Maltrim LLC d/b/a Lumiveil
Lumiveil is operated by Maltrim LLC, a Louisiana limited liability company doing business as Lumiveil ("Maltrim LLC," "Lumiveil," "we," "us," or "our"). "Lumiveil" is a registered trade name (d/b/a) of Maltrim LLC. Wherever this Policy refers to "Lumiveil," it refers to Maltrim LLC in its capacity as the operator of the Lumiveil platform. Maltrim LLC is the data controller for personal information collected through the Service.
This Privacy Policy applies to all personal information collected through the Lumiveil website, platform, and related services (collectively, the "Service"). By creating an account or using the Service, you:
Expressly consent to the collection, use, and sharing of your personal information as described in this Policy;
Acknowledge that this consent is freely given, specific, informed, and unambiguous;
Agree that this Policy, together with our Terms of Service and Community Guidelines, constitutes the complete agreement governing Maltrim LLC's use of your data.
If you are between the ages of 16 and 17, your parent or legal guardian must review this Policy and consent to the collection and use of your personal information on your behalf.
We collect the following categories of personal information that you provide:
Identity data: Username, display name, date of birth, profile bio and avatar;
Contact data: Email address;
Authentication data: Password (stored exclusively as a one-way bcrypt hash — never readable);
Financial data: Payment method details (processed and tokenized by our PCI-DSS-compliant payment processor — Lumiveil never receives or stores full card numbers);
Age data: Self-declared date of birth used to verify you meet the minimum age of 16;
User content: Characters you create, messages you send, personas you build, wellness check-in entries you record, follows/blocks you set, and other content you submit;
Communications: Support requests, reports, and feedback you send us.
When you use the Service, we automatically collect:
Log data: IP address, browser type and version, referring URLs, pages visited, timestamps;
Device data: Device type, operating system, screen resolution, language settings;
Usage data: Features used, characters interacted with, session duration, message counts;
Cookie data: Session identifiers and preference data (see Section 8).
We receive limited information back from the service providers we use to operate Lumiveil:
Payment processor: Payment status and subscription status;
Automated content moderation: Moderation scores for text and images you submit — the moderation provider receives the content being scanned, not your identity.
We process your personal information on the following legal bases:
Contract performance: To create and manage your account and provide the Service you have requested;
Legal obligation: Age verification, tax reporting, and compliance with applicable law;
Legitimate interests: Platform security, fraud prevention, content moderation, and improving our services;
Consent: For optional features and, where applicable, for users between 16 and 17, parental consent for processing personal information of minors.
We use your personal information solely for the following purposes:
Creating, verifying, and managing your account;
Verifying that you meet the minimum age requirement of 16;
Processing payments and managing your subscription and credit balance;
Providing, maintaining, troubleshooting, and improving the Service;
Moderating user-generated content and enforcing our Terms of Service and Community Guidelines;
Sending transactional communications (account verification, password reset, billing receipts);
Detecting, investigating, and preventing fraud, abuse, and Terms of Service violations;
Responding to legal process, court orders, or law enforcement requests;
Enforcing our Terms of Service and Community Guidelines and protecting the rights and safety of our users and the platform.
We do not use your personal information for advertising targeting, do not sell your data to advertisers, and do not build advertising profiles based on your platform activity.
Maltrim LLC does not sell, rent, or trade your personal information.
We share limited personal information with trusted third-party service providers ("sub-processors") who perform specific functions on our behalf under contractual confidentiality obligations. These providers may only use your data to perform services for Maltrim LLC. The categories of sub-processors we use, and the purposes for which we use them, are:
Payment processing — to process and tokenize payment method details and manage subscriptions.
Database and file storage — to store your account data, characters, conversations, and uploaded files.
Application hosting and infrastructure — to run the Lumiveil application servers.
AI model inference — to generate character responses from the messages you send in a conversation. Where these providers offer an opt-out from using our request data to train their models, we have exercised it.
Automated content moderation — to scan submitted text and images for policy violations. We send the content being scanned, not your identity.
Transactional email delivery — to send account emails (verification, password reset, receipts, notifications).
Inbound email forwarding — to route messages sent to our contact addresses to our support inbox.
Web fonts — Lumiveil loads a web-font service; when you view a page, your browser fetches font files from that service's servers, which receives your IP address as part of that request. We do not send any account information to the font service.
You may request additional information about our specific sub-processors by emailing privacy@lumiveil.net.
We may disclose your information when required by law, court order, subpoena, or other legal process, or when we believe in good faith that disclosure is necessary to comply with applicable law, protect our legal rights, protect the safety of any person, or investigate fraud or security incidents. We will report suspected child sexual abuse material to the National Center for Missing & Exploited Children (NCMEC) as required by law.
In the event of a sale, merger, acquisition, or transfer of all or substantially all assets related to the Lumiveil platform or Maltrim LLC, your information may be transferred to the successor entity. You will be notified at least 30 days before such transfer occurs and may delete your account prior to the transfer if you do not consent.
