1. Privacy at a Glance

The following information provides a simple overview of what happens to your personal data when you visit this website.

2. General Information

The responsible party for data processing on this website is:

LumaEcho
Ürziger Str. 7
50969 Cologne
Germany
Email: info@lumaecho.com

3. Data Collection on This Website

Who is responsible for data collection on this website?
Data processing on this website is carried out by the website operator. You can find their contact details in the imprint of this website.

How do we collect your data?
Your data is collected, on the one hand, by you providing it to us. This could, for example, be data that you enter into a contact form.

4. Audio Recordings and Public Content

Important Privacy Notice:
When you create audio content (posts, echoes, or replies) on LumaEcho, you have the option to set the visibility of your content. Please be aware:

• Public Content: If you set a post, echo, or reply to "PUBLIC", your voice recording will be accessible and audible to everyone, including visitors who are not logged in to the platform.
• Followers Only: Content set to "FOLLOWERS_ONLY" will only be accessible to users who follow you.
• Private Content: Content set to "PRIVATE" will only be visible and audible to you.

Attached Information: For every publicly accessible post, echo, or reply, your username, your profile picture, and the automatically generated transcription of your voice recording (the "comment") are also displayed.

Private Profile: If you set your profile to "private" in your account settings, the "PUBLIC" setting on your posts and echoes no longer applies without restriction: this content — including your username, profile picture, and transcription — is then only visible to yourself and to users you have approved as followers. Content set to "FOLLOWERS_ONLY" or "PRIVATE" is unaffected, since the narrower visibility already applies to it.

By uploading and publishing audio recordings, you consent to the storage and accessibility of your voice data according to the privacy settings you have chosen. Public content will be accessible to anyone, including non-registered visitors. You can delete your audio content at any time.

5. Third-Party Data Processors

To provide our services, we use trusted third-party service providers who process your personal data on our behalf. These processors are contractually bound to comply with GDPR requirements and process data only according to our instructions.

OpenAI (Transcription Service)
We use OpenAI's Whisper API to automatically transcribe your audio recordings into text. When you upload audio content:

• Your audio file is transmitted to OpenAI's servers for processing
• OpenAI transcribes the audio into text format
• The transcription is returned to us and stored in our database
• OpenAI does not retain your audio data after processing (per their API usage policy)
• Data transfer occurs to the United States (OpenAI is a US-based company)

Purpose: Transcriptions enable search functionality, accessibility features, and content moderation.
Legal basis: Legitimate interest (Art. 6 Para. 1 lit. f GDPR) and your consent when uploading content.
OpenAI Privacy Policy: https://openai.com/privacy

OpenAI (LumaBot – Automated Community Replies on Daily Prompts)
We use OpenAI's GPT-4o-mini API to let "LumaBot", our automated community companion, respond on the daily writing/speaking prompt ("Daily Prompt"). Unlike the AI text correction and dictation features (see below), you do not need to trigger this processing yourself — it happens automatically:

• When a new Daily Prompt post is published, its text is transmitted to OpenAI so LumaBot can write a welcoming icebreaker reply
• The first time you reply to a Daily Prompt post with an echo, the text of your echo (or, for voice recordings, the automatically generated transcription) along with the prompt's text is transmitted to OpenAI so LumaBot can react personally to your reply
• Every reply generated by LumaBot is additionally screened through OpenAI's Moderation API before publication, to detect and withhold inappropriate content
• Data transfer occurs to the United States (OpenAI is a US-based company)

Purpose: Automated, personal reactions to encourage community engagement with the Daily Prompt feature.
Legal basis: Legitimate interest (Art. 6 Para. 1 lit. f GDPR) in a lively community feature, as well as your consent through your use of the Daily Prompt feature.
OpenAI Privacy Policy: https://openai.com/privacy

OpenAI (AI Text Correction)
We use OpenAI's GPT-4o-mini API to power the optional AI text correction feature. When you actively tap the sparkle (✦) button to check your draft text:

• The draft text you have written is transmitted to OpenAI's servers for grammar and style analysis
• The corrected suggestion is returned to you — you decide whether to apply it or discard it
• This transmission only occurs when you deliberately trigger the feature — your text is never sent automatically
• Data transfer occurs to the United States (OpenAI is a US-based company)

