Responsibility and contact
This policy explains information processing by Lopumi, operated by an individual developer. Contact marcni1998@gmail.com for data rights and operator information. The brand and Japanese service region do not establish that the operator, host or all data are in Japan. See commercial disclosures for operator disclosure and paid-service availability.
Data and purposes
We process account email, secure password-verification data, verification codes, sessions, optional name/avatar and chosen third-party login details; images, file information, choices, prompts, adaptation, previews, crops and outputs; orders, channel identifiers, amounts/currency, subscriptions, credit sources/reservations/consumption, refunds and disputes; reviews, permissions and support communication; IP or its hash, device category, source parameters, language, security and error records. These support requests, authentication, abuse prevention, payment verification, performance, recovery, support, necessary legal duties and service analysis. Withholding necessary data can prevent a specific feature; unrelated sensitive data are not required.
Permission and legal basis
Necessary processing follows applicable law for the requested service, legal duties and other applicable grounds. Optional purposes requiring consent are explained separately. Uploading does not authorize public marketing, sale or model training by Lopumi. Providers may have independent purposes; our commitments do not replace their contracts. Obtain rights to others' images and avoid unnecessary identity documents, location, health or private information about minors.
Images and optional vision
Images may be resized, converted, hashed, watermarked or cropped. Necessary references and prompts are sent through the selected product's image-generation route. Multiple materials reference the same collection; internal originals and crops remain access-controlled. If you choose enabled DeepSeek scene adaptation, only one designated main-image thumbnail and the base scene/permitted style are sent to adjust activity, not authenticate identity. Administrative translation sends its relevant text, not user photos merely because the provider is shared. Additional credits and time are disclosed before selection.
Service providers
PayPal processes orders, amounts/currency, necessary contact and payment/subscription identifiers. Resend (Plus Five Five, Inc.) processes recipient addresses, account/result/notification email content and delivery events. Cloudflare processes website requests, transport and protection information. DeepSeek processes translation text and selected vision input. Image generation uses routes such as NezhaGate or APIMart selected for the product, receiving references and prompts; not every request goes to every route and the model brand does not imply a direct contract with its developer. Chosen identity providers process authorized login data. When Waffo is selected, Waffo processes the order, product, amount/currency, necessary contact and payment/subscription identifiers required for the production purchase. Payment details are processed through its checkout and the actual payment providers under their terms. Payment and other providers may act independently rather than solely on our instructions.
Locations and provider terms
Providers may process or access data across borders. We do not promise Japan-only storage or that every external AI provider never retains or trains on data. Actual recipients, regions, retention and opt-out terms depend on the service and contract; processing requiring additional notices or consent is enabled only when those conditions are met. Request processing information by email. Public references include PayPal's privacy statement, resend.com/legal/privacy-policy, cloudflare.com/privacypolicy and the applicable DeepSeek open-platform terms. DeepSeek's consumer chatbot privacy policy is not this downstream application's processing notice.
Retention and deletion
Input retention starts at upload; final retention starts at persistence under the product version. Pages show actual expiry. Common new-product defaults are 72 hours for inputs and 168 hours for finals, not universal historical terms. Previews are typically 24 hours; originals and crops have separate expiry with protection for accepted or unresolved work. Cleanup may be asynchronous; storage is not permanent. Only necessary transaction, dispute, security and support records remain for performance, disputes or applicable legal duties. Backup rotation and restoration safeguards apply; deletion does not immediately erase every backup or provider copy. Copies downloaded by you or recipients cannot be removed by us.
Reviews and sharing
Aggregate ratings include all eligible genuine feedback regardless of featuring or individual-publication consent. A name, avatar and individual review need separate permission, which can be withdrawn. Email and uploaded photos are not published by default; image publication requires separate permission. Active sharing or result-email delivery can create bearer-access links for designated results, potentially without login. Expiry or revocation cannot recall previously downloaded copies. Protect your mailbox and links.
Cookies and analytics
Necessary cookies/local storage support login, anonymous upload/purchase ownership, language and request recovery. Login typically lasts about 7 days, anonymous sessions 30 days and language preferences up to a year, subject to logout, revocation and configuration. Visit events and source parameters such as UTM support statistics, attribution and security, so usage is not limited to login cookies. Nonessential purposes requiring consent need the applicable choice; we do not claim to operate every form of cookie management. Clearing browser storage may impair recovery but does not erase orders, delete an account or stop renewal.
Rights, security and changes
Request access, correction, deletion, account closure, withdrawal of optional consent and other applicable rights by email. We verify identity proportionately and explain necessary restrictions; there is no promise of one-click complete deletion. Recurring billing must first be verified stopped, while lawful financial and dispute records remain. Minors must meet applicable age/guardian requirements. Access control, credential protection and necessary audit reduce risks, without promising absolute security or end-to-end encryption. Notifiable incidents are investigated, contained and communicated under applicable law. Versions and actual effective times are published, with notices and renewed consent where required; old consent does not extend automatically to new marketing or training.
Marketing eligibility, abuse controls and review
Registration-gift abuse controls and one-level invitation attribution process invite codes, server-verified human-check results, a signed device cookie, an IP digest only after trusted-proxy verification, keyed digests of provider-confirmed equivalent email identities, campaign version/budget, and gift, first-payment and refund facts. Device cookies last up to about 180 days, invite cookies about 30 days, and unconsumed verification proofs about 10 minutes. Raw challenge tokens are not stored. Minimal eligibility digests and financial contribution records may remain after account deletion to prevent repeat claims and support reconciliation, disputes and lawful obligations; campaign revisions do not reset them. Marketing controls do not retain raw IPs or full browsing trails. Cloudflare Turnstile is used for human checks and the browser communicates with that service for security verification. A shared network or legitimate private email is not alone grounds for account suspension. Temporary and catch-all email cannot be identified perfectly; uncertainty affects gift eligibility or review. Contact support for eligibility review and data rights, subject to necessary lawful retention.