Privacy policy

Last updated 25 October 2026.

Lumora (https://lumora.video) turns screen recordings and screenshots into short demo videos. This page explains what we collect, why, who else sees it, how long we keep it and how to reach us. Lumora is run from Finland, and the EU General Data Protection Regulation (GDPR) applies.

What we collect

  • Account: your email address, your name, a salted hash of your password (never the password itself), your plan, whether you confirmed your email, and the answer to "where did you hear about us" if you gave one.
  • Your content: the recordings, screenshots, logos and music you upload, your video projects, brand kits, and the videos you export.
  • Share link statistics: for each exported video, counts of views, plays, finishes and call-to-action clicks. We don't record who watched.
  • Website visits: daily counters of which pages were opened and which site or AI assistant sent the visit. No cookies, no IP addresses and nothing that identifies you are stored for this.
  • Feedback you send us, with your email if you add it.
  • Payments: Stripe handles card details. They never reach our servers; we keep only the Stripe customer id.
  • Connected apps: when you connect Lumora to an assistant such as Claude or ChatGPT, we store the app's registration (its name and return address) and hashes of the access tokens we issued to it.

How we use it

To run your account, store and render your videos, host share links, bill paid plans, answer support requests and keep the service secure. We do not sell your data, show ads or use your content to train AI models.

Apps and assistants you connect (MCP)

Lumora has a hosted MCP server at https://lumora.video/mcp and plugins for Claude and Codex. When you connect one of them:

  • You sign in to Lumora and approve the connection on our consent screen. The app gets an access token that works only for your Lumora account. It is valid for one hour and renewed with a refresh token that lasts up to 90 days.
  • The app sees what our tools return: your name and email, your video projects, previews and export links. It can upload media, create and change projects and start exports for you.
  • We receive only what the assistant puts in a tool call, such as a video spec, an image or a link to a file. We don't receive, read or store your conversations, your assistant's memory or files you didn't send to a tool.
  • If a tool call names a public web page, Lumora opens that page to take screenshots and its colours.
  • You can disconnect at any time in the app's connector settings. Deleting your Lumora account also ends every connection.

Who else processes data

We use a few service providers, only for the purposes above:

  • Oracle Cloud Infrastructure (data centre in Frankfurt, Germany) hosts the servers and stores everything listed above.
  • Stripe processes payments for paid plans.
  • Anthropic receives one frame of your media and your one-line brief when you ask Lumora to direct a video for you ("Direct my video" in the editor, or the brief field through MCP). It writes titles and callouts. Anthropic doesn't use API data to train its models.
  • Resend sends our emails, such as password resets, email confirmations and team invitations.

Anyone with a share link can watch that video. Your other projects and uploads are private to you and, for team projects, to your team.

How long we keep it

  • Your account, projects, uploads and exported videos stay until you delete them or delete your account.
  • Deleting your account removes the account, its projects, uploads, exported videos, API keys and connected-app tokens right away. Daily backups of the database are kept for 14 days and then overwritten.
  • Access tokens expire after one hour and refresh tokens after 90 days, or sooner when you disconnect.
  • Password reset links expire after one hour and email confirmation links after seven days.
  • Server logs, used only for running and securing the service, are rotated automatically and kept for a short time.

Cookies

One sign-in cookie keeps you logged in for 30 days. There are no advertising or analytics cookies.

Your rights

You can see and change your details and delete your account with all its content in Account settings at any time. Under the GDPR you can also ask for a copy of your data, ask us to correct or erase it, or object to how we use it. Email us and we answer within 30 days. You can also complain to your data protection authority; in Finland that is the Data Protection Ombudsman (tietosuoja.fi).

Lumora is not meant for children under 16.

Contact

Questions about privacy, or a request about your data: support@lumora.video.

If this policy changes, we update this page and the date at the top.