1. Who processes your information
This policy covers personal information in the LumePly website account, Photoshop plugin and related cloud services. The operator and personal-information processor is Hangzhou Xiangkuo Technology Co., Ltd. (杭州象阔科技有限公司). Privacy contact and request channel: support@lumeforth.com.
We explain what information actual features process, why, where it is sent, how long it is retained and how to exercise rights. Unavailable features process information only after activation and required notice and lawful conditions. You may choose before providing optional information.
2. Information, purposes and lawful bases
Lawful bases are determined by operation: processing necessary to enter or perform the service contract for accounts and requested services; statutory duties for required records and safeguards; and voluntary explicit consent where needed for optional settings or additional uses. Separate consent, guardian consent, specific notices and impact assessments required by law are handled separately, not replaced by one registration checkbox.
| Scenario | Information processed | Purpose, necessity and choice |
|---|---|---|
| Email registration and login | Email address, verification result and time, internal account ID, registration time, accepted terms and privacy versions and confirmation time | Verify email control, create and protect the account, send necessary security notices and retain confirmation evidence. Email is required for registration, but not for viewing public product pages. Phone numbers are not collected for new registrations. |
| Date of birth | Birth date provided by new users, confirmation time and age-threshold result | Assess registration age and provide related services. Saved with successful registration; rejected users receive no account and their complete birth date is not stored. Existing users need not add it. It is not public; only the user may view it or request correction, export or deletion. Not used for marketing SMS. Future birthday activities would appear only on website visits; none are currently available. |
| Optional profile and security settings | Chosen or server-generated display name, email-change times, optional recovery evidence and status | Display names identify the account in the interface; omitted names are generated and can be changed. Recovery evidence supports account recovery. Display names and recovery codes are optional. Changing email requires verification of both the old and new addresses; contact support if the old address is inaccessible. |
| Referrals and eligibility | Submitted referral code, referral relationship, shareable code, eligibility and reward records | Apply published referral and test-admission rules and prevent duplicate grants. Referred users' contacts are not published. Referral codes are not marketing consent and are optional. Test eligibility is assessed separately. |
| Sign-in security and plugin connection | Request IP and rate-limit/risk digests, client type, device name, installation digest, session/trusted-device IDs, creation/use/expiry times, failures, browser connection requests and approval status | Authenticate, limit abuse, revoke sessions and connect this browser action to the designated plugin. Current risk controls are not full location tracking, SIM-recycling detection or third-party anti-fraud. |
| Image editing and outpainting | Submitted image or needed region, context pixels, selection mask, local-edit prompt, dimensions and parameters; results, task/provider IDs, status, times and credit ledger | Upload, validate, convert as needed, call the relevant model, return and retrieve results again, prevent duplicate charges and review faults. The outpainting interface does not send text prompt fields. Using the plugin does not upload the whole computer or every Photoshop document. |
| Support, appeals and tickets | Voluntarily submitted contacts, issue text, follow-ups, attachments, status and necessary replies | Check ownership, resolve problems and communicate progress. Provide only necessary material. A request intake or status page does not mean all manual operational recovery is ready. |
| Data-rights requests | Identity-check result, export/deletion request ID, scope, status, times, necessary receipts and file digests | Prevent unauthorized access, handle requests and prove results. Internal object locations are not ordinary download content. Some self-service functions are not enabled in production; statutory requests remain available. |
| Payments, refunds and invoices | Order items, amounts, credit batches, membership dates, payment/refund states and receipts; necessary invoice details such as title and tax number | Available WeChat Pay and Alipay payments and email refund requests. Records support transactions, fulfillment, original-method refunds and necessary finances. Payment providers handle payment passwords and full bank-card details; we do not obtain them through collection. Invoices are requested by support email, not automatically issued. |
New registration requires a password; email verification supports login and password reset. The server stores a random salt, irreversible hash and format/normalization versions, not readable passwords. Historical random placeholders are not valid set passwords, and old formats are not changed without justification. Passwords, verification codes and recovery credentials are excluded from ordinary exports.
Login email addresses are encrypted in the identity system, with dedicated digests for deduplication. Digests, account IDs and masked displays may still identify a person and are not anonymous. Verification uses digests, with necessary pending message content encrypted. Sending and provider receipts are recorded separately; acceptance does not mean the person has read a message.
