Privacy policy

This privacy policy covers the website lumioo.me and the lumioo app at app.lumioo.me. It explains which data we process, why, for how long, and what rights you have.

In short: your photos and videos are stored on servers in Germany. We do not analyse them for any purpose of ours, do not pass them on and do not train anything with them. There is no tracking, no advertising and no third-party analytics. Every provider that processes data on our behalf is based in the EU or Switzerland.

1. Controller

42ideas UG (haftungsbeschränkt) Ehrenstr. 66 50672 Köln Germany

Represented by the managing director Daniel Dormann

Contact for privacy matters: privacy@lumioo.me

We have not appointed a data protection officer because the legal requirements for one are not met.

2. Principles

• No tracking. Neither the website nor the app uses analytics, advertising or social media services. We load no fonts or scripts from third parties. The one exception is the payment page (section 7).
• Only necessary cookies. We set only cookies that are required for operation (§ 25 (2) TDDDG), which is why there is no cookie banner. The individual sections say which ones.
• Image analysis stays with us. Automatic tags and face recognition run exclusively on our own servers. No image leaves our infrastructure for that.
• No automated decisions in the sense of Art. 22 GDPR.
• No transfers to third countries. All processors are based in the EU or Switzerland. Payments are handled by Paddle in the United Kingdom, which is covered by an EU adequacy decision.

3. Website (lumioo.me)

Server logs

When you visit the website our server automatically records the IP address, time, page requested, browser identifier (user agent) and referring page. We use these logs to run the site, find errors, protect against abuse and see how many people visit. The legal basis is Art. 6 (1) (f) GDPR (legitimate interest in secure operation). Raw logs with IP addresses are deleted after 14 days. Aggregated numbers without IP addresses (page views per day, referring domain) are kept indefinitely.

Waiting list

If you join the waiting list we store your email address, the time and a confirmation token. We send you an email with a confirmation link (double opt-in); the entry only counts once you click it. The purpose is to send you an invitation as soon as we can take you on. The legal basis is your consent (Art. 6 (1) (a) GDPR). Unconfirmed entries are deleted after 7 days, confirmed ones once the invitation has been sent or when you ask us to delete them. You can withdraw consent at any time by email to privacy@lumioo.me.

4. App: account and access

Registration and login

For an account we store your email address, a hash of your password (never the password itself), your language, the invitation code you redeemed, the time you accepted the terms, and your account settings. After registration you confirm your address with a code sent by email. Codes for login and email change are valid for 10 minutes and deleted afterwards. The legal basis is the user contract (Art. 6 (1) (b) GDPR). The data is kept until you delete your account.

Session cookie

After login we set a session cookie (httpOnly, HTTPS only). It keeps you signed in and is technically necessary for that (§ 25 (2) TDDDG, Art. 6 (1) (b) GDPR). With the session we also store the IP address and browser identifier to secure the login. After a password change we sign out all other devices.

Server logs and abuse protection

As on the website, the app server stores the IP address, time, path and browser identifier for 14 days (Art. 6 (1) (f) GDPR). To protect against abuse we count requests per IP address or per account in short time windows (rate limiting); these counters live for a few minutes in memory and are then discarded.

Notifications

In-app notifications (for example new comments or finished exports) are stored with type, text and read status. We keep at most 99 per account; older ones are deleted automatically.

5. App: photos and videos

Storage

Your original files and the variants and thumbnails derived from them are stored in the object storage of Hetzner Online GmbH in Falkenstein, Germany. Transfer is TLS-encrypted. The legal basis is the user contract (Art. 6 (1) (b) GDPR). The files are kept until you delete them, plus 30 days in the trash (section 10).

Metadata

On upload we read the metadata contained in the file: capture date, camera model, orientation and, if present, GPS coordinates. We also store the file name, size, type and a checksum (hash) to detect duplicates. Titles, notes, favourites, tags, albums, trips and chapter texts are your input and are stored with the respective photo or video.

