Privacy Policy

Lunzo is operated by Alireza Namazian, a sole proprietor based in British Columbia, Canada ("Lunzo," "we," "our," or "us"). We are responsible for the personal information described in this policy (the "controller" under the GDPR). Our privacy officer is Alireza Namazian, reachable at support@lunzoai.com.

This policy covers the lunzoai.com website and the Lunzo app at app.lunzoai.com, including the generator and Studio editor (the "Service"). It explains what we collect, why, who we share it with, how long we keep it, and the rights you have.

• Account data: email address, name, password (stored only as a hash), sign-in method (including Google or Apple sign-in), and two-factor authentication settings.
• Face model data: the photos you upload to create a face model, the reference portraits and descriptions generated from them, and the images you generate with them. See Face Models below.
• Brand and style assets: logos, colours, fonts, brand guideline files, style samples, and channel links you add.
• Generation and Studio data: titles, prompts, format choices, generated images, Studio projects, and feedback you send us.
• Connected accounts: if you connect YouTube or Instagram, the read-only access tokens and the channel or account details, statistics, and thumbnails those platforms return. We cannot post or change anything on those accounts.
• Billing data: plan, credit balance, invoices, and payment history. Card details are entered directly with our payment processor, Stripe, and never reach our servers.
• Messages to us: what you send when you email support or report a problem.
• Technical data: IP address, browser and device type, error logs, anonymous page-performance measurements, and the result of an automated bot check when you sign up.

• To provide the Service: your account, generations, Studio, face models, connected-account analytics, and billing. Legal basis: performance of our contract with you.
• To create and use face models. Legal basis: your explicit consent, which you can withdraw at any time by deleting the face model.
• To keep the Service secure: preventing fraud, abuse, and spam sign-ups, and fixing errors. Legal basis: our legitimate interest in a safe, working service.
• To send account and billing emails such as receipts and security notices. Legal basis: performance of our contract.
• To improve the Service, using usage and technical data (not your images or prompts) to understand which features work and fix problems. Legal basis: our legitimate interest in improving the Service.
• To send product news and offers, only with your consent or where the law allows it, such as Canada's anti-spam law for existing customers. Every such email has an unsubscribe link. Legal basis: consent.
• To meet legal obligations, such as tax records and responding to lawful requests. Legal basis: legal obligation.

We do not use your uploads, prompts, or generated images to train AI models, and we will not start without asking for your permission first. We may use information that has been aggregated or de-identified, so it can no longer identify you, for any purpose, such as usage statistics. We do not sell your personal information, and we do not share it for targeted or cross-context behavioural advertising. We do not make decisions about you based solely on automated processing that have legal or similarly significant effects. Apex scores are suggestions about your images, not decisions about you.

To create a face model, you upload photos of a face. We send those photos to Google's Gemini API to generate a reference portrait and a short written description, which we store with the photos in your account. When you generate an image with a face model, we send the reference portrait and photos to the AI model you choose (see the list below) so it can depict that person.

Some laws treat face images, or data derived from them, as biometric or sensitive information. We use face model data only to generate the images you ask for. We do not use it to identify or verify anyone, we do not sell, lease, or trade it, we do not use it to train AI models, and we share it only with the AI providers that generate your images.

Face model photos are kept in private storage. You view them through short-lived links, our servers read them only to process your own requests, and only authorised Lunzo staff can see them, when reviewing content for safety. Before you create a face model, we ask for your explicit consent and record when you gave it.

You may create a face model only of yourself, or of an adult who has explicitly consented. Face models are kept until you delete them or your account. When you delete a face model, its photos and reference images are queued for deletion and removed from our storage, normally within a day.

We share personal information only with service providers that help us run the Service, only as much as each needs, and under their data-processing terms. These are the providers we use today; we may add or replace providers and will update this list when we do:

• Supabase — database, sign-in, file storage, and server functions.
• Vercel — website and app hosting, and anonymous performance measurements.
• Stripe — payments, subscriptions, and invoices.
• Zoho (ZeptoMail) — account and billing emails, from data centres in Canada.
• Cloudflare (Turnstile) — the bot check at sign-up.
• Google Analytics — visit statistics for this marketing site, with cookies only after you accept.
• Google Fonts — fonts loaded by the app, which share your IP address with Google.
• AI providers, which receive your prompts and any images needed for a request: Google (Gemini), OpenAI, Black Forest Labs (FLUX), fal.ai (image upscaling and layer extraction), and BytePlus, part of the ByteDance group (Seedream), which processes requests in South-East Asia.
• Google (YouTube API Services) and Meta (Instagram), only if you connect those accounts.