This policy gives no blanket permission for advertising profiles, bulk contacts, continuous precise location, public asset display or model training. New purposes require disclosure of scope, necessity and choices and lawful authorization. Refusal of unnecessary processing should not block unrelated necessary services.
3. How images and prompts move
When you actively submit a task, the plugin extracts the necessary image and mask and uploads them to private object storage. Our server reads, validates and converts necessary images, then sends required material and parameters to the relevant model. Validated results are saved for you to retrieve. Direct-to-storage upload does not mean images never pass through our server.
Current local editing uses Jimeng / Volcengine and Tencent Cloud COS storage. Alibaba Cloud Bailian outpainting is not open. Unavailable functionality is not a current transfer. Failed tasks do not by default send the same assets to every vendor. Recipients and scope follow below.
Your submitted content is processed for your requested service, without transferring ownership or public-distribution rights. We do not use inputs or outputs for our independent model training, marketing display or sale. Any such future purpose requires its own lawful basis and explicit optional authorization. Jimeng / Volcengine standard special terms state that inputs and outputs are not used for model training or optimization, subject to stated exceptions such as written authorization, troubleshooting, law and content review. This does not mean third parties never retain data. See the Jimeng AI special terms.
Images and free text may contain faces, identity documents, health, financial, location or children's information. Ordinary image features do not use it for identification or face databases. Sensitive personal information still requires a specific purpose, necessity, rights assessment and lawful authorization. Uploading cannot replace legally required separate consent. Do not submit such material to the test service before specific mechanisms are in place.
4. Third-party recipients and processing
We provide necessary information to these recipients according to the feature you use; registration does not send images to all model vendors. Cloud and model services are purchased through the vendors' standard official services.
| Recipient and feature | Necessary information and purpose | Scope and notes |
|---|---|---|
| Tencent Cloud Computing (Beijing) Co., Ltd.: SES email, COS and cloud computing | Registration and login email addresses, verification parameters and necessary security notices; account data, images, masks, results, necessary request metadata and encrypted backups | Verification, computing, private storage and disaster recovery. Standard service agreement. Verification messages are not marketing; current registration does not use SMS. |
| Beijing Volcano Engine Technology Co., Ltd.: Jimeng AI local editing | Necessary original image, mask, prompt, image parameters and model task ID | Generation and task queries, under Jimeng AI special terms and Volcengine service terms. |
| WeChat Pay / Tenpay Payment Technology Co., Ltd. | Selected item, order ID, amount and necessary payment/refund parameters; returns payment status, provider transaction ID and necessary payer identifier | Only for chosen WeChat Pay payments and related refunds. Tenpay privacy policy. |
| Alipay | Selected item, order ID, amount and necessary payment/refund parameters; returns payment status, provider transaction ID and necessary payer identifier | Only for chosen Alipay payments and related refunds. The payment page displays the relevant payment entity and privacy rules. The provider handles payment passwords and full bank-card information. |
Alibaba Cloud Bailian outpainting is not open and is not a current image recipient. Actual entity, data scope and rules will be disclosed before activation. Adobe Photoshop is separately used host software; the plugin reads necessary local images and writes results. Adobe's own processing follows its rules. This table does not mean we send your LumePly email address or task assets to Adobe servers.
Entrusted processing should have contractual purpose, duration, information categories, security and return/deletion requirements, with supervision and no unauthorized purposes or subprocessing. Where information is provided to another independent processor under law, disclose the recipient and obtain required separate consent. Calling a company a provider does not automatically make all processing entrusted processing.
Registration or this policy does not publish or sell your personal information by default. Legally required disclosure to authorities requires verification of powers and scope and only necessary information. For transfers following operator changes, disclose recipients and require continued obligations; changed purposes are handled separately under law.
5. Retention and deletion limits
Date of birth is retained with the account for the purposes above and deleted under profile-cleanup rules when account deletion completes. It is not a necessary field in retained order, refund or financial records and is not kept long-term with them. Backup copies follow rotation and deletion replay after restoration. You may view it in your account; email support@lumeforth.com for verified correction.
