1. Privacy at a Glance

The following information provides a simple overview of what happens to your personal data when you visit this website.

LumaEcho is not aimed at persons under the age of 16. We do not knowingly collect personal data from children and young people under 16. If we become aware of this, we will delete the data concerned without delay.

2. General Information

The responsible party for data processing on this website is:

LumaEcho
Ürziger Str. 7
50969 Cologne
Germany
Email: info@lumaecho.com

3. Data Collection on This Website

Who is responsible for data collection on this website?
Data processing on this website is carried out by the website operator. You can find their contact details in the imprint of this website.

How do we collect your data?
Your data is collected, on the one hand, by you providing it to us. This could, for example, be data that you enter into a contact form.

4. Audio Recordings and Public Content

Important Privacy Notice:
When you create audio content (posts, echoes, or replies) on LumaEcho, you have the option to set the visibility of your content. Please be aware:

• Public Content: If you set a post, echo, or reply to "PUBLIC", your voice recording will be accessible and audible to everyone, including visitors who are not logged in to the platform.
• Followers Only: Content set to "FOLLOWERS_ONLY" will only be accessible to users who follow you.
• Private Content: Content set to "PRIVATE" will only be visible and audible to you.

Attached Information: For every publicly accessible post, echo, or reply, your username, your profile picture, and the automatically generated transcription of your voice recording (the "comment") are also displayed.

Private Profile: If you set your profile to "private" in your account settings, the "PUBLIC" setting on your posts and echoes no longer applies without restriction: this content — including your username, profile picture, and transcription — is then only visible to yourself and to users you have approved as followers. Content set to "FOLLOWERS_ONLY" or "PRIVATE" is unaffected, since the narrower visibility already applies to it.

Automated content screening: Before a post, echo, or reply is published, we automatically screen the text and the transcription of any voice recording through OpenAI's Moderation API, to detect and block discriminatory, harassing, self-harm-related, sexual, or violence-glorifying content. If a violation is detected, publication is prevented and any already-uploaded audio file is immediately deleted — see the OpenAI entries in Section 5 below for details on this processor.

By uploading and publishing audio recordings, you consent to the storage and accessibility of your voice data according to the privacy settings you have chosen. Public content will be accessible to anyone, including non-registered visitors. You can delete your audio content at any time.

Images:
You can attach images (JPEG or PNG, up to 8 MB; up to 4 per post, 1 per classroom chat message) to posts and classroom chat messages. Images are processed and checked automatically before anyone else can see them:

• We convert every image into two web sizes and delete the original file. This removes all metadata, including EXIF data such as camera details or GPS location.
• Before publication, the reduced version of the image is transmitted to OpenAI's Moderation API (United States) to detect sexual, violent, hateful, or self-harm-related content. Until the check is complete, the image is visible only to you. OpenAI does not retain the reviewed image after processing (per their API usage policy).
• If an image is rejected, it is not published and its files are deleted. To prevent abuse we keep a record of the rejection (your user ID, a cryptographic hash of the file, the date, and the violation category) for 90 days. The hash is used to block re-uploading the same file; after three rejections within 15 minutes, image uploads are temporarily blocked.
• Images that you upload but do not attach to a post or message are deleted automatically after 24 hours.
• Images are stored on our servers in Germany and delivered through time-limited, signed links to the audience of the post or message they belong to. You can delete an image at any time, including in the "My images" tab of your profile. Deleting a post, a message, or your account also deletes the images attached to it.

Legal basis: Performance of the service you requested (Art. 6 Para. 1 lit. b GDPR) and legitimate interest in a safe, legally compliant platform (Art. 6 Para. 1 lit. f GDPR). Please do not upload images showing other identifiable people without their consent.

5. Third-Party Data Processors

To provide our services, we use trusted third-party service providers who process your personal data on our behalf. These processors are contractually bound to comply with GDPR requirements and process data only according to our instructions.