Purpose: Improving the quality and clarity of user-generated text content.
Legal basis: Your explicit consent (Art. 6 Para. 1 lit. a GDPR) — the feature is entirely optional and only triggered by you.
OpenAI Privacy Policy: https://openai.com/privacy

OpenAI (Voice Dictation Feature)
We also use OpenAI's Whisper API for the optional dictation feature in the post, echo, and reply text editors. When you tap the microphone icon to enter text by speaking:

• Your short voice recording is transmitted to OpenAI's servers for transcription
• The transcribed text is returned to you and inserted at the cursor position in your text field
• Unlike voice posts (posts, echoes, replies), this recording is not stored permanently — it is used solely for transcription and deleted from our servers immediately afterward
• This transmission only occurs when you deliberately trigger the feature — no voice post is published
• Data transfer occurs to the United States (OpenAI is a US-based company)

Purpose: Dictating text as an alternative to typing in post, echo, and reply editors.
Legal basis: Your explicit consent (Art. 6 Para. 1 lit. a GDPR) — the feature is entirely optional and only triggered by you.
OpenAI Privacy Policy: https://openai.com/privacy

Cloudflare (Security and Bot Protection)
We use Cloudflare to provide:

• Bot detection and protection during login/registration
• DDoS protection and security services
• SSL/TLS encryption for data transmission
• Web application firewall

Cloudflare may process metadata such as IP addresses, request headers, and access logs during authentication processes.
Data transfer: Cloudflare operates globally with servers in the EU and other regions.
Legal basis: Legitimate interest (Art. 6 Para. 1 lit. f GDPR) for security and fraud prevention.
Cloudflare Privacy Policy: https://www.cloudflare.com/privacypolicy

DeepL (Translation Service)
We use the DeepL API to translate transcriptions of audio content (posts and echoes) into other languages. When you request a translation:

• The text transcription of the audio content is transmitted to DeepL SE servers for translation
• DeepL translates the text into your preferred language
• The translated text is returned to us and displayed to you
• DeepL does not store your data after processing (per their API terms)
• DeepL SE is a German company with servers in the EU

Purpose: Translations enable users to understand content in other languages.
Legal basis: Legitimate interest (Art. 6 Para. 1 lit. f GDPR) and your consent when requesting a translation.
DeepL Privacy Policy: https://www.deepl.com/privacy

Data Transfer Safeguards
For transfers to third countries (e.g., USA), we ensure adequate protection through:

• Standard Contractual Clauses (SCCs) approved by the EU Commission
• Data Processing Agreements (DPAs) with all processors
• Regular security and compliance audits

6. Analytics (Plausible Analytics)

We use the privacy-friendly web analytics service Plausible Analytics to collect anonymized usage statistics (e.g. number of page views, referral source, device type). The service is self-hosted and runs on our own server in Germany — no data is shared with third parties.

Plausible Analytics:

• does not use cookies or any other persistent browser storage
• does not collect personal data and does not create cross-device profiles of individual visitors
• processes IP addresses only briefly to calculate unique visitor counts and does not store them afterwards (hashed with a daily-rotating salt)
• is fully GDPR, ePrivacy, and CCPA compliant

Since no cookies are set and no personal data is stored, no consent is required under the ePrivacy Directive and Art. 6 Para. 1 lit. f GDPR. The legal basis is our legitimate interest in understanding and improving our website.
More information: https://plausible.io/data-policy

7. Rights of the Data Subject

You have the right at any time to:

• Request information about your stored data
• Request correction of incorrect data
• Request deletion of your data
• Request restriction of data processing
• Request data portability
• Object to data processing

8. Cookies

This website uses cookies. Cookies are small text files stored on your device. We distinguish the following types:

Strictly necessary cookies (no opt-in required):

• Authentication cookies (JWT access and refresh tokens, HttpOnly)
• Cookie consent cookie (lumaecho-cookie-consent, 365 days)

9. Server Log Files

The provider of the pages automatically collects and stores information in so-called server log files, which your browser automatically transmits to us.

10. Contact

If you have any questions about data protection, please send us an email to: info@lumaecho.com