LumeoPrime Privacy Policy

Last updated: July 22, 2026

1. Who we are

Bifrost Studio ("we", "us", "our") is the data controller for any personal data processed in connection with the LumeoPrime mobile app. You can reach us at support@lumeoprime.com.

2. Summary

LumeoPrime offers two kinds of editing. Local filters and presets are processed entirely on your device. The Smart Tools (such as passer-by removal, old-photo restoration, expand, makeup, and film looks) cannot run on-device: when you use one, the photo you choose is uploaded over an encrypted connection to our servers, processed, and the result is sent back to you; the uploaded photo is deleted immediately after processing and is not retained (see Section 4). Creating an account is optional: if you sign in with email, Google, or Apple, we store a small amount of account information on our servers (see Section 5). If you choose to subscribe or buy a Boost pack, the payment is handled by Apple or Google; we do not receive your card details, but we do receive purchase and subscription records to activate your membership (see Section 15). We do not embed behavioural analytics, advertising SDKs, or advertising identifiers (IDFA / Android Advertising ID), and we do not track what you do inside the App. The only third-party SDK we include is Firebase Crashlytics, used solely for crash diagnostics; it is off by default and only sends anything if you switch it on (see Section 7).

3. Information processed on your device (not collected by us)

When you use local filters and presets, the following is stored only on your device, in your app's private sandbox, and is never transmitted to us:

Photos and screenshots you import or capture for editing.
Style presets, recent actions, edit thumbnails, and saved photos.
App preferences (language, save quality, etc.).
Face detection: when you use the Makeup feature, a lightweight on-device model detects the position of faces in the photo you are editing. No facial image or coordinate data ever leaves your device or is transmitted to us.

You can remove this information at any time by deleting items in the app or by uninstalling the app. (Photos you send to the Smart Tools are handled separately — see Section 4.)

4. Smart Tools — photos you submit for cloud processing

Some features — the Smart Tools — cannot run on your device and require server-side computation. They only run when you actively select a photo and tap to process it. Here is how we handle that data:

What is uploaded: only the single photo you select for that operation, and, for passer-by removal, the mask you draw to mark the area to erase. We never upload your photo library or any photo you did not submit.
Purpose: the uploaded image is used solely to generate the edited result you requested.
Where: processing happens on our own servers. The image is not sold, not shared for advertising, and not used to train models or for any unrelated purpose.
Retention: the uploaded photo is deleted immediately after processing and is not retained on our servers.
Transmission: uploads and downloads use an encrypted (HTTPS/TLS) connection.

We process this data to perform the service you requested, on the legal basis of performing our contract with you (GDPR Art. 6(1)(b)). You are responsible for having the rights to the photos you submit and for obtaining any consent required from people who appear in them (see also the Terms of Service).

5. Account information and messages you send us

Creating an account is optional. If you choose to sign in, we collect and store on our servers only what is needed to operate your account:

Your email address (for email sign-in, or as provided by Google / Apple).
Basic profile details you choose to share: display name and avatar image URL.
The sign-in method you used (email, Google, or Apple) and the unique identifier issued by that provider.
Temporary one-time verification codes sent to your email, which expire shortly and are then deleted.

We process this information to authenticate you and provide account-based features, on the legal basis of performing our contract with you (GDPR Art. 6(1)(b)) and our legitimate interest in securing the service (Art. 6(1)(f)). If you contact us by email for support, we also receive your email address and the contents of your message, which we use to respond to you. You can delete your account and associated data at any time (see Section 9).

6. Device permissions

To enable the App's core features, your device's operating system will ask you to grant certain permissions:

Photos / Storage: to read photos you choose to edit and to save processed results back to your library or to the app's private folder.
Camera: only used while you are on the camera screen, to capture a new photo. Frames are processed locally and discarded when you leave the screen unless you tap the shutter.

You can grant or revoke each permission at any time in your device settings. Declining a permission only disables the dependent feature; the rest of the App continues to work.

