GDPR Compliance

Effective Date: May 30th 2026

Last Updated: June 25th 2026

1. Introduction

Lumesoon is committed to protecting personal information and respecting the privacy rights of individuals.

This GDPR Compliance Policy explains how Lumesoon complies with the General Data Protection Regulation (GDPR) and other applicable data protection laws when processing personal information.

This Policy should be read together with our Privacy Policy, Cookie Policy and Terms of Service.

Where mandatory provisions of applicable data protection law provide greater protection than this Policy, those mandatory provisions will prevail.

2. Scope

This Policy applies to the processing of personal information where the GDPR or another applicable data protection law applies.

It applies to visitors, registered users, customers, affiliates, business representatives and other individuals whose personal information is processed by Lumesoon.

3. Our Commitment

Lumesoon is committed to processing personal information lawfully, fairly and transparently.

We aim to:

• Process information only where there is a lawful basis.
• Collect only information reasonably necessary for the Services.
• Keep information accurate where reasonably practicable.
• Protect information using appropriate security measures.
• Respect individual privacy rights.
• Retain information only for appropriate periods.
• Review our privacy practices regularly.

4. Personal Information We Process

Depending on how you use the Services, we may process:

• Name.
• Email address.
• Username.
• Company information.
• Billing information.
• Payment records.
• Subscription information.
• Voice recordings.
• Audio files.
• Uploaded documents.
• Text prompts.
• Generated projects.
• Device information.
• Usage information.
• Security logs.
• Support communications.
• Marketing preferences. The categories processed depend on the Services you choose to use.

5. Lawful Bases for Processing

Where required by the GDPR, Lumesoon processes personal information only where one or more lawful bases apply.

These may include:

Performance of a Contract

Processing necessary to:

• Create your account.
• Deliver subscriptions.
• Provide requested Services.
• Process payments.
• Manage projects.
• Deliver customer support. Legitimate Interests

Processing reasonably necessary to:

• Improve platform performance.
• Detect fraud.
• Maintain security.
• Prevent abuse.
• Develop new features.
• Protect our legal rights.
• Respond to customer inquiries.
• Operate our business efficiently. We balance these interests against the rights and freedoms of individuals.

Legal Obligations

Processing necessary to:

• Comply with applicable laws.
• Meet tax obligations.
• Respond to lawful government requests.
• Prevent unlawful activity.
• Maintain legally required records. Consent

Where consent is required, we will request it before processing.

Consent may be withdrawn at any time.

Withdrawal of consent does not affect processing already carried out before the withdrawal.

6. Data Protection Principles

Where the GDPR applies, Lumesoon seeks to process personal information in accordance with the following principles:

• Lawfulness.
• Fairness.
• Transparency.
• Purpose limitation.
• Data minimization.
• Accuracy.
• Storage limitation.
• Integrity.
• Confidentiality.
• Accountability. These principles guide the design and operation of our Services.

7. How Information Is Used

Personal information may be processed to:

• Operate the Services.
• Authenticate users.
• Process subscriptions.
• Deliver requested features.
• Generate requested outputs.
• Manage voice generation.
• Process voice cloning requests.
• Process transcription requests.
• Provide customer support.
• Improve platform performance.
• Detect fraud.
• Maintain security.
• Comply with legal obligations.
• Enforce our agreements.
• Respond to lawful requests.

8. Sharing Information

Personal information may be shared only where reasonably necessary.

Recipients may include:

• Payment providers.
• Cloud infrastructure providers.
• Email delivery providers.
• Authentication providers.
• Analytics providers.
• Security providers.
• Professional advisers.
• Regulatory authorities.
• Courts where legally required. We seek to ensure that third-party service providers process information only for authorized purposes.

9. International Transfers

Personal information may be processed in countries outside your country of residence.

Where international transfers occur, Lumesoon seeks to implement appropriate safeguards recognized under applicable data protection law.

These safeguards may include:

• Contractual protections.
• Technical safeguards.
• Organizational safeguards.
• Other lawful transfer mechanisms recognized by applicable law.

10. Data Security

Lumesoon maintains reasonable administrative, technical and organizational measures designed to protect personal information.

Security measures may include:

• Encryption.
• Access controls.
• Authentication systems.
• Security monitoring.
• Secure hosting.
• Firewall protection.
• Backup systems.
• Fraud detection.
• Software updates.
• Role-based access controls. While we take reasonable steps to protect information, no security system can guarantee absolute protection.

11. Data Retention

Personal information is retained only for as long as reasonably necessary to:

• Provide the Services.
• Maintain accounts.
• Process payments.
• Resolve disputes.
• Prevent fraud.
• Meet legal obligations.
• Protect legal rights.
• Maintain security.
• Preserve backup integrity. Retention periods vary depending on the type of information involved and applicable legal requirements.

When information is no longer required, it will be securely deleted, anonymized or otherwise disposed of where reasonably practicable.

12. Your GDPR Rights

Where the GDPR applies to the processing of your personal information, you may have certain rights, subject to applicable legal limitations and exceptions.

These rights are not absolute and may be restricted where permitted by law.

Lumesoon will respond to valid requests within the time required by applicable law.

To protect your information, we may request reasonable proof of identity before processing a request.

