Luma keeps your personal data for as long as it is needed for its stated purposes, though specific retention periods are not defined in the policy.
This analysis describes what Luma AI's agreement states, permits, or reserves. It does not constitute a legal determination about enforceability. Regulatory applicability and practical outcomes may vary by jurisdiction, enforcement context, and individual circumstances. Read our methodology
The policy does not specify concrete retention periods for different categories of data, meaning users cannot easily determine how long their uploaded content, conversations, or account data will be held.
Interpretive note: The absence of specific retention schedules in the policy means the practical duration of data retention is uncertain and depends on Luma's internal practices, which are not disclosed in this document.
Luma's retention policy is principles-based rather than specifying fixed timelines for different data categories. Your personal data, including uploaded images and conversation history, may be retained for an unspecified period and may persist in backup storage even after deletion requests are fulfilled.
How other platforms handle this
to request that your data be transferred to a third party (data portability)
Your organization may allow you to access and export your data in order to back it up or transfer it to a service outside of Google.
Further, you may take legal actions in relation to any potential breach of your rights regarding the processing of your Personal Information, as well as to lodge complaints before the competent data prot...
"We take measures to delete your personal information or keep it in a form that does not permit identifying you when this personal information is no longer necessary for the purposes for which we process it, unless we are required by law to keep this personal information for a longer period. When determining the retention period, we take into account various criteria, such as the type of products and services requested by or provided to you, the nature and length of our relationship with you, the impact on our Services we provide to you if we delete some personal information from or about you, mandatory retention periods provided by law, and any relevant statute of limitations.Excerpt from Luma AI's Privacy Policy
REGULATORY LANDSCAPE: GDPR Article 5(1)(e) requires that personal data not be kept longer than necessary for the stated purpose (storage limitation principle).
Enforcement risk, jurisdiction flags, contract triggers, and due diligence action items.
Ad personalization controls removed. Contact scanning added. Advertiser data partnerships quietly dropped. A timeline of every change.
Get the research letter
Companies change their terms quietly. We read every version and catch what actually changed. One email a week on the changes that matter and what they mean.
The policy does not specify concrete retention periods for different categories of data, meaning users cannot easily determine how long their uploaded content, conversations, or account data will be held.
Luma's retention policy is principles-based rather than specifying fixed timelines for different data categories. Your personal data, including uploaded images and conversation history, may be retained for an unspecified period and may persist in backup storage even after deletion requests are fulfilled.
ConductAtlas has identified this type of provision across 290 platforms. See the full comparison.
No. ConductAtlas is an independent monitoring service. We are not affiliated with, endorsed by, or sponsored by Luma AI.