OpenAI (Transcription Service)
We use OpenAI's Whisper API to automatically transcribe your audio recordings into text. When you upload audio content:

• Your audio file is transmitted to OpenAI's servers for processing
• OpenAI transcribes the audio into text format
• The transcription is returned to us and stored in our database
• OpenAI does not retain your audio data after processing (per their API usage policy)
• Data transfer occurs to the United States (OpenAI is a US-based company)

Purpose: Transcriptions enable search functionality, accessibility features, and content moderation.
Legal basis: Legitimate interest (Art. 6 Para. 1 lit. f GDPR) and your consent when uploading content.
OpenAI Privacy Policy: https://openai.com/privacy

OpenAI (Content Moderation)
We use OpenAI's Moderation API to automatically check whether user-generated text content violates our content policies before it is published. This applies to the text or the automatically generated transcription:

• for posts and echoes by logged-in users — both when creating and when later editing them
• for guest comments (see Section 10 below)
• for replies automatically generated by LumaBot (see below)

The text to be published, or its transcription, is transmitted to OpenAI's servers for review. OpenAI returns an assessment of whether, and into which category (e.g. hate, harassment, self-harm, sexual content, violence), the content falls. If content is classified as a violation, its publication is automatically blocked — any already-uploaded audio file is immediately deleted. OpenAI does not retain the reviewed content after processing (per their API usage policy).
Data transfer occurs to the United States (OpenAI is a US-based company).

Purpose: Protecting the community from unlawful, discriminatory, or otherwise harmful content.
Legal basis: Legitimate interest (Art. 6 Para. 1 lit. f GDPR) in a safe, legally compliant platform.
OpenAI Privacy Policy: https://openai.com/privacy

OpenAI (LumaBot – Automated Community Replies on Daily Prompts)
We use OpenAI's GPT-4o-mini API to let "LumaBot", our automated community companion, respond on the daily writing/speaking prompt ("Daily Prompt"). Unlike the AI text correction and dictation features (see below), you do not need to trigger this processing yourself — it happens automatically:

• When a new Daily Prompt post is published, its text is transmitted to OpenAI so LumaBot can write a welcoming icebreaker reply
• The first time you reply to a Daily Prompt post with an echo, the text of your echo (or, for voice recordings, the automatically generated transcription) along with the prompt's text is transmitted to OpenAI so LumaBot can react personally to your reply
• Every reply generated by LumaBot is additionally screened through OpenAI's Moderation API before publication, to detect and withhold inappropriate content
• Data transfer occurs to the United States (OpenAI is a US-based company)

Purpose: Automated, personal reactions to encourage community engagement with the Daily Prompt feature.
Legal basis: Legitimate interest (Art. 6 Para. 1 lit. f GDPR) in a lively community feature, as well as your consent through your use of the Daily Prompt feature.
OpenAI Privacy Policy: https://openai.com/privacy

OpenAI (AI Text Correction)
We use OpenAI's GPT-4o-mini API to power the optional AI text correction feature. When you actively tap the sparkle (✦) button to check your draft text:

• The draft text you have written is transmitted to OpenAI's servers for grammar and style analysis
• The corrected suggestion is returned to you — you decide whether to apply it or discard it
• This transmission only occurs when you deliberately trigger the feature — your text is never sent automatically
• Data transfer occurs to the United States (OpenAI is a US-based company)

Purpose: Improving the quality and clarity of user-generated text content.
Legal basis: Your explicit consent (Art. 6 Para. 1 lit. a GDPR) — the feature is entirely optional and only triggered by you.
OpenAI Privacy Policy: https://openai.com/privacy

OpenAI (Voice Dictation Feature)
We also use OpenAI's Whisper API for the optional dictation feature in the post, echo, and reply text editors. When you tap the microphone icon to enter text by speaking:

• Your short voice recording is transmitted to OpenAI's servers for transcription
• The transcribed text is returned to you and inserted at the cursor position in your text field
• Unlike voice posts (posts, echoes, replies), this recording is not stored permanently — it is used solely for transcription and deleted from our servers immediately afterward
• This transmission only occurs when you deliberately trigger the feature — no voice post is published
• Data transfer occurs to the United States (OpenAI is a US-based company)

Purpose: Dictating text as an alternative to typing in post, echo, and reply editors.
Legal basis: Your explicit consent (Art. 6 Para. 1 lit. a GDPR) — the feature is entirely optional and only triggered by you.
OpenAI Privacy Policy: https://openai.com/privacy

Cloudflare (Security and Bot Protection)
We use Cloudflare to provide:

• Bot detection and protection during login/registration
• DDoS protection and security services
• SSL/TLS encryption for data transmission
• Web application firewall

