Privacy Policy

Section 01

1. Who is responsible

Lusso Labs, Inc. (d/b/a Lusso AI), a corporation registered in South Dakota, USA (Business ID DB284852), Lusso Labs, Inc., 1203 S White Chapel Blvd, Ste 100, Southlake, TX 76092, USA, is the controller of your personal data. Contact us about privacy at legal@lusso.ai.

EU representative (GDPR Art. 27): [Company details pending: to be appointed if Lusso is not established in the EU]. UK representative (UK GDPR Art. 27): [Company details pending: to be appointed if Lusso is not established in the UK].

Person in charge of the protection of personal information (Quebec) and data protection contact for Brazil (encarregado): [name or title, to be appointed], reachable at legal@lusso.ai.

For purchases, creators who receive information from us to deliver or support a product (for example a service you booked) handle it as independent controllers and must protect it under our Seller Agreement.

Section 02

2. What we collect and why

Sensitive data: we do not ask for special categories of personal data, and our AI features are not designed to infer them. Please do not include them in messages, notes or reviews.

Section 03

3. Who processes your data

We use the service providers below (processors) under data processing agreements. They may use your data only to provide their service to us. The full list with update history is kept in our records of processing.

Other recipients:

• Creators receive what they need to deliver and support your purchase: your display name, the product and licence you bought, and messages you send them.
• Other users see your public profile, reviews and creator storefront information you publish.
• Tax authorities receive sellers' DAC7 and platform-reporting data where the law requires.
• Authorities when the law requires it, for example a valid order under the Digital Services Act.
• A buyer of Lusso's business, if that ever happens, under the same protections.

Section 04

4. International transfers

Several providers are based in the United States. When we transfer personal data from the EEA, the UK or Switzerland, we rely on the EU-US Data Privacy Framework (and its UK and Swiss extensions) where the provider is certified, or on the European Commission's Standard Contractual Clauses (with the UK addendum) together with supplementary measures such as encryption in transit and at rest. You can ask us for a copy of the relevant safeguards at legal@lusso.ai. Personal data from other countries (for example Brazil, Canada, Japan, South Korea or Switzerland) travels under the same contractual protections. It goes mainly to the United States, and to Ireland for Stripe; where your law requires it, we tell you on request how the law of the receiving country protects it.

Section 05

5. Your rights

Depending on where you live, you have the right to:

• access your personal data and get a copy in a portable format;
• correct inaccurate data;
• delete your data (we keep only what the law requires us to keep);
• restrict or object to processing based on legitimate interests, including fraud prevention and outreach;
• withdraw consent at any time (for example, unsubscribe from marketing email or turn off Creator Copilot), without affecting earlier processing;
• not be subject to decisions based solely on automated processing that significantly affect you (we do not make such decisions), and to ask a person to look again at any decision;
• complain to us, and lodge a complaint with your data protection authority.

You can download or delete your account data from your account settings, unsubscribe or delete a waitlist entry from the link in any waitlist email, or send a request through our privacy request form or to legal@lusso.ai. Your download includes your Ask-Lusso conversations, your creator application and trader details, payouts and earnings records, the reports and appeals you filed and the creators you follow. It also lists every entry of our security and access log that is about you or was made by you, from all of its parts: your sign-ins, each time our staff opened your records (when, what was opened and why), the actions our staff took on your account, your storefront, your listings and their files, your orders and purchases (whether you bought or sold), payment disputes, your reviews, your appeals and your payout holds (such as a suspension, a takedown or a refund), changes to your role, your file uploads and downloads, security signals about your account, and the changes you made through our API in the last 30 days. Each entry shows its time, event, result and country, and for a staff action on one of your records whether you were its account holder, owner, buyer, seller or author; for staff, their role, not their name. No part of the log is held back from it. A staff action recorded against a record that concerns you only indirectly, such as a report or a message thread, is not linked to you automatically: ask us through the privacy request process and we will search for those entries and give them to you. Each download and each deletion is recorded (when and how, never the data itself) so that we can show we answered. Requests are free. We answer within one month; if a request is complex or you send several, we may take up to two further months and, if so, tell you why within the first month. We may ask you to confirm that a request comes from you first, usually with a link we email you or by asking you to reply from the email address on your account, and we never ask for more than we need to be sure it is you; an opt-out, a withdrawal of consent or a complaint needs no confirmation. If we cannot do what you ask, we tell you why and how to complain.

Complaints

If you are unhappy with how we handle your personal data, please complain to us first through our privacy request form or at legal@lusso.ai. We acknowledge every complaint within 30 days, look into it, and tell you the outcome without undue delay. You can also complain at any time to a data protection authority: in the UK the Information Commissioner's Office (ico.org.uk), and in the EU the authority where you live or work.

United States residents

If you live in California, Colorado, Connecticut, Delaware, Indiana, Iowa, Kentucky, Maryland, Minnesota, Montana, Nebraska, New Hampshire, New Jersey, Oregon, Rhode Island, Tennessee, Texas, Utah, Virginia or another US state with a privacy law, you have the right to know what personal information we hold about you and get a copy, to correct it, to delete it, and to opt out of its sale, of sharing for cross-context behavioural advertising, of targeted advertising and of profiling that has legal or similarly significant effects. We do none of those things, and we honour the Global Privacy Control signal as an opt-out. Affiliate links in the AI app directory and links to Lusso Clipping clips carry no personal data about you to the app maker, the affiliate network or the brand, so they are not a sale or a share either. In the last 12 months we collected the categories listed in section 2 (identifiers, customer records, commercial information, internet activity, country-level location, and for creators professional information and the sensitive information needed to pay them and meet tax rules) for the purposes described there. We disclosed them only to the service providers in section 3, for business purposes, and to the other recipients listed there; we did not sell or share them. We use sensitive personal information only to provide the service, keep it secure and meet legal duties, never to infer characteristics about you. We do not offer financial incentives for personal information. You can also opt out at Do Not Sell or Share My Personal Information (it also turns off marketing measurement in that browser), and without an account you can download or erase the analytics recorded from your browser on the same page.

