Governance document

CA-D-000497

Luma AI Privacy Policy

Luma AI

Last change detected September 11, 2026 Privacy policy

SHA-256: ef71ca16dccd41de6b9… 6 versions captured 5 changes documented

Get the research letter

Companies change their terms quietly. We read every version and catch what actually changed. One email a week on the changes that matter and what they mean.

View original document at Luma AI ↗

This page describes what the document states, permits, or reserves. It does not constitute a legal determination about enforceability. Regulatory applicability may vary by jurisdiction. Methodology

83 Total

17 High severity

51 Medium severity

15 Low severity

Key Facts

What does Luma AI collect in users' conversations?

Luma AI collects the content of users' conversations, including information users choose to provide in their Inputs, and this information may be reproduced in the Outputs.

Can information from users' Inputs be reproduced in the Outputs?

Luma AI collects the content of users' conversations, including information users choose to provide in their Inputs, and this information may be reproduced in the Outputs.

What does Luma AI use personal data to do?

Luma AI uses personal data to train, develop, and improve the artificial intelligence, machine learning, and models that support its Services.

Does Luma AI use personal data to train its models?

Luma AI uses personal data to train, develop, and improve the artificial intelligence, machine learning, and models that support its Services.

May Luma AI sell its business or assets in connection with a business transaction?

Luma AI may sell, transfer, or otherwise share some or all of its business or assets, including users' personal information, in connection with a business transaction such as a corporate divestiture, merger, consolidation, or acquisition.

May Luma AI transfer users' personal information in connection with a corporate merger?

Are Luma AI's Services intended for use by children under 13?

Luma AI's Services are not intended for use by children under 13 years of age, and no part of the Services is directed to children.

What do users consent to by providing information on or through Luma AI's Services?

By providing any information, including personal information, on or through Luma AI's Services, users consent to the transfer, storage, and processing of that information.

May Luma AI transfer personal information from the EEA or the UK?

Luma AI may transfer personal information from the EEA or the UK to the United States and other third countries based on European Commission-approved or UK Government-approved Standard Contractual Clauses.

Where may Luma AI transfer that information to?

Stay ahead of the changes

Track Luma AI and get the diff the day its terms change.

Monitor Luma AI + up to 20 platforms — $4.99/mo →

Summary

Luma AI's Privacy Policy governs how the company collects and uses your information, including everything you type in conversations, which may also appear in AI-generated Outputs and be used to train Luma AI's AI models. Your personal information may be shared with another company if Luma AI is sold or merges with another business. You have the right to opt out of targeted advertising and to withdraw any consent you previously gave for processing your personal information, at any time and at no cost.

Analysis

This Privacy Policy establishes Luma AI's practices for collecting, using, sharing, and retaining personal information in connection with its Services. Luma AI collects conversation Inputs and uses personal data to train and improve its AI and machine learning models, with users' continued use of the Services constituting agreement to these practices. Personal information may be transferred to third parties in corporate transactions and may be transferred internationally from the EEA or UK to the United States via Standard Contractual Clauses. The Policy does not apply where Luma AI acts as a processor on behalf of enterprise customers, and Luma AI reserves the right to modify its terms at any time with material changes communicated by updating the policy date and reposting.

What this means for you

Using Luma AI's Services means your conversation Inputs are collected and may reappear in Outputs, and your personal data is used to train and improve Luma AI's AI models. If you accessed Luma AI through an enterprise customer's platform, this Privacy Policy does not govern your data — your protections come from that enterprise's separate agreement with Luma AI. Luma AI cannot guarantee the security of data during internet transmission, and the Policy may change at any time, with material updates communicated only by a revised date posted on the Services. One concrete action available to you: you can opt out of having your personal data shared for targeted advertising, and you can withdraw any previously given consent to data processing at any time, free of charge.

Institutional Analysis

Stay ahead of the changes

Institutional analysis available with Insight

Which mapped governance frameworks each document engages, tied to the specific provisions that engage them.

Monitor Luma AI + up to 20 platforms — $4.99/mo → Get the research letter, free

5 important changes detected

6 versions captured · Last updated: August 2026

August 21, 2026

low

What changed Luma AI expanded its privacy policy to explicitly describe how it handles mobile phone numbers provided for SMS verification. The updated language states that phone numbers are used solely to deliver one-time verification codes and for fraud prevention, and that this information will not be shared with third parties for marketing purposes. The policy clarifies that SMS verification providers may receive phone numbers solely to deliver the verification message, and specifies opt-out mechanisms (reply STOP) and standard message frequency disclaimers.

