Privacy Policy
Draft for review — this policy is a working draft and should be checked by a legal adviser before you rely on it.
Last updated: August 1, 2026
Who we are
Lumi (“Lumi”, “we”, “us”) provides a service for creating and sharing digital invitations. For the personal data described in this policy, the data controller is Düzgün Baran Taştan, trading as Lumi, of 17 Founder Close, London, E6 6FS, United Kingdom — a sole trader, so no company registration number applies. If you have any questions about this policy or how we handle your data, you can reach us at lumiinvites@gmail.com.
Our two roles
Lumi handles personal data in two different roles. For your own account — your name, email, and how you use the product — we are the controller: we decide why and how that data is used.
For the content you put inside an invitation — your guests’ names, their RSVP responses, and any photos guests upload — you are the controller and we act as your processor: we store and process that information on your behalf and under your instructions. You are responsible for having a proper basis to collect your guests’ details and for telling them how their information will be used.
What we collect
Account data: your display name, email address, an optional phone number, an optional profile photo, and your password (stored only in hashed form — we never see it in plain text).
Invitation content: the text, dates, venue, photos, music, and other details you add to your invitations.
Guest data:the RSVP responses your guests submit (name, whether they’re attending, guest count, and any note) and photos guests choose to upload to your album.
Preferences & billing: your language, notification, and marketing choices, plan/subscription status, and payment records when billing is active.
Newsletter: if you subscribe, we store your email address to send the updates you opted into.
Cookies and analytics
We do not use cookies for advertising or tracking, and we do not share your browsing with advertising networks. The only cookies Lumi sets are the ones the product cannot work without: one that keeps you signed in, and one that remembers the language you chose.
To understand which pages people find useful we use Vercel Web Analytics, which is cookieless — it stores nothing on your device and does not follow you to other websites. It records the page visited, the referring site, and coarse details such as country, browser, and device type. It never receives your name or email. Before a page view is sent we strip the address down: invitation links are reduced to a placeholder, so the analytics data shows how many invitations were opened but never which couple, and anything in the web address after a question mark is discarded except campaign tags. This is why you will not see a cookie banner on Lumi.
Why we use it, and our lawful basis
We use account and invitation data to provide the service you signed up for — this is processing necessary to perform our contract with you. We use limited data to keep the product secure and working and to understand which templates are popular, on the basis of our legitimate interests in running and improving Lumi. We send marketing emails only with your consent, which you can withdraw at any time. Where the law requires it — for example keeping certain billing records — we process data to meet a legal obligation.
How long we keep it
We keep your account and invitation data for as long as your account is open. Guest-uploaded photos are automatically deleted 180 days after they are uploaded. When you delete your account, we remove your data — including invitations, RSVP responses, and guest photos — from our live systems. Some information may remain in routine backups for a short period before those backups are overwritten, and we may retain the minimum records we are legally required to keep.
Your rights
Under UK data protection law you have the right to access a copy of your data, to correct it, to delete it, to restrict or object to certain processing, and to data portability. You can exercise the main ones yourself from your account settings: “Download my data” gives you a machine-readable copy of everything we hold about you, and “Delete account” permanently removes your account and its data. For anything else, email us at lumiinvites@gmail.com. You also have the right to complain to the UK Information Commissioner’s Office (ICO) at ico.org.uk.
Who we share data with
We do not sell your personal data. We rely on a small number of trusted service providers who process data on our behalf as sub-processors: Vercel (application hosting and cookieless web analytics), Neon (database hosting), Vercel Blob (file and photo storage), Resend (sending account emails such as password resets and order confirmations), and — when enabled — Stripe (payment processing). Each is bound to protect the data and use it only to provide their service to us. Where data is transferred outside the UK, we rely on appropriate safeguards such as the UK’s international data transfer terms.
How we protect data
Access is protected by authentication, passwords are stored only as salted hashes, and data is transmitted over encrypted connections. Guest photo albums are private to the invitation owner. No system is perfectly secure, but we take reasonable technical and organizational measures to protect your information.
Changes to this policy
We may update this policy as the product and our legal obligations evolve. When we make material changes we will update the date above and, where appropriate, let you know.
Contact
Questions or requests? Email lumiinvites@gmail.com.