Privacy Policy

1. Who is responsible

The controller of your personal data is Arthur Breno Costa Polimeni (CPF 059.507.189-92), Rua Ulrico Zuinglio, 500, Londrina, Paraná, Brazil, who develops and sells Lugh Xtudio (“we”). For anything about your data, write to support@lugh-lens.com. This policy follows Brazil's General Data Protection Law (LGPD, Law 13.709/2018).

2. The short version

• Your projects and media stay on your computer. We never receive them.
• We never see your card details: Stripe handles the payment.
• We keep what we need to deliver and support your licence, and nothing to sell.
• Analytics on the website only run if you allow them.
• The app counts how it is used without identifying you, and you can turn that off in Settings.

3. What we collect

On the website

• Technical data any web server receives: IP address, browser and the page requested, in the server's logs.
• Cookies. Two essential ones: lugh_cookie_choice remembers your cookie choice, and lugh_partner remembers, for 180 days, the partner code of a link you arrived from. We also count visits per partner link, without identifying the visitor.
• Google Analytics, only if you accept it in the cookie banner: pages visited and how you reached them, through Google's cookies.
• Google Fonts: the page's fonts are loaded from Google's servers, which receive your IP address and browser.
• Downloads. Installers are delivered from Cloudflare's storage through a short-lived link; the request passes through our server.
• Email list. If you signed up to be notified about the release, we keep your email, when and where you signed up, and the page that referred you.

When you buy a licence

• Purchases go through Stripe, which collects your payment details, name, email and billing country under its own privacy policy. We receive the email, the amount, the currency, the country that issued the card and whether the payment succeeded; never the card number.
• Purchases in reais made until October 6, 2026 went through InfinitePay (CloudWalk): you typed your email on our page, and InfinitePay collected your payment details, name, email and phone under its own privacy policy. We received the transaction reference, the amount and whether the payment succeeded; never the card number.
• We keep an order record: the payment reference at InfinitePay or Stripe, the price paid, the partner code if you came from a partner link, your email, the licence issued and its key, and whether the key email was sent. The key is kept so the thank-you page can show it to you again.

When you use the app

• Licence activation: the licence is identified by a one-way fingerprint of the key (not the key itself), its dates and status. For each activated computer we keep an identifier derived from that computer and the computer's name, so you can see and release your computers.
• Update and configuration checks: the app periodically asks our server for the latest version and settings. The request carries the app's version and system, and your IP address reaches the server as with any connection.
• Error reports, only when you press “Send report” and confirm in the window the app opens: the app's version, your system, the project's identifier, the details of recent errors and the app's logs are emailed to us to fix the problem, and not stored in any database. Project content and media are not attached, and folder paths, links, email addresses and credentials are removed before sending.
• Slow export report, only when you press “Is it slow?” during an export and confirm: how fast the export is going and how long each step takes, the shape of the project as numbers (how many clips and tracks, the size of the videos; never file names or content) and your computer's processor, memory and graphics card. It reaches us the same way an error report does.
• Anonymous usage statistics, which you can turn off in the app's Settings, on the Privacy tab: the app's version, your system and its language, and counts of what is used: a project created or opened and whether it uses AI, an export finished and how long it took, a sticker, transition, effect, whiteboard or filter made, and an error and its kind. They carry no name, email, licence key, file name or project content. They go to a server of ours, which uses your IP address only to tell one visit from another within the same day and does not store it; nothing links one day to the next, or the statistics to your licence.
• Your projects, media, exports and conversations with AI assistants stay on your computer and are never sent to us. An AI assistant you connect is run by its own company, under its own privacy policy.

4. Why, and on what legal basis

• Selling and delivering the licence, activation, support and refunds: performance of a contract with you (LGPD art. 7, V).
• Tax and accounting records of sales: legal obligation (art. 7, II).
• Security, preventing fraud and key abuse, server logs, and error and slow export reports: our legitimate interest in keeping the service working and safe (art. 7, IX).
• Anonymous usage statistics: our legitimate interest in knowing what works and what is slow in the app so we can improve it (art. 7, IX). They do not identify you, and you can turn them off in Settings at any time.
• Release announcements to the email list, and Google Analytics: your consent (art. 7, I), which you can withdraw at any time through the unsubscribe link or the cookie settings in the website's footer.

We do not sell personal data, and we do not use it for advertising profiles.

5. Who processes it for us

• Stripe: payments.
• InfinitePay (CloudWalk): payments in reais made until October 6, 2026.
• Resend: sending emails, such as your licence key.
• Cloudflare: storage and delivery of the installers.
• Google: website fonts, and Analytics if you allow it.
• Our hosting provider: the rented server where the website, the order records, the licence service and the usage statistics run (with Aptabase, open-source software installed on that server; the data does not go to the company that makes it).

Some of them process data outside Brazil, mainly in the United States. These transfers happen under the providers' contractual and security guarantees, as allowed by the LGPD (art. 33).

6. How long we keep it

• Order records: for at least 5 years after the sale, as tax law requires.
• Licence and activation data: while the licence exists, and then for as long as needed to handle disputes.
• Email list: until you unsubscribe or ask us to delete it.
• Server logs: for a limited time, to investigate security problems.
• Error and slow export reports: in our inbox, until the problem is solved.
• Usage statistics: they identify no one, so they are kept with no set limit.

7. Your rights

Under the LGPD (art. 18) you can ask us to confirm whether we process your data, give you access to it, correct it, delete or anonymise what is unnecessary, give you a copy, tell you who we share it with, and withdraw consent. Write to support@lugh-lens.com; we may ask you to confirm it is really you before acting. We answer within 15 days.

Some data we must keep even if you ask us to delete it, such as sale records required by tax law. You can also complain to Brazil's data protection authority, the ANPD.

8. Security and children

Connections use encryption (HTTPS), licence keys are stored as one-way fingerprints in the licence service, and access to our servers is restricted. No system is perfectly secure; if an incident puts your data at risk, we will tell you and the ANPD as the law requires.

Lugh Xtudio is not directed at children. Buying a licence requires being of legal age or having the permission of a parent or guardian.

9. Changes and contact

We will update this policy when what we collect changes. The date at the top says when it last changed, and significant changes will be announced on the website. Questions: support@lugh-lens.com. See also the Terms of Use and Sale.