Information is kept for the shortest period necessary for its specific purpose. Statutory records follow applicable categories and starting events. Possible usefulness or reconciliation convenience does not justify keeping all data indefinitely.
| Category | Retention rule and starting event | Handling at expiry, account deletion or request |
|---|---|---|
| Saved generation results | Retrievable for 7×24 hours from saving; retrieving again does not extend the exact displayed deadline | Normal retrieval stops at expiry; asynchronous cleanup retries failures. The documented eight-day object lifecycle is a fallback for orphaned files, not an extension or proof all copies disappear on time. |
| Uploaded originals, masks and validation inputs | 24 hours after a reliable terminal task state; unbound or interrupted pre-creation material: 24 hours from server registration | Protect tasks in progress, unknown outcomes, valid upload authorization and necessary reads/writes. Stop ordinary use and delete asynchronously at expiry. Verify unknown historical starting points and copies separately; no promise all bytes physically disappear simultaneously. |
| Export packages and staging | Background ZIP design: downloadable for 24 hours from request. The production entry is closed. Export does not extend source-result validity | Reject downloads at expiry. Cleanup accounts for preparation/download already started, failed retries and unreachable copies. Not all bytes necessarily disappear at once. |
| Account profile, contacts and security credentials | As necessary for active accounts and chosen security settings; sessions and trusted devices have their own expiry/revocation times | Membership expiry or signing out does not delete a normal account. |
| Prompts and ordinary task records | Successful prompts: 7 days with saved result. Failed/cancelled prompts: 7 days after reliable terminal state. Ordinary task data: 180 days after reliable terminal state and settlement | Remove text and unnecessary metadata. Minimum reconciliation IDs and ledger relationships remain restricted under their actual category, preventing duplicate grants or charges. Random IDs and identity digests may still be personal information, not anonymous. |
| Ordinary tickets and attachments | Text: 1 calendar year after reliable closure; attachments: 30 days | Protect active handling, valid reads/writes and specific unresolved disputes. Keep only necessary statutory/dispute material with documented basis, term and review, not all tickets forever. |
| Orders, refunds, invoices and accounting archives | Ordinary business records: 3 years from the later of benefits ending and financial settlement. Orders without benefits: later of reliable closure and settlement. Accounting archives follow legally verified categories; not every business record requires 30 years | Account deletion does not remove legally required minimum financial records. Unrelated contacts and free text are cleaned separately; access is limited to lawful purposes. |
| Legally required network logs | At least 6 calendar months for applicable categories; clean afterward without another basis | Separate from ordinary rate counters. Do not apply log retention to every image or prompt. |
| Current shared ordinary disaster recovery | The account database has encrypted backups. The backup prefix shared with the operations board has a 30-day lifecycle from creation. Old recovery sets, versions and other copies need separate review; this is not a maximum 30-day promise for all copies | Not for routine processing. Restore in isolation and replay latest deletions and security revocations before reopening. Avoid deleting another project's shared backups. Retain full and continuous binlog recovery chains until a replacement recovery point is verified. |
Seven days is the ordinary period for results and successful prompts, not proof that all copies physically disappear on day seven. Historical data, third-party copies and shared backups require separate handling. Unreviewed historical copies have restricted access and use while creation time, retention basis and cleanup scope are verified. Required processing records, impact assessments and financial archives follow their own categories, without retaining all business content for the same term.
6. Storage region and overseas transfers
Current production account servers, databases, private image storage and new cloud backups use Tencent Cloud Shanghai; email uses Tencent Cloud SES. Necessary operations may use restricted encrypted recovery material and device copies. Historical copies and third-party processing regions need separate checks. The main server location does not establish the location of the entire chain.
Any necessary overseas transfer requires prior verification of lawful basis and applicable transfer conditions, disclosure of overseas recipient, contact, purpose, method, information categories and rights channels, necessary separate consent, impact assessment and applicable procedures. Exemption from one assessment, contract or certification does not remove notice, security or other duties. No corresponding new transfer is added before these are implemented.
7. Cookies, local storage and security
Account pages use necessary authentication and security cookies for sessions and access control. The plugin stores credentials in host secure storage, isolated by API environment. Browser and plugin sessions differ; a connection request should not turn ordinary browsing into plugin authorization. Sign out, clear browser data or revoke devices where available. Clearing necessary cookies may require signing in again.