Cloudflare may process metadata such as IP addresses, request headers, and access logs during authentication processes.
Data transfer: Cloudflare operates globally with servers in the EU and other regions.
Legal basis: Legitimate interest (Art. 6 Para. 1 lit. f GDPR) for security and fraud prevention.
Cloudflare Privacy Policy: https://www.cloudflare.com/privacypolicy

DeepL (Translation Service)
We use the DeepL API to translate transcriptions of audio content (posts and echoes) into other languages. When you request a translation:

• The text transcription of the audio content is transmitted to DeepL SE servers for translation
• DeepL translates the text into your preferred language
• The translated text is returned to us and displayed to you
• DeepL does not store your data after processing (per their API terms)
• DeepL SE is a German company with servers in the EU

Purpose: Translations enable users to understand content in other languages.
Legal basis: Legitimate interest (Art. 6 Para. 1 lit. f GDPR) and your consent when requesting a translation.
DeepL Privacy Policy: https://www.deepl.com/privacy

Data Transfer Safeguards
For transfers to third countries (e.g., USA), we ensure adequate protection through:

• Standard Contractual Clauses (SCCs) approved by the EU Commission
• Data Processing Agreements (DPAs) with all processors
• Regular security and compliance audits

6. Analytics (Plausible Analytics)

We use the privacy-friendly web analytics service Plausible Analytics to collect anonymized usage statistics (e.g. number of page views, referral source, device type). The service is self-hosted and runs on our own server in Germany — no data is shared with third parties.

Plausible Analytics:

• does not use cookies or any other persistent browser storage
• does not collect personal data and does not create cross-device profiles of individual visitors
• processes IP addresses only briefly to calculate unique visitor counts and does not store them afterwards (hashed with a daily-rotating salt)
• is fully GDPR, ePrivacy, and CCPA compliant

Since no cookies are set and no personal data is stored, no consent is required under the ePrivacy Directive and Art. 6 Para. 1 lit. f GDPR. The legal basis is our legitimate interest in understanding and improving our website.
More information: https://plausible.io/data-policy

7. Rights of the Data Subject

You have the right at any time to:

• Request information about your stored data
• Request correction of incorrect data
• Request deletion of your data
• Request restriction of data processing
• Request data portability
• Object to data processing

8. Cookies

This website uses cookies. Cookies are small text files stored on your device. We distinguish the following types:

Strictly necessary cookies (no opt-in required):

• Authentication cookies (JWT access and refresh tokens, HttpOnly)
• Cookie consent cookie (lumaecho-cookie-consent, 365 days)

9. Server Log Files

The provider of the pages automatically collects and stores information in so-called server log files, which your browser automatically transmits to us.

10. Guest Comments

LumaEcho lets visitors who are not logged in ("guests") leave a short text comment under a post. To keep this feature safe from abuse while collecting as little personal data as possible, the following processing takes place:

• IP address (hashed): Your IP address is never stored in plain text. It is hashed (SHA-256 with a dedicated, server-side secret) and used only to enforce a rate limit and to detect abuse. The hash cannot be reversed back into your IP address.
• Cloudflare Turnstile: Submitting a guest comment requires passing a Cloudflare Turnstile challenge to block automated abuse — see the Cloudflare entry in Section 5 above for details on this processor.
• Content moderation: Before publication, the text of your comment is automatically screened through OpenAI's Moderation API to detect and block hateful, harassing, self-harm-related, sexual, or violent content — see the OpenAI entries in Section 5 above for details on this processor.
• Identity: Your comment is shown publicly under a fixed, server-assigned label ("Guest 1", "Guest 2", …) counted per post. No name, email address, or other identifying information is requested, stored, or displayed.
• Delete token (local storage): After you submit a comment, a one-time, random delete token is stored locally in your browser (localStorage, key lumaecho.guestCommentTokens) and is never linked to an identity on our servers. As long as it remains there, your own comment shows a ⋮ menu with a delete option. If you clear your browser data or switch devices, this ability is lost permanently — we cannot restore it for you.

Legal basis: Legitimate interest (Art. 6 Para. 1 lit. f GDPR) in preventing abuse of a publicly accessible, unauthenticated feature. Storing the delete token requires no consent under the ePrivacy Directive, since it is strictly necessary to provide a feature you actively requested — the ability to remove your own comment later.

11. Contact

If you have any questions about data protection, please send us an email to: info@lumaecho.com