We may share information when necessary to enforce our Terms of Service or Community Guidelines, investigate potential violations, or protect the rights, property, or safety of Maltrim LLC, our users, or others.
Because Lumiveil accepts users as young as 16, we treat age-related data with heightened care:
Date of birth is used exclusively to verify the minimum age requirement and calculate account age;
Date of birth is never shared with third parties except as required by law;
Lumiveil relies on self-declared age at registration and does not currently perform third-party document-based identity verification;
Age-related records may be retained for legal compliance purposes even after account deletion.
Lumiveil uses only a small number of first-party cookies, all of which are strictly necessary for the Service to function:
Authentication cookies: `lumi_refresh` and `lumi_admin_refresh` — HTTP-only, secure, SameSite=lax refresh tokens. These are required for you to remain signed in;
Session and preference storage: Small amounts of preference data may be stored in browser localStorage (for example, your current access token, active persona, and UI preferences). This is stored only on your device and is not transmitted to third parties;
Consent record: A single cookie or localStorage flag records that you have acknowledged our cookie notice.
Lumiveil does not use advertising cookies, analytics cookies, third-party tracking pixels, or any tracking technology that shares your data with advertisers. You may clear cookies through your browser settings at any time; doing so will sign you out of the Service.
We implement the following security measures to protect your personal information:
All passwords are hashed using bcrypt with a cost factor of 12 — your password is never stored in readable form;
All data transmitted between your device and our servers is encrypted using TLS/HTTPS;
Refresh tokens are stored in HTTP-only, secure, SameSite cookies inaccessible to client-side scripts;
Database-level row security controls prevent unauthorized cross-account data access;
Rate limiting protects against brute-force and credential-stuffing attacks;
Content moderation is applied to user-generated text and images to detect prohibited content.
Despite these measures, no security system is impenetrable. In the event of a data breach that affects your personal information, we will notify you in accordance with applicable law. To report a security vulnerability, please email security@lumiveil.net.
We retain your personal information as follows:
Account data is retained for the life of your account plus 90 days after deletion;
Chat messages are retained for the life of your account; you may delete individual conversations at any time. Deleted conversations are removed from user-facing views immediately and purged from backups within 30 days;
Payment and billing records are retained for 7 years as required by tax law;
Age-related records may be retained indefinitely for legal compliance;
Moderation, fraud, and security incident records may be retained indefinitely for safety purposes.
Subject to applicable law and verification of your identity, you have the following rights:
Access: Request a copy of the personal data we hold about you;
Correction: Request correction of inaccurate or incomplete data;
Deletion: Request deletion of your account and personal data, subject to the retention requirements in Section 10;
Portability: Request your data in a structured, machine-readable format;
Objection: Object to processing based on legitimate interests;
Withdrawal of consent: Withdraw consent for consent-based processing at any time without affecting prior processing.
To exercise any right, email privacy@lumiveil.net. We will respond within 30 days. We may require identity verification before processing requests.
If you are a California resident, you have rights under the California Consumer Privacy Act and California Privacy Rights Act, including the right to know, the right to delete, the right to correct, and the right to opt out of the sale or sharing of personal information. We do not sell or share personal information for cross-context behavioral advertising. To exercise your rights, contact privacy@lumiveil.net. We will not discriminate against you for exercising your privacy rights.
If you are located in the European Economic Area or United Kingdom, our processing of your personal data is subject to the General Data Protection Regulation (GDPR) or UK GDPR as applicable. You have the right to lodge a complaint with your local supervisory authority. For transfers of personal data from the EEA/UK to the United States, we rely on standard contractual clauses or other approved transfer mechanisms.
For users between the ages of 16 and 17 in jurisdictions where GDPR Article 8 or equivalent law requires parental consent for the processing of a minor's personal data, we rely on the consent of a parent or legal guardian, obtained through the user's affirmation at account registration and continued use.
Lumiveil is intended for users aged 16 and older. We do not knowingly collect, use, or retain personal information from anyone under the age of 16. If we discover or are notified that we have inadvertently received information from a person under 16, we will immediately delete that information and terminate the associated account. If you believe someone under 16 has created an account on Lumiveil, please contact safety@lumiveil.net immediately.
For clarity, Lumiveil is not directed to children under 13 and is not subject to the Children's Online Privacy Protection Act (COPPA), because our minimum age of 16 exceeds the COPPA age threshold.
We may update this Privacy Policy from time to time. We will notify you of material changes by email at least 30 days before the updated Policy takes effect. For material changes, we may require you to affirmatively re-accept the updated Policy before continuing to use the Service. The date of the most recent update will always be displayed at the top of this document. Continued use of the Service after the effective date of changes constitutes your acceptance of the updated Policy.
Privacy inquiries: privacy@lumiveil.net
Safety concerns: safety@lumiveil.net
Security vulnerabilities: security@lumiveil.net
General support: support@lumiveil.net