Make a request, opt out or appeal on Your Privacy Choices. We confirm a request within 10 business days and answer within 45 days. If we decline it, you can appeal; a different person reviews the appeal and we answer within 45 days. If we deny your appeal, you can contact the Attorney General of your state. An authorised agent may act for you with your written permission. We will not discriminate against you for using your rights.

Other countries

If you live elsewhere, for example in Canada (including Quebec), Brazil, Switzerland, Australia, Japan, South Korea, Singapore or India, you have the rights your local law gives you, such as access, correction and, where the law provides them, deletion, portability and withdrawing consent. Use the same routes as above. We answer within the time your law sets, and you can complain to your local authority, for example the Office of the Privacy Commissioner of Canada, the Commission d'accès à l'information du Québec, Brazil's ANPD, Switzerland's FDPIC or the Office of the Australian Information Commissioner.

Section 06

6. Cookies

We use cookies that are strictly necessary to run the Service (sign-in, security, the app sign-in, carrying an invite through sign-up and remembering your cookie choice) and cookies that remember settings you chose. Our own analytics keeps random ids in your browser's storage only with your consent where the law requires it (the banner asks first), and otherwise until you turn it off; Global Privacy Control and Do Not Track are always honoured. There are no advertising cookies or third-party trackers; page views and page performance are measured for us by Vercel and Sentry only after you allow analytics yourself. Details are in the Cookie Notice; change your choices on Privacy choices.

Section 07

7. Security

• Encryption in transit (HTTPS everywhere, HSTS) and at rest by our providers.
• Passwords are stored only as salted hashes; sign-in, invite, confirmation and reset tokens are stored only as hashes.
• Purchased secrets (such as revealed prompts and configurations) and admin MFA secrets are encrypted with dedicated keys.
• Raw IP addresses are stored in our database only in a security log of refused requests (rate limits, blocked cross-site requests and malformed analytics data), kept 30 days and readable by security staff only. Everywhere else, where we need to recognise repeat abuse, we keep a keyed hash for a short time.
• Access to production data is limited to staff who need it, protected by multi-factor authentication and logged in an append-only audit log.
• Security events, staff actions and each time our staff open personal data are kept in a tamper-evident log that is checked every day.
• Error reports are scrubbed of emails, tokens and cookies before they leave our servers.
• If a personal data breach puts your rights at risk, we tell the regulator within 72 hours and tell you without undue delay.

Section 08

8. Children

Lusso is for adults. You must be 18 or older to create an account or buy, and we do not knowingly collect data from children. If you think a child has given us personal data, tell us at legal@lusso.ai and we will delete it. Lusso Clipping pays clippers, so a clipper must also be 18 or older, or the age of majority where they live if that is higher, before joining or being paid.

Section 09

9. Automated processing and AI

We use automated checks to rank products (see How Ranking Works), to stop spam and bots (rate limits and bot checks), and to help our team prioritise reports.

AI-assisted risk screening

New creator applications, listings and their uploaded code, payments, refunds and disputes, and reviews are checked by rules and, where we have switched it on, by AI models from Anthropic. They look for signs of fraud, scams, malware, fake reviews and products that break our Acceptable Use and AI Policy, and give our team a risk level with the evidence behind it. The AI can raise a concern but cannot clear what the rules found, and it never acts on its own: removing or restricting a listing, rejecting a creator application, warning, suspending or banning an account, pausing a payout, refunding an order, hiding a review are always decided by a person, who sees the evidence first. When automated screening found the issue, the statement of reasons we send you says so, and you can appeal to a person. A clean creator application may in future be approved automatically, but never refused automatically. We screen for fraud and safety only. Screening does not scan private messages: messages reported to us are reviewed by people.

Creator Copilot

Creators who turn on Copilot get AI drafts of listing copy, social posts and replies, built from their own Lusso data. Drafts are labelled as AI drafts, the creator reviews and publishes them, and Copilot never sends, posts, prices or publishes anything itself. Buyers' names and contact details are removed before a message is used for a reply draft.

Lusso, the creator assistant

In Creator Studio, Lusso answers creators' questions from their own Lusso data and Lusso's guides, with the sources shown under every answer, and writes drafts with Copilot's tools. Answers are labelled as AI answers, and sentences with numbers no source holds are removed before they are shown. Lusso never publishes, prices, sends, posts, emails, charges or submits anything: the creator presses every button. Without its AI, Lusso shows passages from its guides instead.

Ask-Lusso assistant

Where enabled, the assistant answers shopping questions from our catalog. Its answers are labelled as AI-generated.

We do not use your messages, files or purchases to train AI models, and our AI provider may not use them for training either. We do not make decisions based solely on automated processing that produce legal or similarly significant effects for you (GDPR Art. 22). You can ask for a person to review any decision and object to the screening by writing to legal@lusso.ai.

Section 10

10. Changes to this policy

When we change this policy we update the version and date at the top of the page. For material changes we notify account holders and waitlist members by email before they take effect, and signed-in members are asked to review the new version the next time they use Lusso.

Keep reading

Related documents

• Terms of Service

  Read

• Your Privacy Choices

  Read

• Cookie Notice

  Read

Questions about this document? Contact us.