This policy says what Luala keeps about you, why, who else handles it and for how long. It covers luala.app and lua.la.

1. Who is responsible

Die Digitalen GmbH, Rautistrasse 60, 8048 Zürich, Switzerland, is responsible for your data under the Swiss Federal Act on Data Protection and, where it applies, the EU General Data Protection Regulation. Questions and requests go to privacy@lua.la.

2. What we keep

• Your account: the name, email address and account ID that Apple or Google send when you sign in, your language, and when you signed up and last visited.
• Your selfies: the photos you upload, and what the automatic check found in each one (whether it is allowed, and the faces in it).
• Your photos: every photo made for you, what it was made from (pack, options, the edit instructions you type) and what it cost.
• Your consents: for every upload, the version of the terms you agreed to, the time and your language.
• Purchases and credits: what you bought, when, for how much, and every credit granted, spent or refunded. Card details never reach us; Link handles them.
• Settings: whether the daily photo is on.
• Technical data: your IP address, used to limit sign-ups and requests and to keep Luala secure, and the server logs our host keeps.
• Reports: when you report a photo, what you write in the report and your name and email. A report about someone under 18 can be made without them. We don't keep the IP address it came from.
• Where you came from: when the link that brought you to Luala carries an ad's tags (UTM tags) or an ad click ID (Google's gclid, gbraid and wbraid, Meta's fbclid, TikTok's ttclid), we keep them with the account you then create, whatever you choose in the cookie banner. Signing in to an account you already have keeps none.
• Analytics and advertising, only if you agree in the cookie banner (section 8).

3. Why we use it

• To provide Luala (the contract with you): your account, making and showing your photos, credits, billing, support, and the emails Luala sends (renewal reminders, the daily photo you turned on, notices about your account).
• Your selfies, with your explicit consent, given at every upload. Your face is personal data that needs particular care, so we use the selfies for nothing but making your photos. You withdraw consent by deleting them.
• To prevent abuse and keep Luala safe (our legitimate interest): checking selfies, rate limits, reviewing reports, and remembering banned accounts.
• To know which ads work (our legitimate interest): where an account came from tells us which ad or campaign brings people who go on to use and pay for Luala, so we can stop paying for the rest. We keep it on our servers and don't send it to Google, Meta, TikTok or anyone else. (If you allow analytics, Google Analytics sees the address of the page you land on, tags included.)
• To meet legal duties: keeping accounting records, and answering authorities and courts.
• To understand how Luala is used, and to let Google measure Luala's ads, only with your consent.

We never use your selfies or your photos to train AI models, and we never sell your data.

4. Who else handles it

These companies process data for us, under contracts that bind them to our instructions:

Google doesn't use what Luala sends through the paid Gemini API to train its models. fal keeps neither the photo we send nor the result once the job is done.

Link (Stripe) sells credits and plans to you as reseller, so it handles your payment details as a controller in its own right, under Link's privacy policy. Apple and Google sign you in under their own policies.

Some of these companies are in the USA. Where a country doesn't protect data to the Swiss or EU standard, transfers rest on the European Commission's standard contractual clauses, as recognised in Switzerland, or on the companies' certification under the Data Privacy Framework.

5. How long we keep it

• Selfies and photos: until you delete them. After 24 months without a sign-in we delete your account; we email you 30 days before. An account with a running plan is never deleted for inactivity.
• When you delete your account, it goes at once. Copies in backups are gone within 30 days.
• What stays after a deletion: your purchases, credit history and the record of each photo made (without the image or the instructions you typed), because accounting law makes us keep them for 10 years; your upload consents; and a one-way hash of your sign-in ID and email, so the free photos are given once per person and a ban holds.
• Where you came from: as long as your account. Before you sign up, it waits in the session cookie (section 8), which expires 14 days after your last visit at the latest.
• A copy you ask for in Settings is kept for 7 days.
• When you withdraw a consent, we keep Google Analytics' ID for that browser for 30 days, so a checkout already open in it doesn't report its purchase to Google. Then we delete it.
• A report you made: your name, your email, the link and what you wrote, for one year after we close the report. Then we delete them, and keep only the reason and our decision.
• A banned account: we keep a copy of its photos, selfies and account history for one year, only as evidence in case an authority or a court asks for it. We keep it longer only while a legal case needs it.

6. Automatic checks

Every selfie is checked automatically when you save it. One with nudity or sexual content is refused and deleted. A person decides every freeze, removal and ban, and you can ask for any decision to be looked at again.

7. Your rights

You can:

• get a copy of your photos, selfies and account history, in Settings ("Your data");
• have your data deleted, by deleting single photos, your selfies or your whole account in Settings;
• have wrong data corrected: your name and email come from Apple or Google, so change them there;
• object to a use based on our legitimate interest, such as keeping where you came from (write to us and we delete it), and withdraw a consent at any time;
• complain to the Swiss Federal Data Protection and Information Commissioner (FDPIC), or to the data protection authority where you live in the EU.

For anything not in Settings, write to privacy@lua.la.

8. Cookies and browser storage

These don't wait for the cookie banner:

• _luala_key, the session cookie, set on your first visit to luala.app or lua.la. Luala doesn't work without it: it protects forms against forgery, remembers your language, holds analytics events until you have made your choice and, on luala.app, keeps you signed in. Before you sign in there, it also holds the page to return to and, whatever you choose in the banner, where you came from (section 2); on lua.la, where you came from rides only in the links to luala.app. It expires 14 days after your last visit at the latest.
• _luala_oauth, while Apple or Google signs you in, or confirms it is you before your account is deleted: it carries that sign-in across, with the page to return to and where you came from, and goes within 10 minutes.
• luala_consent, your choice in the cookie banner and when you made it. After six months we ask again.
• luala_ga_withdrawn, in your browser's storage: when you withdraw a consent, it holds the withdrawal and Google Analytics' ID for your browser until they have reached us. On luala.app, signed out, that is the next time you sign in.
• Phoenix's entries (names starting with phx:), in your browser's storage: the framework Luala runs on keeps a page's place in your history and how it last connected. They hold nothing about you.

These only if you agree in the cookie banner:

• Analytics: Google Analytics' cookies (_ga and _ga_ followed by an ID), which tell visits apart and last up to two years, and luala_ga_sent, in your browser's storage, which keeps the same event from being counted twice.
• Advertising, together with analytics: lets Google use your visit to measure Luala's ads on Google and to show you Luala's ads, with the ad cookies and browser-storage entries Google's tag may set on Luala's sites (names starting with _gcl_ or _gac_), which last up to 90 days. Google may also set cookies on its own domains, such as doubleclick.net, under Google's privacy policy. Luala has no other ad network's tags.

You can change your choice at any time under "Cookie settings", at the foot of lua.la's pages and in Luala's Settings. Turning analytics off deletes every analytics and advertising cookie and entry above on Luala's sites, and turning advertising off deletes the advertising ones. Those on Google's own domains only Google, or your browser, can delete.

9. Changes

When this policy changes, the new version is published here with the date it takes effect, and earlier versions stay readable.