Privacy policy

Last updated: 24 October 2026

1. Who is responsible

Nelson Silva, sole trader trading as VisualMind, Portuguese tax number (NIF) 257272259, business address Rua de São Vicente, 20, Braga, Portugal ("VisualMind", "we") is the controller of the data described here. For any privacy question, or to exercise your rights, write to [email protected].

2. What we process, why, and on what basis

2.1 The lumaalbums.com website

The website uses no cookies and no visitor analytics. It only remembers the language you pick, in your browser's local storage, which is never sent to us. Cloudflare, which serves the site, receives your IP address and the technical details of each request to deliver it and protect it from attacks. We do this in our legitimate interest in keeping the site available and secure (Art. 6(1)(f) GDPR). The app is downloaded from GitHub, which receives the same technical details.

2.2 Purchases

Payments are handled by Polar (Polar Software, Inc.), which sells as merchant of record: Polar charges you, issues the invoice and handles VAT. For that it collects your name, email, billing address and payment details as a controller, under Polar's privacy policy. We never see your card details. Polar gives us your name, email, country, what you bought and your licence key. We use them to provide the licence, give support, process refunds and meet legal obligations, on the basis of the contract and of legal obligations (Art. 6(1)(b) and (c)).

2.3 The Luma Albums app

• Your photos and albums stay on your Mac and are never sent to us. The optional MCP server also runs only on your Mac.
• Licence activation and validation: when you activate, and from time to time afterwards to confirm the licence, the app sends Polar your key, your Mac's name (for example "Nelson's MacBook"), the macOS and app versions, and an identifier for this Mac. The identifier is a code derived from the hardware identifier and serves no other purpose; the hardware identifier itself never leaves the Mac. This is how we make sure each licence is active on one Mac (performance of the contract). Polar returns the purchase email, which the app shows in the licence window.
• Updates: once a day, and when you choose Check for Updates…, the app reads the list of releases published on GitHub. GitHub receives your IP address and the app version. No system profile is sent (legitimate interest in keeping the app up to date and secure).

2.4 Luma Studio (online proofs)

When you subscribe to Luma Studio, we process your account data to provide the service (performance of the contract):

• your name and email; the brand you set up (name, colour and logo), your reply-to address and the language of your emails;
• the subscription key, its activation on your Mac (the same identifier as in 2.3) and the subscription status, which we confirm with Polar daily;
• a record of when each email to a client was sent, kept for 24 hours to apply the daily sending limit.

The proofs you publish contain your clients' data: the title and client name, the client's email if you enter it, the spread images, the comments and the name of whoever approved, with dates. That data is processed on behalf of the photographer, who is its controller. VisualMind is the processor, under the data processing agreement. If you are a photographer's client and have a question about your proofs, please ask the photographer first. If you write to us, we will forward your request.

On the proof page, the visitor's IP address is used in the server's memory, without being stored, to limit PIN attempts and excessive requests (legitimate interest in protecting the proofs). If the proof has a PIN, a strictly necessary session cookie remembers that it was unlocked. The browser stores the chosen theme and the client's name locally, so it is not asked for again. Server logs record the method and path of each request, without IP addresses and without the codes in proof links.

2.5 Support

When you write to us, we use your email and what you tell us to answer (legitimate interest, or the contract if you are a customer).

3. Who else receives data

Providers that process data on our behalf do so only on our instructions, under a data processing agreement. Transfers outside the European Economic Area rely on the EU-US Data Privacy Framework, where the recipient is certified, or on the European Commission's standard contractual clauses. We only hand data to authorities when the law requires it.

4. How long we keep it

• Proofs: until the photographer deletes them. If a Luma Studio subscription ends, its proofs stay read-only for 30 days and are then deleted.
• Luma Studio account: while the subscription lasts and, afterwards, while the account still holds proofs.
• Backups: one a day, kept for 14 days. Anything deleted from the service leaves the backups within 14 days at most.
• Email sending record: 24 hours.
• Purchase and billing data: as long as tax law requires (10 years in Portugal); invoices are kept by Polar.
• Support requests: up to 3 years after the last message.

5. Your rights

You may ask to access your data, rectify or erase it, restrict its processing or receive it in a portable form, and you may object to processing based on legitimate interest. Write to [email protected]; we answer within one month. You may also complain to the Portuguese data protection authority, CNPD (www.cnpd.pt), or to the authority in your country.

We make no automated decisions with legal effects on you. Licence activation only checks that the key is valid and that the Mac limit is respected.

6. Security

Connections are encrypted (HTTPS). Proof links and account tokens are random, and we only store their cryptographic hash. PINs are stored hashed and attempts are limited. Backups are encrypted at rest by Cloudflare. If a data breach puts you at risk, we will tell you and the CNPD, as the law requires.

7. Children

Luma Albums and Luma Studio are meant for professionals, not for anyone under 16.

8. Changes

If we change this policy, we update the date at the top. If the change is significant, we email Luma Studio customers before it applies.

This is a translation; if it differs from the Portuguese version, the Portuguese version prevails.