7. Third parties

We do not sell or rent personal data, and we do not share the photos you submit to the Smart Tools with any third party. To operate optional accounts we rely on a few service providers acting on our behalf: Google and Apple process sign-in when you choose those methods (under their own privacy policies), and our email service provider delivers verification codes to your address. The distribution platform you obtained the App from (Apple App Store or Google Play) collects its own analytics about app installs, crashes, and ratings under its own privacy policy; we receive that information only in aggregated form. If you make a purchase, Apple or Google acts as the payment and subscription processor and shares purchase and subscription status with us (but not your payment card details) so we can activate your membership (see Section 15). If you switch on “Diagnostics & crash reports” in Settings, crash reports are processed on our behalf by Google (Firebase Crashlytics). A report contains the crash stack trace, your device model, operating system version, app version and build number, app language, the screen you were on, and a coarse membership state (guest / free / active / expired). It never contains your photos, the text you enter, file names or paths, your email address, account identifiers, authentication tokens, or purchase receipts. This setting is off unless you turn it on, you can turn it off again at any time in Settings, and doing so stops all further uploads and discards any reports still queued on your device. We do not use Google Analytics for Firebase and the App contains no Analytics SDK.

8. International transfers

Local filters and presets never leave your device. Photos you submit to the Smart Tools, along with account information and support emails, are processed on our servers, which may be located in other countries; photos are deleted immediately after processing. Where required, we put appropriate safeguards in place for such transfers. You can ask us about the current arrangements at any time.

9. Data retention

Photos, presets, and other in-app data persist on your device for as long as you keep the App installed and do not delete the data yourself. Uninstalling the App removes the App's private storage. Photos you submit to the Smart Tools are deleted immediately after processing and are not retained on our servers. If you create an account, we keep your account information until you delete your account or it becomes inactive; one-time verification codes expire within minutes and are then purged. You can delete your account and all associated server-side data at any time from Settings → Delete Account, or by emailing us at support@lumeoprime.com. We retain support emails only for as long as necessary to handle the request and any follow-up.

10. Security

We rely on the security features of your device's operating system (sandboxed app storage, OS-level encryption where available) to protect on-device data. Photos you submit to the Smart Tools are transmitted over an encrypted (HTTPS/TLS) connection and deleted immediately after processing. Please keep your device and operating system up to date. No transmission or storage method is 100% secure; please use the App accordingly.

11. Children

The App is rated for general audiences and is not directed at children under 13 (or under 16 in the EEA / UK, where higher). We do not knowingly collect personal data from children. If you believe a child has sent us personal data, please contact us so we can delete it.

12. Your rights under the GDPR

If you are located in the European Economic Area, the United Kingdom, or Switzerland, you have the following rights with respect to personal data we hold about you (your account information and the contents of your support emails, if any):

Right of access — to obtain a copy of the personal data we hold about you.
Right to rectification — to correct inaccurate or incomplete data.
Right to erasure ("right to be forgotten") — to ask us to delete your data.
Right to restriction of processing — to ask us to limit how we use your data.
Right to data portability — to receive your data in a structured, machine-readable format.
Right to object — to object to processing carried out on the basis of our legitimate interests.
Right to withdraw consent — where processing is based on consent, you may withdraw it at any time.
Right to lodge a complaint with your local data-protection supervisory authority.

To exercise these rights, email us at support@lumeoprime.com. We will respond within one month, subject to extensions permitted by law.

13. Your rights under the CCPA / CPRA (California)

If you are a California resident, you have the following rights:

Right to know what personal information we have collected, used, disclosed, or sold.
Right to delete personal information we collected from you.
Right to correct inaccurate personal information.
Right to opt out of the sale or sharing of personal information — we do not sell or share personal information as those terms are defined under the CCPA/CPRA.
Right to limit the use of sensitive personal information — we do not collect sensitive personal information.
Right to non-discrimination for exercising any of the above rights.

To exercise these rights, email support@lumeoprime.com. We may need to verify your identity before responding.

14. Do Not Track

The App does not track you across third-party websites or services, and does not respond to Do Not Track browser signals because it does not perform such tracking in the first place.

15. Subscription and purchase data

If you buy a subscription or the Boost pack, the payment itself is processed by Apple or Google. We do not receive or store your payment card number or other payment credentials. To activate and maintain your membership or credits, we receive and store on our servers a limited set of purchase data: the store transaction / purchase token, the product and subscription status, the purchase and expiry dates, and an account identifier that links the purchase to your account (an Apple appAccountToken or a Google obfuscated account id). Apple and Google may also send us server notifications about renewals, cancellations, and refunds so we can keep your entitlement up to date. We process this data to perform our contract with you (to provide the paid features) and to keep accurate order records, and we retain it for as long as needed to manage your subscription and to meet legal, tax, and accounting obligations.

16. Changes to this Policy

We may update this Privacy Policy from time to time. Material changes will be highlighted in the App and reflected in the "Last updated" date above. Your continued use after the change means you accept the updated Policy.

17. Contact

Privacy questions, requests, and complaints can be sent to Bifrost Studio at support@lumeoprime.com.