Consent to Personal Data Processing

Version 0.15 · 1 October 2026

1. Controller and scope

I give this consent to the CamLuma operator: Individual Entrepreneur Nikoyan Vachagan Arturi, registration and tax number 20309749, registered address Avan 6th, 28, Yerevan, Armenia. Contact for questions, withdrawal and personal-data requests: support@camluma.com. Website: https://camluma.com.

This consent concerns the account, photographs and related service processing specified below, to the extent that consent is the applicable legal basis. The Privacy Policy at https://camluma.com/legal/privacy-policy has been made available to me. The Public Offer at https://camluma.com/legal/public-offer governs the service and purchases. This consent is a separate document available at https://camluma.com/legal/consent-to-processing.

Processing that has a separate lawful basis, such as performance of a contract, compliance with law or a permissible legitimate interest, remains governed by that basis and the Privacy Policy. This document does not turn every operation into consent-based processing or authorise unnecessary data collection.

2. Data and purposes

Account and authentication: email address, account identifier, language, registration and verification details, authentication and session information, selected preferences, and the time of accepting the Terms or providing consent. Purposes: creating and securing the account, confirming email, signing in, recording the relevant permission and sending necessary service messages.

Photographs and results: the image I submit, people and information visible in it, any included metadata, selected effect and face mode, processing parameters and the resulting image. Purposes: applying the requested AI lighting and colour effect, returning the result, keeping the permitted result history and investigating a related support request.

Payments and service records: plan and subscription status, trial use, edit balances, payment and subscription references, amount, currency and dates; generation identifier, file type and size, status, deduction source, error code or text, timing and storage metadata. Purposes: providing purchased access, accounting for edits, reconciling purchases and manual refunds, diagnosing failures, preventing abuse and dealing with applicable duties or claims. CamLuma does not receive or store the full payment-card number.

Support and necessary technical data: correspondence and attachments I send, account or request identifiers, relevant IP, browser or device information, security events and errors. Purposes: responding to requests, keeping the service secure and reliable, and investigating specific incidents. The original image and its base64 content are not written to CamLuma backend error logs.

Registration source: a partner code from a first-visit referral link may be stored in a first-party HttpOnly cookie for 30 days and copied to the account upon registration, solely to attribute that registration. It is not sent to PostHog or used for cross-site tracking. Its legal basis, cookie classification and account retention are described in Privacy Policy sections 3, 9 and 14.3; this general consent does not replace any separate cookie consent required by law.

3. Permitted operations and limits

For the stated purposes, processing may include collection and receipt, recording, organisation, storage where stated, retrieval and access, correction, use, automated image transformation, transmission or provision of access to the listed recipients, restriction, irreversible anonymisation, deletion and destruction. Processing may be automated or performed with limited authorised human involvement for support, security, payments and privacy requests.

I do not give permission through this document to publish private photographs in advertising, create a public gallery, train CamLuma’s own models, or opt my images into the BytePlus data-sharing or model-improvement programmes described as disabled in the Privacy Policy. CamLuma does not separately build a facial-identity database or use facial templates to identify me.

This consent does not authorise inference of sensitive characteristics or unrestricted processing of health, identity-document or other sensitive information. I should not submit unnecessary sensitive information. If an intended use requires additional specific authorisation under applicable law, this general document does not replace it.

For a photograph of another person, I must have the necessary rights, provide the relevant privacy information and have a valid legal basis or representative authority. My acceptance alone does not constitute that other person’s consent. For a child’s photograph, the parent’s or legal guardian’s authority and any additional rights of the child must be respected. Business processing may require a separate data-processing agreement.

4. Recipients and countries

Data relevant to each task may be processed by the following recipients. Not every recipient receives every category. Dodo also acts as an independent controller for the payment and other purposes it determines. PostHog is listed for transparency only: the consent in this document does not authorise analytics.

5. International transfers

The stated service involves processing in Armenia and transfers to or access in the provider locations in section 4, including Germany, Malaysia, South Korea and the United States. Provider support and authorised subprocessors may operate in other countries under their applicable arrangements. A selected storage region does not guarantee that every operation occurs only there. Different countries may provide different protections.

Where consent is legally required for a specified transfer covered by this notice, I give it only for the stated data, recipients and service purposes. This is not blanket permission for transfers to unspecified recipients for new purposes and is not a general waiver of data rights. CamLuma must still meet the transfer requirements applicable to the relevant route, including required contractual or other safeguards and Armenian requirements. This document is not relied on as a general derogation replacing safeguards for routine EEA or UK transfers.

