Privacy policy
Effective and last updated 22 July 2026
Luuma uses your information to organise your wardrobe, suggest outfits, support optional community features and keep the service secure. We do not sell personal data or use your wardrobe to target clothing advertising.
1. Who this policy is for
This policy explains how Luuma handles personal data on luuma.life and in the Luuma app. The service provider and data controller details are available in the legal information. For privacy requests, email info@luuma.life.
2. Scope
This policy applies when you visit luuma.life, create or use a Luuma account, scan garments or outfits, use wardrobe, planning, challenge or sharing features, contact us, or otherwise interact with Luuma. It does not govern third-party services that have their own privacy notices.
3. Personal data we process
| Category | Examples | Source |
|---|---|---|
| Account and profile | Email address, account identifier, display name, avatar choice, language and preferences | You and the sign-in provider |
| Wardrobe and garment data | Garment photos, label photos, brand, colour, composition, care information, notes, price, wear history, availability and repair status | You and optional image analysis |
| Looks and planning | Saved looks, outfit feedback, events, trips, packing details, dress codes, style choices and manual weather notes | You and Luuma recommendations |
| Camera and images | Photos you choose to capture or upload for garments, labels, outfits or avatars | Your device, with permission |
| Location and weather | Approximate device coordinates, saved location and current weather conditions when you enable weather | Your device and weather providers |
| Community and challenges | Challenge participation, group membership, invitations, reactions and content you intentionally share | You and other participants |
| Communications | Support messages, legal requests and feedback | You |
| Technical and usage | IP address, device and platform type, app version, session identifier, feature events, errors, timestamps, push token and security logs | Your device, hosting and app infrastructure |
| Purchases | Subscription status, product and transaction reference; payment card data is handled by the relevant app store or payment provider | Apple, Google or another payment provider |
4. Why we use data and our legal bases
| Purpose | GDPR legal basis |
|---|---|
| Create and administer your account; save, synchronise and display your wardrobe, looks, plans and challenges | Performance of our contract with you |
| Analyse photos when you request garment, label or outfit assistance and generate recommendations | Performance of our contract; consent where device permission or optional processing requires it |
| Use location to obtain local weather after you enable the feature | Your consent, which you may withdraw in device settings |
| Send service messages and optional push notifications | Performance of contract for essential notices; consent for optional notifications |
| Operate community, invitation and challenge features you choose to use | Performance of contract |
| Prevent abuse, secure accounts, diagnose errors and protect Luuma and its users | Our legitimate interests and compliance with legal obligations |
| Measure feature use and improve usability using first-party activity events | Our legitimate interests; consent where local law requires it |
| Respond to rights requests, complaints, regulators and lawful orders | Compliance with legal obligations and establishment or defence of legal claims |
| Send marketing communications, if introduced | Your consent; you may unsubscribe at any time |
Where we rely on legitimate interests, we consider the necessity of the processing and balance it against your rights. You may object as explained below.
5. AI-assisted features
When you actively use an AI-assisted scan or styling feature, relevant images and instructions may be sent securely to our AI service provider, currently OpenAI, to produce a result. Results can be incomplete or wrong and are presented as suggestions. Label text, composition, care, durability, fit and sustainability statements should be checked against the garment and manufacturer information.
Luuma does not use these suggestions to make decisions that produce legal effects or similarly significant effects about you. We do not use facial recognition or biometric identification. You can correct AI-generated garment information and can use core wardrobe functions without accepting an AI suggestion.
6. Device permissions
Camera, photo library, location and push notification access are optional and controlled by your device. Denying a permission only disables the feature that needs it. You can revoke permissions in your device settings. Luuma does not access photos you have not selected or capture location in the background for weather.
7. Who receives personal data
We disclose only what is necessary to service providers acting for us, independent controllers you choose to use, other users where you intentionally share something, professional advisers, and public authorities where legally required. Current core recipients include:
- Supabase for authentication, database, private file storage and server functions.
- OpenAI for optional garment and outfit image analysis.
- Vercel for hosting and securing luuma.life.
- Open-Meteo or OpenWeather for optional weather retrieval; coordinates are sent only when weather is requested.
- Apple and Google for app distribution, purchases and optional push notification delivery.
- Google Fonts on this website; your browser requests font files directly from Google.
We do not sell personal data. We do not share wardrobe content with advertisers. A challenge invitation shares the challenge details you select, not your private wardrobe, wear history or private statistics. The app previews shareable content before sharing where the feature supports it.
8. International transfers
Some providers may process data outside Belgium or the European Economic Area. Where an adequacy decision does not apply, we use appropriate safeguards such as the European Commission's Standard Contractual Clauses and supplementary security measures where required. You may request information about the safeguard relevant to your data at info@luuma.life.
9. Retention
- Account, wardrobe, look, planning and challenge data are kept while your account is active and deleted when you delete the relevant item or account, unless law requires longer retention.
- Garment and label images are kept until you delete the garment, image or account.
- Support, legal and complaint records are kept only as long as needed to resolve the matter and meet limitation or record-keeping duties.
- Security and technical logs are kept for a limited period appropriate to diagnosis, fraud prevention and service security.
- Transaction and accounting records are retained for the statutory Belgian accounting and tax period.
Deletion removes data from active systems without undue delay. Residual encrypted backups are isolated from normal use and expire under the applicable backup schedule. We may retain data that has been irreversibly anonymised.
10. Security
We use access controls, private storage, encryption in transit, row-level database controls, signed file links, logging and least-privilege administration. No online service can guarantee absolute security. Keep your account credentials confidential and report suspected misuse to info@luuma.life.
11. Your European data protection rights
Subject to the conditions in the General Data Protection Regulation (EU) 2016/679, you may request access, rectification, erasure, restriction, portability, or object to processing based on legitimate interests. You may withdraw consent at any time without affecting earlier lawful processing. You also have the right not to be subject to a solely automated decision with legal or similarly significant effects.
Send a request to info@luuma.life. We may ask for proportionate information to verify your identity. We normally respond within one month; the GDPR allows an extension for complex or numerous requests.
12. Complaints
Please contact us first so we can investigate. You may also complain to the Belgian Data Protection Authority or the supervisory authority where you live or work:
Data Protection Authority / Gegevensbeschermingsautoriteit / Autorité de protection des données
Rue de la Presse 35 / Drukpersstraat 35, 1000 Brussels, Belgium
dataprotectionauthority.be
13. Children
Luuma is intended for people aged 16 or older. We do not knowingly create accounts for children under 16. A parent or guardian who believes a child has provided personal data should contact us so we can investigate and delete it where appropriate.
14. Website cookies and local storage
The public website does not currently use advertising cookies, analytics cookies or profiling pixels. Hosting providers still receive standard request data such as IP address and browser information. The Luuma app uses local device storage and strictly necessary identifiers to keep you signed in, remember settings, support offline use and maintain security. See the cookie and local storage notice.
15. Changes to this policy
We may update this policy when the service, providers or law changes. Material changes will be communicated in the app or by another appropriate channel before they take effect where required. The date at the top identifies the current version.