you before your data becomes subject to a different privacy policy.

We don’t sell your personal data, and we don’t share it for cross-context behavioral advertising.

05International transfers

We are based in the United States, and our service providers may process data in the United States and other countries. When we transfer personal data out of the EEA, the United Kingdom or Switzerland to a country that doesn’t have an adequacy decision, we use safeguards such as the European Commission’s Standard Contractual Clauses and the UK International Data Transfer Addendum. You can ask us for a copy of the relevant safeguards.

06How long we keep it

• Account data: while your account is open. We delete it within 30 days after you close your account.
• Your content: we keep your prompts, uploads and results until you delete them or close your account. Items you delete go to your Trash, where you can restore them for 30 days; after that, they are permanently deleted from our live systems. If you close your account, your content is deleted from our live systems within 30 days. Deleted content is removed from backups within 90 days.
• Purchase and tax records: for as long as tax and accounting laws require, usually up to 10 years.
• Usage, security and log data: up to 12 months.
• Support conversations: up to 3 years after the conversation ends.

We may keep specific data longer when we need it to comply with the law, investigate abuse or a security incident, resolve a dispute or enforce our agreements.

07Your rights

Wherever you live, you can ask us to access, correct or delete your personal data and to give you a copy of your content. You can stop marketing emails at any time with the unsubscribe link.

If you are in the EEA or the United Kingdom

Under the GDPR and the UK GDPR, you have the right to:

• access your personal data and get a copy of it;
• have inaccurate data corrected;
• have your data erased;
• restrict how we use your data;
• receive your data in a structured, machine-readable format and have it sent to another company (portability);
• object to processing based on our legitimate interests, and to direct marketing at any time;
• withdraw your consent at any time, without affecting processing that happened before;
• not be subject to decisions based solely on automated processing that have legal or similarly significant effects on you; and
• complain to a data protection authority, in particular in the country where you live or work. In the United Kingdom, this is the Information Commissioner’s Office (ICO).

If you live in a US state with a privacy law

Residents of California and other states with privacy laws may have the right to know what personal data we collect and how we use it, to access, correct and delete it, and to opt out of its sale or sharing (we don’t sell or share it). We won’t treat you differently for using these rights. You may use an authorized agent to make a request for you.

How to make a request

Email support@popnow.ai from the address on your account. We may need to confirm your identity before we act. We reply within one month. If a request is complex or we receive many requests, we may extend this by up to two more months, and we’ll tell you why within the first month.

08Security

We protect your data with encryption in transit (HTTPS), encryption of sensitive data at rest, access controls that limit which team members can see personal data, and monitoring of our systems. No service is perfectly secure, so please keep your sign-in details safe and tell us right away if you notice anything unusual. If a breach affects your personal data, we’ll notify you and the authorities as the law requires.

09Cookies

We use cookies and similar technologies for two things:

• Strictly necessary: keeping you signed in, remembering your settings, protecting against fraud and abuse, and making checkout work. These don’t need your consent.
• Analytics: understanding how PopNow is used so we can improve it. Where the law requires it, we use these only with your consent, and you can change your choice at any time.

We don’t use advertising cookies to follow you around other websites. Paddle sets its own cookies during checkout, which are covered by Paddle’s Privacy Policy. You can also block or delete cookies in your browser settings, though some parts of PopNow won’t work without the necessary ones.

10Children

PopNow is not meant for children under 13, and we don’t knowingly collect personal data from them. Teenagers who are under the age of majority where they live may use PopNow only with a parent’s or guardian’s permission. If you believe a child under 13 has given us personal data, contact us and we’ll delete it.

11Changes to this policy

When we update this policy, we’ll post the new version here and change the date at the top. If a change is significant, we’ll also tell you by email or in the Service before it takes effect.

12Contact us

Questions about your data or this policy? Get in touch: