If you use Luma through an enterprise customer's deployment, this privacy policy does not protect you; instead, the enterprise customer controls how your data is handled under a separate agreement.
This analysis describes what Luma AI's agreement states, permits, or reserves. It does not constitute a legal determination about enforceability. Regulatory applicability and practical outcomes may vary by jurisdiction, enforcement context, and individual circumstances. Read our methodology
Users accessing Luma through an employer or enterprise customer may have substantially different privacy protections than consumer users, and Luma explicitly disclaims responsibility for enterprise customer data practices.
If you interact with Luma through a workplace or enterprise deployment, your personal data is governed by your employer's or the enterprise customer's privacy policies and agreements with Luma, not by this document. This means the rights and protections described in this policy may not apply to you in that context.
How other platforms handle this
This Privacy Statement does not apply to the extent we process Personal Data as a processor or service provider on behalf of our customers, including where we offer to our customers various services through which our customers (or their affiliates): (i) create their own websites and applications run...
Our Service allows customers to submit, manage or otherwise use content relating to others, such as end users of applications built and managed through the Service or their employees and contractors ("Customer Data"). We use such Customer Data primarily as a processor, meaning we process such Custom...
Egnyte is a data controller with respect to personal data it collects from visitors to its website and through its marketing activities. Egnyte acts as a data processor with respect to the content and data that customers store within the Egnyte platform. In that capacity, Egnyte processes data on be...
Monitoring
Luma AI has changed this document before.
Receive same-day alerts, structured change summaries, and monitoring for up to 10 platforms.
"This Privacy Policy does not apply where Luma acts as a processor or service provider on behalf of enterprise customers. In that context, our processing of your personal information is subject to our agreements with the enterprise customer. In those cases, the enterprise customer is the data controller, and its privacy policies will apply to the processing of your personal information. We are not responsible for the privacy or data security practices of our enterprise customers, which may differ from those explained in this Privacy Policy.— Excerpt from Luma AI's Luma AI Privacy Policy
REGULATORY LANDSCAPE: This provision engages GDPR's controller-processor distinction under Articles 4, 26, and 28, which require that data processing agreements between controllers and processors include specific mandatory provisions. Under CCPA, a similar service provider framework applies. Enterprise customers who are controllers bear primary compliance obligations for employee or end-user data processed through Luma's platform. GOVERNANCE EXPOSURE: Medium. The carve-out is standard in B2B SaaS contexts, but its practical effect is to shift compliance responsibility entirely to enterprise customers. If enterprise customers have not entered into compliant data processing agreements with Luma, both parties may face regulatory exposure. The clause as written does not confirm that Luma's enterprise agreements contain GDPR Article 28-compliant terms. JURISDICTION FLAGS: EEA and UK enterprises face heightened exposure because GDPR Article 28 mandates specific contractual terms in processor agreements. US enterprises subject to CCPA should ensure Luma is contracted as a service provider with appropriate data use restrictions. The adequacy of Luma's data processing agreements should be reviewed on a jurisdiction-by-jurisdiction basis. CONTRACT AND VENDOR IMPLICATIONS: Procurement and legal teams at enterprises deploying Luma must ensure a compliant data processing agreement is in place before use. The policy's explicit disclaimer of responsibility for enterprise customer privacy practices does not eliminate Luma's processor obligations under GDPR. Vendor assessment processes should include review of Luma's standard DPA and sub-processor lists. COMPLIANCE CONSIDERATIONS: Enterprise compliance teams should audit whether existing agreements with Luma satisfy GDPR Article 28, CCPA service provider requirements, and any sector-specific obligations. Data mapping updates should reflect that personal data processed through enterprise Luma deployments flows under a controller-processor model with a separate legal basis.
Full compliance analysis
Regulatory citations, enforcement risk, and due diligence action items.
Free: track 1 platform + weekly digest. Watcher: 10 platforms + same-day alerts. No credit card required.
We read the privacy policies and terms of service of 38 AI platforms. Here is what they say about training, retention, arbitration, and liability.
Professional Governance Intelligence
Need to monitor specific governance provisions?
Professional includes provision-level monitoring, governance timelines, regulatory mapping, and audit-ready analysis.
Built from archived source documents, structured governance mappings, and historical version tracking.
Users accessing Luma through an employer or enterprise customer may have substantially different privacy protections than consumer users, and Luma explicitly disclaims responsibility for enterprise customer data practices.
If you interact with Luma through a workplace or enterprise deployment, your personal data is governed by your employer's or the enterprise customer's privacy policies and agreements with Luma, not by this document. This means the rights and protections described in this policy may not apply to you in that context.
No. ConductAtlas is an independent monitoring service. We are not affiliated with, endorsed by, or sponsored by Luma AI.