Privacy Notice
Effective 2026-08-30 · Last updated 2026-09-29 · Beta version · Controller: PathoBrainSeq Inc. · Contact: lumiere-dish-support@googlegroups.com
Summary of processing
| Item | Purpose | Retention | Right to refuse |
|---|---|---|---|
| Email, display name, avatar URL | Account identity | Until account deletion | Refusal prevents account creation |
| Recipes, photos, stories, tags | Service display + search | Until user deletion | You may delete any post at any time |
| Heart / virtual Lumi activity | Progression + counter display | Until account deletion | N/A (aggregate only, no sale) |
| Device info (browser, OS) | Performance + error logs | 90 days rolling | Refusal may reduce reliability |
| Usage events (event name, time, page path, anonymous session ID, campaign tags, referring domain) | Traffic-source analysis + product improvement | 12 months, then deleted | Opt out anytime by email — refusal does not affect your use of the service |
What we collect
- Account info from Google or email sign-in (email, display name, avatar URL).
- Content you publish (recipes, photos, stories, tags).
- Heart and virtual-Lumi activity (for progression and counter display).
- Basic device info (browser, OS) for performance and error logs.
- Usage events — which features you use, page paths, an anonymous session ID, and the campaign tags and referring domain of the link that brought you here.
What we strip from photos
Photos you upload are re-encoded before storage, which removes all EXIF metadata including GPS coordinates. Your home, restaurant, or travel locations are not stored or displayed unless you type them into the post yourself.
How we use it
To operate the service, show your content to others, and maintain your progression (hearts, level, virtual Lumi). We offer an optional AI feature that drafts a recipe from the public description of a YouTube video you choose to import; you review and edit any draft before publishing. For that feature we process only the public video title and description text, for that purpose only, under an appropriate legal basis. We do not sell personal data. We do not run behavioral ads in the beta. We also use usage events to understand which channels bring people to Lumière and which features are used (traffic-source analysis and product improvement).
Where it lives
Service hosting via Vercel. Database via Supabase (PostgreSQL). Image storage via Supabase Storage. Public video metadata is retrieved via the Google/YouTube Data API. AI recipe drafting is provided via the Anthropic Claude API (Anthropic PBC, USA) — we send only the public video title and description text, never your account data. Transfers to the United States are covered by Standard Contractual Clauses (SCCs). Data may be processed in the United States or the European Union, depending on provider region.
Your rights
- Request a copy of your data.
- Request deletion of your account and content.
- Opt out of non-essential communication.
- Object to the statistical processing of your usage events.
Email lumiere-dish-support@googlegroups.com for any of the above. We respond within 14 days in the beta.
Cookies
We use a minimal session cookie for authentication (ld_beta_authed), a language preference cookie (ld_locale), and a local preference store for the Dual-Mode last-used setting. For usage statistics we store an anonymous session ID (ld_sid_v1) and, if you arrived via a link we published, its campaign tags (ld_utm_v1) — both live in sessionStorage and are deleted when you close the tab. Our hosting provider, Vercel, measures aggregate page views (Vercel Web Analytics) — it sets no cookies and does not track you across sites. We use no ad trackers, no behavioral advertising, and we sell nothing. To refuse: block or delete this site’s data in your browser settings, or use a private/incognito window; note that refusing the authentication cookie makes sign-in impossible.
Children
Lumière is for users aged 13 and over. If we learn that a child under 13 has created an account, we will delete it.
Usage analytics
We record basic in-product events (for example: a paywall was seen, a recipe was unlocked, a signup was completed) together with an anonymous session ID and the page path. If you arrive through a link we published, we also record its utm campaign tags and the referring domain only — never the full referring address. When you are signed in, events are linked to your account ID so we can count people rather than browsers. We do not record IP addresses or User-Agent strings, we use none of this for advertising, and we never sell it. Legal basis: our legitimate interest in understanding how Lumière is discovered and used (GDPR Art. 6(1)(f)). You can object at any time by emailing us. Events are kept for 12 months and then deleted; when you delete your account, the link to your account ID is removed immediately.
This notice is a beta-stage disclosure, not a substitute for formal legal counsel review.