Capture location (reverse geocoding)

If a photo contains GPS coordinates we ask MapTiler AG (Switzerland) for the matching place (city, region, country). The same happens when you type in the location field and get suggestions. We send only the coordinates rounded to roughly 100 metres, or your search text, from our server and without any identifier that could link the request to you, your account or the photo. According to its own documentation MapTiler does not store visitor IP addresses. The exact coordinate stays with us on the photo. The legal basis is the user contract (Art. 6 (1) (b) GDPR).

Automatic tags

If you switch automatic tags on, a model on our own servers analyses each photo and suggests terms (for example "beach" or "dog"). The detected terms are stored with the photo. You can switch the feature off in the settings at any time. The legal basis is the user contract (Art. 6 (1) (b) GDPR).

Face recognition

Face recognition is off by default. You switch it on deliberately at first launch or in the settings. A model on our own servers then detects faces in your photos, computes mathematical features from them (embeddings), creates small crops as thumbnails and groups similar faces into people you can name.

Facial features are biometric data. The legal basis is your explicit consent (Art. 9 (2) (a) GDPR). Recognition runs exclusively within your account: no matching against other accounts, no external databases, no disclosure.

You can withdraw consent at any time: the switch in the settings stops recognition for new uploads. Faces, features, thumbnails and people already detected remain until you run "Delete all face data" in the settings, after which they are removed permanently. The people in your photos are usually family and friends; you are responsible for those photos, as with any private photo archive.

Sample content

On request we load sample photos into your account so you can try the app. These files are stored once centrally and are not related to you. You remove them at any time with one click.

6. App: sharing

Share links

When you share a photo, an album or a trip we create a link with a random token. With it we store your settings (expiry date, optional password as a hash, whether info, comments or following are allowed). Visitors only see what the link allows: without "show info" only the images, never the street of a location, never deleted photos or draft chapters. The legal basis is the user contract (Art. 6 (1) (b) GDPR).

What we process about visitors of your links

Visitors need no account. About them we process:

• Visitor count. So you can see how many people have viewed a link, we form a checksum per link and day from the IP address and browser identifier together with a random value that changes daily and is deleted after two days. After that the checksum can no longer be attributed to anyone; what remains is a plain number. This only prevents reloads from counting twice; it is not tracking across days. Your own views do not count. The legal basis is Art. 6 (1) (f) GDPR.
• Comments. If you allow comments we store the display name the visitor enters, the text and the time. You can delete any comment.
• Reactions. If a visitor reacts with an emoji we set a cookie visitor_id with a random identifier (httpOnly, 1 year). Its only purpose is to let the visitor take back their own reaction. It is set on the first reaction and is technically necessary for that (§ 25 (2) TDDDG).
• Password links. After the correct password is entered we set a session cookie so the visitor does not have to re-enter it on every page. It ends when the browser is closed.
• Trip follows. Visitors with a lumioo account can follow a trip and get an email on new chapters. We store the account, the link through which they followed and an unsubscribe token for the link in every email. The legal basis is consent (Art. 6 (1) (a) GDPR), revocable through the unsubscribe link.

Reporting content

Visitors can report shared content. We then store the reporter's comment, a salted checksum of the IP address (only to detect repeat reports) and a snapshot of the reported content as references and checksums, never copies of the files. A report never triggers an action automatically; we review it. In case of a violation we can block sharing of the content, delete it or disable the account; the owner is informed, but never told who reported or what they wrote. The legal basis is Art. 6 (1) (f) GDPR (protection against abuse). Comment and IP checksum are deleted when the report is closed, the snapshot 90 days later, the case itself after two years. If content is blocked we keep its file checksum permanently so that a re-upload cannot be shared again; the checksum reveals nothing about any person.

7. App: payments

You buy paid plans through Paddle.com Market Ltd, London, United Kingdom. Paddle acts as reseller (Merchant of Record) and is independently responsible for payment processing. Payment data such as card numbers is held exclusively by Paddle; we never see it. We pass your email address and an internal account identifier to Paddle so the payment can be matched to your account. From Paddle we receive and store a customer identifier, the status of your subscription, plan, billing period, booked storage packages and identifiers of the events Paddle reports to us. The legal basis is the contract (Art. 6 (1) (b) GDPR).

The payment page runs at checkout.lumioo.me and is the only page that loads code from Paddle. Paddle sets its own cookies there for the checkout. Paddle's privacy policy applies to that. Neither the app nor the website loads code from Paddle.

You manage cancellation and payment methods in Paddle's customer portal, linked from the app. Paddle keeps invoice data for the statutory retention periods that apply to Paddle, also after your account is deleted.

If your account falls back to a smaller plan and your library exceeds the storage then available, we notify you by email. You have 14 days to delete or export content; we remind you 2 days before the deadline. After that we remove the newest items until the library fits again. Details are in the Terms of service.

8. Email

Emails from us

We only send emails that are needed for using lumioo or that you asked for: confirmation codes, welcome, new chapters in trips you follow, digests of new comments, notices about storage and plan, finished exports, account deletion and invitations. No newsletter, no marketing.

Sending is handled by AhaSend B.V. (Netherlands), with Scaleway SAS (France) as fallback during outages. Both process exclusively in the EU. The email content is held there only for delivery (AhaSend: at most 1 day; Scaleway: until delivery, encrypted backups 7 days). Delivery logs with recipient, subject and status remain at AhaSend for up to 7 days and at Scaleway for the duration of our contract.

Emails to us

If you write to support@lumioo.me or privacy@lumioo.me, the sender, content, attachments and our reply are stored in the mailbox at our provider one.com Group ApS (Denmark, data centres in Denmark). We use them to handle your request (Art. 6 (1) (b), (c) or (f) GDPR depending on the matter). We keep the correspondence for three years after the case is closed so we can prove it if needed, and delete it afterwards.

9. Export, API and integrations

• Downloads and export. When you download a selection we create an archive that is available for 7 days. You start the full export of your library (Art. 20 GDPR) in the settings; the archive is available for 14 days, one export per 30 days.
• API keys. When you create an API key we store only its checksum, a name, whether it is read-only and when it was last used. The key itself is shown to you once.
• Connected assistants (MCP/OAuth). You can give third-party applications, such as an AI assistant, access to your library. This happens only with your explicit consent on an authorisation page (Art. 6 (1) (a) GDPR). We store the third-party client's registration, your consent and the access tokens. The third-party application receives only what you authorise, and never internal identifiers or storage paths. What it does with the data is its responsibility; you revoke access at any time in the settings.

10. Deletion and retention

• Trash. Deleted photos and videos stay in the trash for 30 days and are then deleted permanently. Until then they still count towards your storage.
• Account deletion. You can delete your account in the settings. Deletion is carried out after 14 days; until then you can cancel it. Optionally you delete immediately. We then remove all photos, videos, variants, face data, archives and the account with everything attached to it. An open report against shared content pauses deletion until it has been handled.
• What remains afterwards. Server logs until the end of their 14 days, checksums of blocked content (not related to a person), invoice data at Paddle, delivery logs at the email provider until the end of their period, and our correspondence with you (section 8).
• Backups. Permanently deleted photos and videos remain for up to 30 days, database rows for up to 7 days in backup copies (Hetzner Storage Box, Germany). We read backups only to restore after a failure. This applies to every deletion: trash, face data, account.

11. Processors and recipients

Beyond that we disclose data only when you initiate it (share links, connected assistants) or when we are legally required to.

12. Your rights

You have the right of access (Art. 15 GDPR), rectification (Art. 16), erasure (Art. 17), restriction of processing (Art. 18), data portability (Art. 20) and to object to processing based on Art. 6 (1) (f) GDPR (Art. 21). You can withdraw consent (face recognition, trip follows, connected assistants, waiting list) at any time with effect for the future.

Much of this you do yourself in the app: export of your library, deleting photos, face data and account, switches for tags and faces, unsubscribe links in emails, revoking connected assistants. For everything else write to privacy@lumioo.me. We reply within one month.

You also have the right to lodge a complaint with a data protection supervisory authority. The authority responsible for us is the Landesbeauftragte für Datenschutz und Informationsfreiheit Nordrhein-Westfalen, Kavalleriestr. 2–4, 40213 Düsseldorf, Germany, ldi.nrw.de.

13. Changes

We update this policy when the app or the legal situation changes. The current version with its date is always on this page. We inform you about material changes in the app or by email.

This English version is a translation for your convenience. The German version is the binding one.