Why this matters The updated policy establishes explicit restrictions on how Luma AI uses phone numbers collected for SMS verification. The terms state that these numbers are used solely to deliver verification codes and for fraud prevention, and will not be shared with third parties or affiliates for marketing purposes. Sharing with SMS service providers to deliver verification messages is permitted. You can opt out of text messages by replying STOP to any verification message.

View full change record →

August 19, 2026

low

What changed In an update detected on August 19, 2026, Luma AI modified its privacy policy footer to add a reference to 'Case Studies' in its product and resource listing. The previous version listed 'AI Image Generator' as a standalone product; the updated version replaced this with 'AI Video Generator from Image' and added 'Case Studies' to the footer navigation. This is a minor formatting and product listing clarification with no material change to privacy obligations, data practices, or user rights.

Why this matters This change does not materially affect consumer privacy rights, data practices, or obligations. The updated privacy policy footer now includes a link to Case Studies and clarifies the naming of Luma AI's video generation product offerings. No changes to how user data is collected, processed, or shared are reflected in this update.

View full change record →

June 10, 2026 low

Luma AI's privacy policy was updated on June 10, 2026 to reorganize its footer navigation links. The change added references to two new product offerings, 'Ray', 'AI Video Generator', and …

View change record →

May 5, 2026 low

Luma AI added a navigation link to 'API' in the header of their privacy policy page on May 5, 2026. This is a minor website navigation change with no impact …

View change record →

April 29, 2026 low

Luma AI removed the word 'API' from the navigation menu in its privacy policy header on April 29, 2026. The previous version listed 'Product Pricing API Enterprise News' while the …

View change record →

Featured, High severity

AI Conversation Input and Output Collection Compare →

Personal or sensitive information shared in conversation Inputs is collected by Luma AI and may be reproduced in Outputs, which could be seen by other parties depending on how Outputs are used.

Added July 10, 2026 Standard Seen across 296 platforms
AI Model Training Use of Personal Data Compare →

Personal data is used directly to build and refine Luma AI's core AI models, meaning user data has an ongoing role in shaping the technology beyond the immediate service interaction.

Added July 10, 2026 Standard Seen across 279 platforms
Business Transfer Data Sharing Compare →

Users' personal information may pass to a different legal entity in a corporate transaction, potentially changing who controls and processes that data.

Added April 30, 2026 Standard Seen across 288 platforms
Children Under 13 Service Exclusion Compare →

This clause establishes that children under 13 are an excluded user group, which has implications for regulatory compliance and parental responsibility.

Added July 10, 2026 Standard Seen across 245 platforms
Consent to International Data Transfer Compare →

The act of providing information itself is defined as consent to international data transfer, storage, and processing, which has direct implications for users in jurisdictions with strict data transfer rules.

Added July 10, 2026 Standard Seen across 288 platforms
EEA/UK Standard Contractual Clauses Transfer Mechanism Compare →

Standard Contractual Clauses are the stated legal mechanism Luma AI relies on to legitimise cross-border transfers of personal information from the EEA and UK, which determines the level of protection available to affected users.

Added July 10, 2026 Standard Seen across 267 platforms
Enterprise Customer Processor Exclusion Compare →

Users whose data is processed by Luma AI on behalf of an enterprise customer are not protected by this Privacy Policy; their rights and protections depend instead on the enterprise customer's separate agreement with Luma AI.

Added July 10, 2026 Standard Seen across 297 platforms
No Guarantee of Internet Transmission Security Compare →

Luma AI explicitly disclaims any guarantee of transmission security, meaning users bear the residual risk of interception or exposure during data transmission.

Added July 10, 2026 Standard Seen across 287 platforms
Regional Right to Opt Out Targeted Advertising Compare →

The existence of an opt-out mechanism means users have a right to limit the sharing of their personal data for targeted advertising purposes.

Added July 10, 2026 Standard Seen across 290 platforms
Unilateral Privacy Policy Modification Right Compare →

Luma AI's right to modify the Privacy Policy at any time means the terms governing data collection and use can change, with notification for material changes limited to a date update and reposting rather than direct user communication.

Added July 10, 2026 Standard Seen across 289 platforms
User Consent to Privacy Policy Collection Compare →

Use of the Services is defined as consent to all data practices described in the Privacy Policy, making continued use the operative act of agreement.

Added July 10, 2026 Standard Seen across 297 platforms

Featured, Medium severity

EEA/UK Right to Withdraw Consent Compare →

This clause establishes that consent-based data processing can be stopped by the user without cost or time restriction, limiting Luma AI's ability to rely on consent as an ongoing legal basis.

Added July 10, 2026 Standard Seen across 290 platforms