This policy says what Luala keeps about you, why, who else handles it and for how long. It covers luala.app and lua.la.

1. Who is responsible

Die Digitalen GmbH, Rautistrasse 60, 8048 Zürich, Switzerland, is responsible for your data under the Swiss Federal Act on Data Protection and, where it applies, the EU General Data Protection Regulation. Questions and requests go to support@lua.la.

2. What we keep

• Your account: the name, email address and account ID that Apple or Google send when you sign in, your language, and when you signed up and last visited.
• Your selfies: the photos you upload, and what the automatic check found in each one (whether it is allowed, and the faces in it).
• Your photos: every photo made for you, what it was made from (pack, options, the edit instructions you type) and what it cost.
• Your consents: for every upload, the version of the terms you agreed to, the time and your language.
• Purchases and credits: what you bought, when, for how much, and every credit granted, spent or refunded. Card details never reach us; Link handles them.
• Settings: whether the daily photo is on.
• Technical data: your IP address, used to limit sign-ups and requests and to keep Luala secure, and the server logs our host keeps.
• Reports: what you write in a report, and your name and email if you give them.
• Analytics, only if you agree in the cookie banner (section 8).

3. Why we use it

• To provide Luala (the contract with you): your account, making and showing your photos, credits, billing, support, and the emails Luala sends (renewal reminders, the daily photo you turned on, notices about your account).
• Your selfies, with your explicit consent, given at every upload. Your face is personal data that needs particular care, so we use the selfies for nothing but making your photos. You withdraw consent by deleting them.
• To prevent abuse and keep Luala safe (our legitimate interest): checking selfies, rate limits, reviewing reports, and remembering banned accounts.
• To meet legal duties: keeping accounting records, and answering authorities and courts.
• To understand how Luala is used, only with your consent.

We never use your selfies or your photos to train AI models, and we never sell your data.

4. Who else handles it

These companies process data for us, under contracts that bind them to our instructions:

Google doesn't use what Luala sends through the paid Gemini API to train its models. fal keeps neither the photo we send nor the result once the job is done.

Link (Stripe) sells credits and plans to you as reseller, so it handles your payment details as a controller in its own right, under Link's privacy policy. Apple and Google sign you in under their own policies.

Some of these companies are in the USA. Where a country doesn't protect data to the Swiss or EU standard, transfers rest on the European Commission's standard contractual clauses, as recognised in Switzerland, or on the companies' certification under the Data Privacy Framework.

5. How long we keep it

• Selfies and photos: until you delete them. After 24 months without a sign-in we delete your account; we email you 30 days before. An account with a running plan is never deleted for inactivity.
• When you delete your account, it goes at once. Copies in backups are gone within 30 days.
• What stays after a deletion: your purchases, credit history and the record of each photo made (without the image or the instructions you typed), because accounting law makes us keep them for 10 years; your upload consents; and a one-way hash of your sign-in ID and email, so the free photos are given once per person and a ban holds.
• A copy you ask for in Settings is kept for 7 days.
• A banned account: we keep a copy of its photos, selfies and account history for one year, only as evidence in case an authority or a court asks for it. We keep it longer only while a legal case needs it.

6. Automatic checks

Every selfie is checked automatically when you save it. One with nudity or sexual content is refused and deleted. A person decides every freeze, removal and ban, and you can ask for any decision to be looked at again.

7. Your rights

You can:

• get a copy of your photos, selfies and account history, in Settings ("Your data");
• have your data deleted, by deleting single photos, your selfies or your whole account in Settings;
• have wrong data corrected: your name and email come from Apple or Google, so change them there;
• object to a use based on our legitimate interest, and withdraw a consent at any time;
• complain to the Swiss Federal Data Protection and Information Commissioner (FDPIC), or to the data protection authority where you live in the EU.

For anything not in Settings, write to support@lua.la.

8. Cookies

Signing in sets one cookie that keeps you signed in for up to 14 days. Luala doesn't work without it. Analytics cookies are set only if you agree in the cookie banner, and you can change your choice there at any time.

9. Changes

When this policy changes, the new version is published here with the date it takes effect, and earlier versions stay readable.