Luma AI Privacy Policy

This document governs Luma AI's collection, use, disclosure, and processing of personal information from users of its website, applications, and AI-powered services, with stated legal bases including consent, contractual necessity, legal obligation, and legitimate interests for EEA/UK users under GDPR. The policy asserts that Luma collects a broad range of data including user-uploaded images and videos, AI conversation inputs and outputs, device identifiers, location inferred from IP address, collaboration data including real-time cursor position, and third-party sourced data from marketing partners and data providers; notably, the terms authorize use of this information to train and improve Luma's AI models and machine learning systems. The explicit authorization to use user-uploaded content and conversation inputs for AI model training is an operationally significant provision that may engage user expectations around content ownership and consent, particularly given that inputs may include personal images, videos, and text; the policy does not specify an opt-out mechanism for AI training use specifically, which may create tension with GDPR legitimate interests balancing requirements and emerging AI-specific regulatory frameworks. The policy engages GDPR and UK GDPR for EEA and UK users, CCPA and similar US state privacy laws for California and other US residents, and may require evaluation under the EU AI Act given Luma's AI model development activities; the explicit carve-out for enterprise processor relationships means enterprise-context users are governed by separate contractual arrangements rather than this policy.