13. Right of Access

You may request confirmation of whether Lumesoon processes your personal information.

Where applicable, you may also request access to the personal information we hold about you together with information regarding:

• The categories of information processed.
• The purposes of processing.
• The categories of recipients.
• The expected retention period where available.
• The source of the information where it was not collected directly from you.
• Your applicable privacy rights. Access requests may be refused or limited where permitted by applicable law.

14. Right to Rectification

You may request correction of inaccurate personal information.

You may also request completion of incomplete information where appropriate.

We may request supporting information before making corrections.

15. Right to Erasure

You may request deletion of your personal information where applicable law provides such a right.

Deletion requests are not absolute.

Lumesoon may retain information where continued retention is reasonably necessary to:

• Comply with legal obligations.
• Complete ongoing transactions.
• Detect fraud.
• Resolve disputes.
• Protect platform security.
• Exercise or defend legal claims.
• Enforce contractual obligations.
• Maintain backup integrity.

16. Right to Restrict Processing

Where applicable, you may request that Lumesoon temporarily restrict certain processing activities while specific issues are being reviewed.

During a restriction period, certain Services may become unavailable or limited.

17. Right to Object

Where processing is based upon legitimate interests, you may object to that processing where applicable law provides such a right.

Lumesoon will consider the request and determine whether compelling legitimate grounds exist to continue processing.

18. Right to Data Portability

Where required by applicable law, you may request a copy of certain personal information in a structured, commonly used and machine-readable format.

This right applies only where:

• The processing is based on consent or contract.
• The processing is carried out by automated means.
• Applicable law grants such a right.

19. Right to Withdraw Consent

Where processing relies upon your consent, you may withdraw that consent at any time.

Withdrawal of consent does not affect processing that occurred before consent was withdrawn.

Withdrawal of consent may limit the availability of certain Services that depend upon that consent.

20. Automated Decision Making

Lumesoon may use automated systems to assist with:

• Fraud prevention.
• Security monitoring.
• Abuse detection.
• Spam prevention.
• Service optimization.
• Operational efficiency. Where applicable law grants rights relating to automated decision making, those rights remain available.

Where required by law, meaningful information regarding such processing will be provided upon request.

21. Data Breach Response

Lumesoon maintains procedures designed to identify, investigate and respond to suspected personal information security incidents.

Where a reportable personal data breach occurs, Lumesoon will take appropriate action consistent with applicable legal obligations.

Where required by applicable law, affected individuals and relevant supervisory authorities will be notified within the legally required timeframes.

22. Data Protection by Design

Lumesoon seeks to incorporate privacy and security considerations into the design, development and operation of the Services.

This includes reasonable measures intended to:

• Reduce unnecessary data collection.
• Limit access to personal information.
• Protect information throughout its lifecycle.
• Support compliance with applicable privacy laws.

23. Data Minimization

We seek to collect and process only the personal information reasonably necessary for the purposes described in our Privacy Policy and this Policy.

Users should avoid submitting unnecessary personal information through the Services.

24. Accuracy of Information

Lumesoon takes reasonable steps to maintain accurate personal information.

Users are encouraged to keep their account information current and promptly update inaccurate or outdated information.

25. Third Party Processors

Where Lumesoon engages third-party service providers to process personal information on our behalf, we seek to ensure they provide appropriate safeguards consistent with applicable data protection requirements.

Third-party processors are permitted to process personal information only for authorized purposes connected with providing the Services.

26. Children's Information

Lumesoon does not knowingly process personal information from children in circumstances prohibited by applicable law.

If we become aware that such information has been collected contrary to applicable legal requirements, we will take reasonable steps to remove it.

27. Supervisory Authorities

Where applicable under the GDPR, you may have the right to lodge a complaint with the competent data protection supervisory authority if you believe that your personal information has been processed in violation of applicable law.

We encourage users to contact Lumesoon first so that we have an opportunity to resolve concerns promptly and fairly.

28. Changes to This Policy

Lumesoon may update this GDPR Compliance Policy from time to time.

Updated versions become effective upon publication unless otherwise stated.

Where required by applicable law, we will provide appropriate notice of material changes.

Your continued use of the Services after the effective date of the revised Policy constitutes acceptance of the updated Policy.

29. Contact Us

If you have questions regarding this GDPR Compliance Policy or wish to exercise your applicable privacy rights, please contact Lumesoon using the official contact methods published on our website.

To protect personal information, we may request reasonable verification of identity before responding to certain requests.

30. Relationship With Other Policies

This GDPR Compliance Policy should be read together with the Lumesoon Privacy Policy, Cookie Policy and Terms of Service.

Where another policy provides additional protections relating to personal information, those protections continue to apply unless prohibited by applicable law.

31. Severability

If any provision of this Policy is determined to be invalid or unenforceable under applicable law, the remaining provisions shall continue in full force and effect.

32. Reservation of Rights

Except where prohibited by applicable law, Lumesoon reserves all rights not expressly limited by this Policy.

Failure to exercise any right under this Policy shall not constitute a waiver of that right.

33. Electronic Acceptance

By creating an account or using the Services, you acknowledge that you have read and understood this GDPR Compliance Policy and that your personal information may be processed as described in this Policy and the Privacy Policy where permitted by applicable law.