Legal

Privacy Policy

How Lumicrush collects, uses, and protects personal data.

Effective date: 19 March 2026

1. Overview

This Privacy Policy explains how Lumicrush collects, uses, stores, shares, and protects personal data when you use the Service.

For the purposes of this policy, Lumicrush, we, us, and our refer to the operator of the Lumicrush Service.

Lumicrush is an adult-only fictional AI roleplay service. It is not intended for anyone under 18.

2. The Personal Data We Collect

Depending on how you use the Service, we may collect:

A. Account and identity data

  • name
  • email address
  • profile image
  • account identifiers
  • login or authentication metadata

B. Profile and preference data

  • user profile details you choose to add
  • onboarding choices
  • saved preferences
  • conversation settings

C. Chat and content data

  • prompts, messages, reactions, and conversation history
  • media you upload or generate
  • character interactions and feature usage
  • reports, complaints, and moderation submissions

D. Technical and device data

  • IP address
  • browser type
  • device identifiers
  • operating system
  • session identifiers
  • timestamps
  • referring URLs
  • basic diagnostic and security logs

E. Safety and compliance data

  • reports of misuse
  • moderation flags
  • enforcement actions
  • records reasonably required for legal, safety, fraud, abuse, or regulatory compliance purposes

3. How We Collect Data

We collect personal data:

  • directly from you when you use the Service;
  • from your chosen authentication provider;
  • automatically from your device and browser through cookies, logs, and similar technologies; and
  • from complaints, safety reports, or legal requests we receive.

4. How We Use Personal Data

We use personal data to:

  • provide, operate, and secure the Service;
  • authenticate users and manage sessions;
  • display conversation history and user settings;
  • generate AI responses, images, and related features;
  • maintain and improve performance, reliability, and product quality;
  • detect, investigate, prevent, and respond to abuse, fraud, illegal content, and security incidents;
  • enforce our Terms and policies;
  • respond to user requests, support issues, and complaints;
  • comply with legal and regulatory obligations; and
  • establish, exercise, or defend legal claims.

We may also use de-identified or aggregated data for analytics, service improvement, and business planning where lawful.

5. Our Lawful Bases

Under UK GDPR, we generally rely on one or more of the following lawful bases:

  • Contract: where processing is necessary to provide the Service you ask us to provide.
  • Legitimate interests: where processing is necessary for running, securing, moderating, improving, and defending the Service, provided those interests are not overridden by your rights.
  • Legal obligation: where we need to comply with applicable law, regulation, regulator requests, or lawful orders.
  • Consent: where consent is legally required, such as for certain non-essential cookies or similar technologies.

If we rely on consent, you can withdraw it at any time, although this will not affect processing already carried out lawfully before withdrawal.

6. Special Position of Chat Content

Chat content may contain sensitive, intimate, or explicit material. You should not share personal data you do not want processed or retained.

We process chat content because it is necessary to provide the Service you requested, to maintain conversation functionality, and to protect the Service and others from misuse, illegal content, or safety risks.

7. Sharing Personal Data

We may share personal data with:

  • hosting, infrastructure, and security providers;
  • authentication providers;
  • AI model and content-generation providers;
  • analytics, diagnostics, and communications providers, if used;
  • professional advisers, insurers, auditors, and legal representatives;
  • regulators, law enforcement, courts, or public authorities where required or reasonably necessary; and
  • a buyer, investor, or successor in connection with a merger, acquisition, restructuring, or asset sale.

We do not sell your personal data in the ordinary meaning of that term.

8. International Transfers

Some providers we use may process personal data outside the UK or EEA. Where we transfer personal data internationally, we will take steps intended to ensure an appropriate level of protection, such as:

  • adequacy regulations;
  • standard contractual clauses or equivalent safeguards; or
  • another lawful transfer mechanism recognised under applicable data protection law.

9. Retention

We keep personal data only for as long as reasonably necessary for the purposes described in this policy, including to provide the Service, maintain records, enforce our rights, resolve disputes, and comply with legal obligations.

Retention periods may vary depending on the type of data, the sensitivity of the data, the risk involved, and legal or operational needs.

We may retain certain records for longer where required for safety, fraud prevention, abuse prevention, legal compliance, or evidence preservation.

10. Cookies and Similar Technologies

We use cookies and similar technologies to operate, secure, and remember your session and preferences. If we introduce non-essential cookies, we will seek any consent required by law.

See the Cookie Policy for more detail.

11. Your Rights

Depending on the law that applies to you, you may have the right to:

  • access your personal data;
  • ask us to correct inaccurate personal data;
  • ask us to delete personal data;
  • ask us to restrict processing;
  • object to certain processing;
  • request portability of certain personal data;
  • withdraw consent where processing is based on consent; and
  • complain to a supervisory authority.

To exercise your rights, contact help@lumicrush.com.

We may need to verify your identity before responding. We may also refuse or limit a request where the law allows us to do so.

12. Complaints

If you are in the UK and believe we have mishandled your personal data, you can complain to the Information Commissioner's Office:

https://ico.org.uk

If you are in the EEA, you may also have the right to complain to your local data protection authority.

13. Automated Processing

Lumicrush uses automated systems, including AI systems and moderation tools, as part of the Service. However, we do not intend to make solely automated decisions about you that have legal or similarly significant effects without an appropriate lawful basis and any safeguards required by law.

14. Security

We use technical and organisational measures intended to protect personal data against unauthorised access, loss, misuse, alteration, or disclosure. No internet service or storage system can be guaranteed to be completely secure.

15. Children

Lumicrush is not intended for children. We do not knowingly permit under-18 use. If we learn that a child has used the Service or that under-18 personal data has been submitted to us, we may remove the relevant data and restrict the associated account or access.

16. Changes to This Policy

We may update this Privacy Policy from time to time. The latest version will be posted with the revised effective date.

17. Contact

For privacy questions or rights requests, contact:

help@lumicrush.com