If you use Luma through an enterprise customer's deployment, this privacy policy does not protect you; instead, the enterprise customer controls how your data is handled under a separate agreement.
This analysis describes what Luma AI's agreement states, permits, or reserves. It does not constitute a legal determination about enforceability. Regulatory applicability and practical outcomes may vary by jurisdiction, enforcement context, and individual circumstances. Read our methodology
Users accessing Luma through an employer or enterprise customer may have substantially different privacy protections than consumer users, and Luma explicitly disclaims responsibility for enterprise customer data practices.
New provision creates a significant carve-out where enterprise customers' own privacy policies supersede Luma's stated commitments, limiting user protections in B2B contexts.
View full change record →If you interact with Luma through a workplace or enterprise deployment, your personal data is governed by your employer's or the enterprise customer's privacy policies and agreements with Luma, not by this document. This means the rights and protections described in this policy may not apply to you in that context.
How other platforms handle this
At Ledger, earning and maintaining our users' trust is a top priority. That's why we are deeply committed not only to protecting your privacy and securing your personal data, but also to being fully transparent about how we handle it.
If you are located in the European Economic Area, Switzerland, or the United Kingdom, you have the right to access, correct, or erase your personal data; the right to restrict or object to our processing of your personal data; the right to data portability; and, where our processing is based on your...
We may display advertisements on our Services and those advertisements may be targeted to your interests based on your personal information. We may share your personal information with advertising partners for interest-based advertising purposes. You may opt out of interest-based advertising by visi...
Monitoring
Luma AI has changed this document before.
Receive same-day alerts, structured change summaries, and monitoring for up to 25 platforms.
"This Privacy Policy does not apply where Luma acts as a processor or service provider on behalf of enterprise customers. In that context, our processing of your personal information is subject to our agreements with the enterprise customer. In those cases, the enterprise customer is the data controller, and its privacy policies will apply to the processing of your personal information. We are not responsible for the privacy or data security practices of our enterprise customers, which may differ from those explained in this Privacy Policy.— Excerpt from Luma AI's Luma AI Privacy Policy
REGULATORY LANDSCAPE: This provision engages GDPR's controller-processor distinction under Articles 4, 26, and 28, which require that data processing agreements between controllers and processors include specific mandatory provisions. Under CCPA, a similar service provider framework applies. Enterprise customers who are controllers bear primary compliance obligations for employee or end-user data processed through Luma's platform. GOVERNANCE EXPOSURE: Medium. The carve-out is standard in B2B SaaS contexts, but its practical effect is to shift compliance responsibility entirely to enterprise customers. If enterprise customers have not entered into compliant data processing agreements with Luma, both parties may face regulatory exposure. The clause as written does not confirm that Luma's enterprise agreements contain GDPR Article 28-compliant terms. JURISDICTION FLAGS: EEA and UK enterprises face heightened exposure because GDPR Article 28 mandates specific contractual terms in processor agreements. US enterprises subject to CCPA should ensure Luma is contracted as a service provider with appropriate data use restrictions. The adequacy of Luma's data processing agreements should be reviewed on a jurisdiction-by-jurisdiction basis. CONTRACT AND VENDOR IMPLICATIONS: Procurement and legal teams at enterprises deploying Luma must ensure a compliant data processing agreement is in place before use. The policy's explicit disclaimer of responsibility for enterprise customer privacy practices does not eliminate Luma's processor obligations under GDPR. Vendor assessment processes should include review of Luma's standard DPA and sub-processor lists. COMPLIANCE CONSIDERATIONS: Enterprise compliance teams should audit whether existing agreements with Luma satisfy GDPR Article 28, CCPA service provider requirements, and any sector-specific obligations. Data mapping updates should reflect that personal data processed through enterprise Luma deployments flows under a controller-processor model with a separate legal basis.
Full compliance analysis
Regulatory citations, enforcement risk, and due diligence action items.
Free: track 1 platform + weekly digest. Monitor: 25 platforms + same-day alerts. No credit card required.
Ad personalization controls removed. Contact scanning added. Advertiser data partnerships quietly dropped. A timeline of every change.
Compliance Governance Intelligence
Need to monitor specific governance provisions?
Compliance includes provision-level monitoring, governance timelines, regulatory mapping, and audit-ready analysis.
Built from archived source documents, structured governance mappings, and historical version tracking.
Users accessing Luma through an employer or enterprise customer may have substantially different privacy protections than consumer users, and Luma explicitly disclaims responsibility for enterprise customer data practices.
If you interact with Luma through a workplace or enterprise deployment, your personal data is governed by your employer's or the enterprise customer's privacy policies and agreements with Luma, not by this document. This means the rights and protections described in this policy may not apply to you in that context.
No. ConductAtlas is an independent monitoring service. We are not affiliated with, endorsed by, or sponsored by Luma AI.