The account entry uses the necessary storage below, without advertising profiling:
| Name / location | Purpose and duration | How to clear |
|---|---|---|
| `__Host-lumeply` cookie | Website session; expires under server session limits, currently 30 days by default, revocable earlier | Sign out or clear site data. A server-revoked cookie cannot authenticate even if retained. |
| `__Host-lumeply-device` cookie | Remember this device for up to 30 days, never beyond the server deadline | Clear site data or revoke the device. |
| `__Host-lumeply-recovery` cookie | Continue account recovery, usually 49 hours; follows flow expiry, at most 7 days | Cancel or complete the flow, or clear site data. Invalid after expiry. |
| localStorage keys starting `lumeply-phone-installation:` | Random browser installation ID separated by account-service origin; no automatic expiry | Clear site data. Contains no passwords, email codes or login tokens. |
| sessionStorage keys starting `lumeply-plugin-connection:v1:` | Continue this tab's plugin connection request within the server request deadline | Cleared on completion/cancellation or tab close. Restored tabs still follow the server deadline. |
These cookies use HTTPS, HttpOnly and SameSite restrictions. The unavailable full self-service deletion flow has an additional short-lived receipt cookie; it is not described as available now. Clearing site data may require signing in or starting a connection again.
We apply risk-appropriate authentication, encryption, digests, ownership checks, access limits and transport safeguards and minimize sensitive logs. These are not a guarantee of zero risk. Actual or potential leakage, tampering or loss requires timely lawful remediation, reporting and notification where required.
Necessary additional verification may prevent mistakes or account theft, with reasons and suitable appeal channels. For automated decisions materially affecting rights, you have applicable legal explanation and objection rights. Current failure-event rate limits are not a complete automated anti-fraud system.
8. Exercising your rights
Email support@lumeforth.com to request access, copies, correction, supplementation, deletion, restricted processing, consent withdrawal, account deletion or explanations, and transfers where legally available. Hangzhou Xiangkuo Technology Co., Ltd. handles requests manually through this address, including if you have no account or cannot sign in. We should respond promptly, verify necessary identity and explain results or specific refusal reasons. Normally a result is provided within 15 business days after necessary checks; delays require reasons, pending actions and an estimate. Missing online buttons do not justify refusing reasonable requests.
Basic exports include available personal account, business and security records, excluding password hashes, tokens, recovery codes, verification codes, provider secrets and others' data. Basic JSON excludes image files. Background ZIP export is designed to include retrievable images and public attachments, but is not open in production. Email for manual handling of extra scope or capacity limits. Expired or deleted images are not regenerated for export.
You may withdraw consent for optional settings or extra purposes without affecting prior lawful processing. If processing is necessary for a specific feature, we should explain why that feature cannot continue while preserving unrelated features. Processing under statutory or other independent lawful bases does not automatically stop with consent withdrawal; its basis and limits should be clear.
Deletion requires renewed identity verification and explanation of pending tasks or refunds. If the login email is inaccessible, identity can be verified through support. No mandatory prior export or purchase, or generic waiting period without a specific basis. Full self-service deletion is not open; request it and progress by email. Prechecks, freezing, file cleanup or financial settlement do not mean all personal information has been deleted; completion depends on itemized receipts.
Completed deletion should revoke access and delete or lawfully handle related information. If statutory retention has not ended or deletion is temporarily technically difficult, restrict processing to storage and necessary security, identifying categories, basis, duration or review conditions. Do not use it for marketing, normal sign-in or new generation. You may seek regulatory or court remedies without first completing an internal appeal.
9. Minors, updates and contact
Registration is available at age 14 or above; users under 14 cannot register. New users must provide an accurate date of birth, assessed on registration in Beijing time. Self-reported birth dates do not establish real-name or identity verification. Users aged 14–17 should read these terms and the Privacy Policy with a guardian and obtain guardian consent before purchasing plans.
Material changes should be prominent and accessible. New purposes, categories, recipients or processing requiring renewed consent need appropriate notice and authorization first. Continued use is not consent to all purposes. Prior versions should remain verifiable. Wording corrections do not retroactively expand processing.
For policy questions, complaints or data requests, contact support@lumeforth.com. Before formal publication, we must verify the channel can receive messages, check identity and perform actual handling.