Luma can share your personal data with any current or future business partners and affiliates for any purpose listed in the policy, including AI training, marketing, and analytics — without naming those parties.
Your personal data including images, videos, and conversation content can be shared with unnamed future business partners for any purpose in the policy, which consumers cannot meaningfully evaluate or object to at the time of collection.
Cross-platform context
See how other platforms handle Open-Ended Affiliate and Partner Data Sharing and similar clauses.
Compare across platforms →The phrase 'current or future partners and affiliates' combined with 'any of the purposes' creates an extremely broad sharing authorization that could encompass undisclosed third parties acquiring or partnering with Luma after you signed up.
(1) REGULATORY FRAMEWORK: This provision implicates GDPR Art. 13(1)(e) (requirement to identify recipients or categories of recipients at time of collection), Art. 6(1)(f) (legitimate interests balancing for third-party sharing), and Art. 44-49 (international transfers if affiliates are outside EEA); UK GDPR equivalent provisions; CCPA/CPRA §1798.115 (right to know categories of third parties with whom data is shared) and §1798.120 (opt-out rights); FTC Act Section 5. Enforced by EU supervisory authorities, UK ICO, CPPA, and state AGs. (2)
Compliance intelligence locked
Regulatory citations, enforcement risk, and due diligence action items.
Watcher: regulatory citations. Professional: full compliance memo.