Information about the applicable transfer arrangements and available safeguards may be requested at support@camluma.com, subject to lawful protection of confidential terms. If additional, specific transfer consent is required, it must be obtained before that transfer.

6. Duration and retention

This consent takes effect when I click “I agree and continue” in the document acceptance window shown before my first photo processing, before I select or send a photo to the server. It applies to the specified purposes while they remain necessary, until I withdraw it or the relevant retention period ends, subject to processing independently permitted or required by law. The window requests renewed acceptance when a new edition of the documents is introduced. A new incompatible purpose is not covered merely because this document is updated, and a later consent does not retrospectively authorise earlier processing.

Original photographs are handled transiently in CamLuma server memory and are not deliberately saved in its permanent image storage or application database. This does not mean that BytePlus retains nothing. BytePlus may keep inputs or outputs flagged by its content filter for up to 180 days in Malaysia. No single fixed retention period for every other request is promised.

Saved website results are scheduled for deletion 30 days after successful storage. Cleanup normally runs hourly and at backend startup; outages or deletion errors may delay physical deletion and lead to retries. A signed download link remains valid for up to seven days from issue, without extending the file’s retention period.

Account data, including the email in Supabase and its copy in the Frankfurt application database, and relevant edit balances are kept while needed to operate the account. The registration-source account entry is kept while the account exists, subject to earlier deletion when its purpose ends or applicable rights require it. Account closure and data deletion are handled manually on request to support@camluma.com.

Generation records have no automatic age-based deletion in the current configuration. Backend error logs rotate according to storage size and available disk space, without a fixed age limit. These records, support correspondence and proof of acceptance are kept only as needed for the disclosed purpose and justified legal duties or claims, and are then deleted or irreversibly anonymised. Required payment and tax records are retained for the applicable statutory periods. A duty to retain payment records does not justify retaining photographs unnecessarily.

DigitalOcean backend backups are retained for seven days and may contain database records, including email, but not the result files in Spaces. Applicable deletion requests must be respected after restoration. The current Supabase configuration has no scheduled project backups. Copies independently downloaded or shared by a user are not all under CamLuma’s control.

Analytics and browser-storage lifetimes are described in Privacy Policy sections 6, 9 and 14. They are disclosed separately and are not authorised by this consent. Lawful retention exceptions are explained on request where permitted.

7. Withdrawal deletion and consequences

I may withdraw all or a specified part of this consent by emailing support@camluma.com, preferably from my account email, and identifying the relevant account, image or processing. No prescribed form is required. CamLuma may ask for proportionate information to confirm identity or representative authority. Requests are handled manually within the deadlines required by applicable law.

Withdrawal stops processing that depends on the withdrawn consent. Relevant data is deleted or, where lawful, irreversibly anonymised unless an independent legal ground requires or permits limited continued processing. Withdrawal does not make earlier lawful processing unlawful. CamLuma explains applicable exceptions and deals with relevant provider requests under the applicable legal and contractual arrangements.

If the information may no longer lawfully be used and is necessary for a requested function, that function may no longer be provided; for example, processing cannot continue without the selected photograph, and an account cannot operate without its necessary account data. A withdrawal does not itself waive refund, consumer or data rights.

I may also ask for account closure or deletion at the same email address. Subscription cancellation is handled through Account → Manage subscription in the Dodo portal, with support available for assistance. Data deletion, stopping renewal and requesting a refund are distinct actions; I can specify them together in my request. Applicable purchase and refund rights remain governed by the Public Offer.

Depending on applicable law, I may also request access, correction, restriction or portability, object to relevant processing and complain to a competent data protection authority. Privacy Policy section 11 provides further information.

8. Separate analytics choice and confirmation

This consent does not include optional analytics cookies or PostHog product analytics and error tracking. They are enabled only through a separate affirmative Analytics choice in the cookie banner or Cookie settings. Declining that choice does not prevent account registration or use of paid features.

If I separately agree to analytics, PostHog Cloud US in the United States receives my account ID and email with the disclosed browser and server events and error information. Session Replay is disabled. I may withdraw that separate choice in Cookie settings; collection stops and the relevant browser storage is removed. Existing PostHog data is not automatically deleted by the browser action; manual deletion and any erasure duty without a second request are explained in Privacy Policy section 6.

By clicking “I agree and continue” in the document acceptance window, I confirm that I am at least 18, accept the Public Offer and give the specific consent described in this document. Before that action, the Public Offer, this Consent and the Privacy Policy are made available to me through links in the window. A separate personal-data consent checkbox is not used in this flow; the same button records the combined action, and its acceptance time is saved. This action does not include consent to optional analytics, which I choose separately in the cookie banner or Cookie settings.

All legal documents: https://camluma.com/legal