Privacy Policy

Last updated: 11 October 2026

Lumi HQ (“we”, “us”) provides client galleries, print sales and studio management software for photographers. This policy explains what personal information we collect, how we use it, and the choices you have. We handle personal information in accordance with the Australian Privacy Principles (APPs) in the Privacy Act 1988 (Cth).

Who this policy covers

It covers three groups of people:

• Photographers — account holders who use Lumi HQ to run their business.
• Photographers’ clients — people whose galleries, bookings, invoices, contracts and photos a photographer manages through Lumi HQ.
• Visitors — people browsing this website, including anyone who joins our waitlist.

What we collect

• Account information — name, email address, business name, ABN and contact details you provide when signing up or configuring your studio.
• Client data entered by photographers — names, email addresses, phone numbers, booking details, contracts, questionnaire responses, invoices and message threads. The photographer controls this data; we store and process it to provide the service.
• Photos — images uploaded to galleries, including any metadata embedded in them (such as capture time and location, if present in the file).
• Payment information — handled by Stripe. We never store full card numbers; we keep records of transactions, invoices and payouts.
• Usage information — gallery views, downloads and favourites (used to provide analytics to the photographer), plus standard technical logs (IP address, browser type) for security and reliability.
• Email delivery information — whether an email a photographer sent through Lumi HQ was delivered, opened or had a link clicked. Emails sent from the platform’s own address carry this through our email provider; a photographer sending through their own Gmail or mail server can additionally switch on open tracking, which adds an invisible image to their outgoing mail. It is off unless they turn it on. Open tracking is approximate by nature — some mail apps load the image automatically and some never load it at all — and is shown to the photographer only, never used for advertising or shared with anyone else.
• Waitlist and marketing — the email address you give us when joining the waitlist or opting into product updates.

How we use it

• To provide, secure and improve the service — hosting galleries, processing orders, sending the emails a photographer asks us to send (gallery delivery, invoices, booking reminders).
• To process payments and print orders through our payment and fulfilment partners.
• To respond to support requests.
• To send product updates you’ve opted into. Every marketing email includes an unsubscribe link; transactional emails (like an invoice) are sent regardless because the service requires them.

We do not sell personal information, and we do not use your photos or your clients’ data for advertising.

Gallery search and Find me

Photographers on some plans can let clients search a gallery. Two features work differently:

• Photo search (typing “cake” or “first dance”): each photo in the gallery is sent to an AI service that writes a short description of what’s in it, such as “bride and groom cutting the cake”. The description is told never to identify anyone. We keep the description to answer searches, and we don’t use photos to train any model.
• Find me (finding the photos you’re in with a selfie): this uses face recognition, and a face template is sensitive information under the Privacy Act. It is off unless the photographer turns it on for a gallery. When they do, the faces in that gallery’s photos are recognised by Amazon Rekognition in its Sydney region, so the face data is held in Australia. It is kept separately for each gallery, used only to answer Find me searches in that gallery, and never shared across galleries or photographers. We keep only a reference to each face and where it sits in the photo, never a separate image of anyone’s face.

A guest using Find me is told what happens before their camera opens, and nothing is sent until they agree. Their selfie is compared with that gallery’s faces and then discarded: it is not saved by us or by Amazon. A gallery’s face data is deleted when the photographer turns Find me off, when the gallery is permanently deleted, 30 days after the gallery expires, and when the photographer’s account is closed. Faces in a deleted photo are deleted with it. If you’re in a gallery and would like your face data removed sooner, ask the photographer to turn Find me off or contact us.

Third-party services

We rely on a small set of processors to run Lumi HQ: cloud hosting and storage providers, our database provider, Stripe (payments), our email delivery provider, SMS delivery (where a photographer enables reminders), AI and face recognition services for gallery search (described above) and print fulfilment labs (only the details needed to produce and ship an order — typically the recipient’s name, shipping address and the ordered image). Each receives only what it needs to perform its function. Some of these providers store data outside Australia; where that happens, we take reasonable steps to ensure they handle it consistently with the APPs.

Security and retention

Data is encrypted in transit, access to production systems is restricted, and we keep encrypted backups with a separate provider. We retain your data while your account is active. If you close your account, we delete or de-identify personal information within a reasonable period, except where we must keep records (for example, tax and transaction records) to meet legal obligations.

Access, correction and deletion

You can access and update most of your information directly in your dashboard. For anything else — including a copy of your data or a deletion request — contact us and we’ll respond within a reasonable time. If you are a photographer’s client, the photographer controls your data; contact them first, and we’ll support their request.

Cookies

We use cookies that are necessary to sign you in and keep your session secure. On our public website (but not inside the app, and not on a photographer’s client galleries) we use Google Analytics 4 to count visits and see which pages people find useful. We turn off Google’s advertising signals and ad personalisation, so we do not build advertising profiles and your visit is not used to target ads to you elsewhere. You can block it with any browser setting or extension that blocks analytics, and the site works exactly the same.

On the same public pages, and on the sign-up and studio set-up screens, we also use Microsoft Clarity to record how pages are used — clicks, scrolling and where people get stuck — so we can fix what gets in the way. Anything you type, including your name, email address and password, is masked before it leaves your browser, and we don’t tell Clarity who you are. Clarity is run by Microsoft and its data is stored overseas (in the United States). It is never used inside the app or on a photographer’s client galleries, and blocking it changes nothing about how the site works.

Complaints and contact

If you have a question or believe we’ve mishandled your information, contact us and we’ll look into it promptly. If you’re not satisfied with our response, you can complain to the Office of the Australian Information Commissioner (OAIC) at oaic.gov.au.

We’ll update this policy as the product evolves and note the date of the latest change at the top of this page.