We use these AI providers through their business APIs and do not authorise them to train their models on what we send. One exception: Black Forest Labs' API terms let it use requests to improve its models. We have asked it to opt us out, and until that takes effect, prompts and images sent to the FLUX models may be used under its terms. To avoid this, choose another model. Each provider may keep requests for a limited time under its own terms, mainly to detect abuse, usually between 30 and 55 days and up to 180 days for content its safety filters flag.

We may also disclose information if the law requires it, to protect someone's safety, or as part of a sale or reorganisation of the business, in which case this policy will continue to apply to it.

The YouTube connection uses YouTube API Services. By connecting YouTube you also agree to the YouTube Terms of Service, and Google's handling of the data is covered by the Google Privacy Policy. We use the read-only data only to show your channel analytics and inform your designs.

You can disconnect YouTube or Instagram in the app at any time, which deletes the stored access tokens. You can also revoke Lunzo's access to YouTube in your Google account permissions and to Instagram in your Instagram settings. Data we stored from a connected account is deleted when you disconnect it or delete your account.

We are based in Canada, and our providers process data in Canada, the United States, the European Union, and South-East Asia. The European Commission recognises Canada as providing adequate protection for personal data. When data goes to another country, we rely on our providers' contractual safeguards, such as the EU Standard Contractual Clauses and the EU-US Data Privacy Framework where they participate in it. Data processed in another country may be accessible to that country's authorities under its laws.

Apart from the optional analytics below, we use only the cookies and browser storage needed to keep you signed in, remember your settings, and keep the Service secure. Our performance measurements do not use cookies or identify you. We do not use advertising or cross-site tracking cookies.

This marketing site uses Google Analytics to count visits and see which pages and links bring people here. Google Analytics sets cookies only if you accept them in the cookie banner; until then it receives only cookieless signals with no identifier. Ad storage and ad personalisation stay off either way. You can change your choice at any time with “Cookie settings” in the footer. Google processes this data under the Google Privacy Policy.

• Account data: until you delete your account.
• Face models: until you delete them or your account.
• Files and generations: while your account is active; when a subscription ends we keep them for 90 days and may delete them after that.
• Connected-account data: until you disconnect the account or delete your account.
• Billing records: for as long as tax law requires, which in Canada is generally six years.
• Security and error logs: only as long as needed to investigate problems.

Depending on where you live, you can ask us to give you a copy of your personal information, correct it, delete it, restrict or object to how we use it, or send it to you in a portable format, and you can withdraw consent at any time. You can delete face models, connected accounts, and your whole account yourself in the app. For anything else, email support@lunzoai.com. We may ask you to confirm your identity, and we answer within 30 days.

We will not treat you differently for using these rights. California residents have the right to know, delete, and correct their personal information; we do not sell or share it as those terms are defined in California law.

If you are not satisfied with our answer, you can complain to your data protection authority: in Canada, the Office of the Privacy Commissioner of Canada or the Office of the Information and Privacy Commissioner for British Columbia; in the EU or UK, your local supervisory authority or the UK ICO.

We protect your information with encryption in transit, per-account access rules in our database, optional two-factor authentication, and limited internal access. No system is perfectly secure. If a breach creates a real risk of significant harm to you, we will notify you and the relevant authorities as the law requires.

The Service is for people aged 18 and over. We do not knowingly collect personal information from anyone under 18, and images of minors may not be uploaded. If you believe a minor has given us personal information, contact us and we will delete it.

We may update this policy at any time and will post the update on this page with a new date. For a material change, we will give you reasonable advance notice by email or in the app. You can read our Terms of Service for the rules of using the Service.

For any privacy question or request, email support@lunzoai.com.