Privacy Policy
Effective Date: March 18, 2026 · Last Updated: July 27, 2026
Lumitone ("we," "us," or "our"), a Deruvish Labs LLC service operated at lumitone.io, is built around a single principle: your taste data is yours. This Privacy Policy explains what limited data we process, why, and your rights under the GDPR, CCPA, and KVKK.
1. Minimum Data, Written Down Exactly
We keep as little as we can, and this policy states precisely what that is. For a free analysis we store nothing:
- We do not store your analysis history. There are no accounts, so there is nothing to attach a history to.
- Each recommendation is computed in real-time and the inputs are gone when the request ends.
- We do not cache your queries. Every request is computed fresh; your raw inputs are never written to a database or cache.
- Analysis inputs and results exist only in volatile memory (RAM) for the duration of the computation.
Operational logs, stated plainly. We keep server logs for security and debugging, and we want to be exact about what is in them, because “we only ever log a hash” would not be true:
- Our application log never writes a username. When we fetch a public profile you asked for, the log line carries a short one-way hash so we can trace one request, and nothing else.
- Our web server access log records the URL that was requested, which is what every web server does by default. A results page URL contains the public username you typed, so that username appears in this log in readable form. It is a handle that is already public on the platform it belongs to, we never link it to an identity, and these logs are rotated and deleted after 14 days.
One narrow exception, gifts: when you buy a gift, we store the generated recommendation package together with the input it was generated from (the Letterboxd username or the songs/artists you picked for your friend), plus the buyer and recipient email addresses needed to deliver it. This is the only case in which recommendation results persist. In short: for gift delivery we retain only the data strictly necessary to deliver the gift, and we delete it on request. Gift links themselves remain permanent so your recipient can return anytime; the underlying data is removed whenever you ask us by email.
A second narrow exception, uploaded Letterboxd exports: if you upload your Letterboxd data export (ZIP), the archive is parsed in memory and the raw ZIP and CSV files are not retained after processing: they are never written to our database or to any persistent application or object storage, and our error records carry no file content. What we keep server-side is a derived summary of your film history (catalogue identifiers with rating, liked and watch information, plus counts), because without it a purchase made from that upload could not be delivered or re-shown. It is kept for 24 hours if you do nothing, 7 days once a checkout has been started, and 1 year with a completed purchase, after which it is deleted automatically; you can ask us to delete it sooner at any time. The free result you see stays in your own browser tab only.
2. Data We Process
2.1 Data You Provide
| Data | When | Retention |
|---|---|---|
| User-provided public profile data (a public username you enter) | Requesting an analysis | Not stored for free analyses, processed in real-time and deleted after the session. For a purchase, the username is kept with the purchase record (see below). |
| Songs and artists you pick by hand | Requesting a film analysis | Not stored for free analyses, processed in real-time and deleted after the session. For a purchase, your picks are kept with the payment provider's transaction record so we can deliver and re-show what you bought. |
| Uploaded Letterboxd export (derived viewing history only; the raw ZIP/CSV is not retained after processing and never written to our database or persistent storage) | Uploading your data export for a fuller analysis | 24 hours without a purchase; 7 days once a checkout is started; 1 year with a completed purchase. Deleted sooner on request. |
| Email address & the inputs you purchased for | Purchase (all purchases are guest purchases) | Kept with the purchase record for up to 1 year |
2.2 No Accounts, No Third-Party Access
Lumitone has no user accounts and no third-party sign-in. We never connect to, read from, or write to your Spotify, Letterboxd, or any other account. Everything the Service knows comes from what you type or pick by hand.
2.3 Purchase Records
Payment processing is handled entirely by our payment provider; we never see or store card numbers. We retain transaction identifiers, tier information, and timestamps as required for accounting and fraud prevention.
2.4 Automatically Collected Data
- Cookies: we set none of our own. A results page loads Spotify's embedded player, and Spotify sets two cookies on its own domain as it loads, before you click anything. Our Cookie Policy names them and explains how to stop it.
- In-browser records (sessionStorage, not cookies): your picks, the free result computed from an uploaded export, and a small purchase-attempt record live only in your browser tab and are destroyed when it closes. They are listed one by one in the Cookie Policy; none of them is an identifier we can read across visits.
- Anonymous usage counts: we record which steps of the site get used, so we can see where people get stuck. This is first-party: the data goes to our own database and no third party is involved. We set no cookies for it, we do not record your IP address, and we create no identifier that outlives your browser tab. A random session id is held in your browser's sessionStorage and is destroyed the moment the tab closes, so we cannot connect two visits to the same person. What we store is the name of the step (for example “a result was shown”) plus small non-personal details such as how many items were listed and whether the device is a phone or a desktop. The only free text we keep is a search term that returned no results, so we can find gaps in our catalogue. Kept for up to 180 days, and this is enforced rather than promised: a scheduled job runs every day and deletes anything older.
- Server security logs: we keep standard web server and application logs, exclusively for security, abuse prevention, DDoS protection, and debugging. They contain the IP address, user agent, timestamps, the requested URL, and our own hashed request identifiers. Web server access logs are deleted after 14 days. Application logs are capped by size rather than by date: we keep the most recent 30 MB per service and older lines are discarded as new ones arrive. As explained in section 1, a public username you type appears in the access log because it is part of the URL; it is never written to the application log. These logs are never used for profiling, analytics, or marketing.
3. How We Use Data
| Purpose | Legal Basis (GDPR) |
|---|---|
| Generate AI recommendations in real-time from data you provide | Contractual necessity |
| Process payments and deliver purchased content (including gifts) | Contractual necessity |
| Send transactional emails containing your requested results | Contractual necessity |
| Security, fraud and abuse prevention | Legitimate interest |
4. What We Do NOT Do
- We do not store your analysis history or query results (except gift deliveries and the derived history behind an uploaded-export purchase, both described above).
- We do not sell your personal data to any third party.
- We do not share your data for advertising or marketing purposes.
- We do not use your data to train or improve our machine learning models.
- We do not track you across other websites, and we use no third-party analytics, advertising pixels, or social media scripts. The anonymous usage counts described in 2.4 are our own, stay on our own infrastructure, and are never shared.
We are not affiliated with, endorsed by, or sponsored by any third-party media or music platforms.
5. Service Providers
We share data only with the following processors, strictly as necessary to operate the Service, and only at the moment of the relevant transaction:
| Provider | Purpose | Data Processed |
|---|---|---|
| Stripe | Payment processing | Email, payment details (handled by Stripe), and order parameters including the username or song/artist picks you supplied |
| Resend | Transactional email delivery | Recipient email and message content at the moment of sending; Resend retains standard delivery logs under its own policy |
| Supabase (EU) | Purchase & gift delivery database | Purchase records, gift packages, and the derived viewing history behind uploaded-export purchases, as described above |
| Hetzner (Finland, EU) | Server infrastructure | Encrypted data at rest on our servers |
6. Data Retention Summary
| Data Type | Retention Period |
|---|---|
| Analysis inputs & results, free analysis | Not stored, real-time processing only |
| Analysis inputs, purchased analysis (the username or the picks you bought for) | Kept with the purchase record, 1 year after purchase |
| Uploaded Letterboxd export, derived viewing history (raw ZIP/CSV not retained after processing) | 24 hours without a purchase; 7 days once a checkout is started; 1 year with a purchase |
| Fulfilment problem records (payment reference and a short error label, no content) | Until the affected order is resolved |
| Gift recommendation packages (input and generated result) | Until the gift is deleted on request |
| Purchase records | 1 year after purchase |
| Anonymous usage counts | 180 days |
| Web server access logs | 14 days |
| Application logs | Most recent 30 MB per service, older lines discarded |
7. Data Security
- All traffic encrypted in transit (HTTPS/TLS).
- No authentication cookies or tokens, because the Service has no login.
- Payment card data handled exclusively by our payment provider.
- Purchase and gift records are accessible only to our backend service role, never from the browser.
- Servers located in the EU (Helsinki, Finland), accessible only through a reverse proxy.
8. International Data Transfers
Our servers are located in the EU/EEA. Some processors (payments, email) may process data in the United States under the EU-US Data Privacy Framework, Standard Contractual Clauses, or equivalent safeguards.
9. Your Rights
Under the GDPR (EU/EEA), CCPA (California), and KVKK (Turkey) you may request: access to your data, correction, deletion ("right to be forgotten"), restriction of processing, portability, and objection to processing based on legitimate interest. Because free analysis data is never stored, most deletion requests are already satisfied by design; purchase and gift data, and the derived history behind an uploaded-export purchase, will be deleted on request within 30 days. You may also lodge a complaint with your local data protection authority (any EU DPA, the California AG, or the Turkish KVKK authority).
To exercise any right, contact hello@lumitone.io. We may ask you to verify your identity first.
10. AI and Automated Decision-Making
Recommendations are generated by machine learning models for entertainment and discovery purposes only. No decisions with legal or similarly significant effects are made about you, and your data is processed solely to generate the specific recommendations you request.
11. Children's Privacy
The Service is not intended for children under 16. We do not knowingly process data of children under 16; if you believe we have, contact us and we will promptly delete it.
12. Changes to This Policy
We may update this Privacy Policy from time to time. Material changes are indicated by the "Last Updated" date above. Continued use of the Service after changes constitutes acceptance.
13. Contact
Lumitone, Data Protection
Email: hello@lumitone.io
Website: lumitone.io