Privacy

Privacy Policy

Last updated: 2 August 2026

This policy explains what personal data Host Luma collects when you visit HostLuma.app or use AI Hosting, why we collect it, who we share it with, and the rights you have over it under UK data protection law (the UK GDPR and the Data Protection Act 2018).

• Who is responsible for your data
• Personal data we collect
• How and why we use it
• Our lawful basis for processing
• Who we share data with
• International data transfers
• How long we keep data
• How we protect your data
• Cookies and similar technologies
• Your rights (UK GDPR)
• Children's privacy
• Ask Luma, the Host Luma AI Assistant
• Changes to this policy
• Contact and complaints

Who is responsible for your data

Host Luma, the trading name of a UK-based sole trader, is the data controller for personal data processed through HostLuma.app and the AI Hosting service. For data protection questions or to exercise any of the rights below, contact support@hostluma.co.uk.

Personal data we collect

Depending on how you use HostLuma.app, we collect:

• Account data: your email address, and authentication details when you sign in.
• GitHub connection data: repository metadata, the branch and commit information needed to build and publish your project, and the minimum OAuth access scope needed to read the connected repository. We do not read repositories you have not connected.
• Billing data: your subscription status, plan and payment history. Card details are collected and stored by Stripe, our payment processor — Host Luma does not store your full card number.
• Deployment and technical data: build logs, deployment status, preview and custom domain configuration, and infrastructure logs needed to operate and secure the service.
• Support communications: messages you send us by email, live chat or WhatsApp, so we can help with your query and keep a record of what was resolved.
• Usage and log data: standard technical data such as IP address, browser type and pages visited, collected for security, abuse prevention and diagnosing faults.

How and why we use it

We use personal data to: create and operate your account; build, publish and serve your application; process subscription payments and prevent fraud; provide customer support over live chat, WhatsApp and email; secure the platform against abuse and unauthorised access; and communicate essential service updates, such as a change to these policies or a billing issue. We do not sell your personal data.

Our lawful basis for processing

We rely on: contract — processing needed to provide AI Hosting once you sign up, including billing, builds and deployments; legitimate interests — keeping the platform secure, preventing abuse, and improving reliability, balanced against your rights; and legal obligation — where we must keep certain records, such as billing data, to comply with UK tax and accounting law.

Who we share data with

We share personal data only with the service providers needed to run AI Hosting, under contracts that require them to protect it:

• Stripe — payment processing and subscription billing.
• GitHub — source code hosting and the authorisation you grant when you connect a repository.
• Bunny.net — global CDN delivery for published applications and attached custom domains.
• OVH and Backblaze — the infrastructure and off-site backup storage that Host Luma's hosting platform runs on.

We do not share personal data with third parties for their own marketing purposes. We may disclose data if required by law, to protect Host Luma's rights, or to investigate suspected abuse of the service.

International data transfers

Host Luma's infrastructure runs on servers in the EU/UK. Some of the third-party providers listed above may process data outside the UK. Where that happens, we rely on their standard contractual clauses, UK adequacy regulations, or an equivalent lawful transfer mechanism to keep your data protected to a UK standard.

How long we keep data

We keep account and billing data for as long as your subscription is active, and for a limited period afterwards to meet legal and accounting obligations and resolve any disputes. Deployment logs and build history are retained for a working period to support troubleshooting, then rotated out. Backups follow Host Luma's standard retention windows and are not kept indefinitely once the underlying account is deleted. If you close your account, contact support@hostluma.co.uk if you want confirmation that your data has been deleted from active systems.

How we protect your data

Host Luma's infrastructure runs on CloudLinux with resource isolation between accounts, with Imunify360 providing continuous malware detection and file isolation, and brute-force and XML-RPC abuse blocked at the server level. Backups are kept in three places — an offsite copy, a second remote copy, and a local snapshot — so no single failure holds the only copy of your data. Access to production systems is restricted to the Host Luma team who need it to operate the service.

Cookies and similar technologies

HostLuma.app keeps cookies and tracking to a minimum. We use essential cookies needed to keep you signed in and to remember basic preferences. This site loads Google Fonts (Inter and JetBrains Mono) from Google's servers for typography; loading a webfont can expose your IP address to Google in the same way any external resource request does. We do not run third-party advertising trackers or analytics cookies on HostLuma.app.

Your rights (UK GDPR)

Under the UK GDPR, you have the right to:

• Access the personal data we hold about you.
• Rectification of inaccurate or incomplete data.
• Erasure of your data, where there is no legal reason for us to keep it.
• Restriction of how we process your data in certain circumstances.
• Portability — receiving your data in a structured, commonly used format.
• Object to processing based on our legitimate interests.
• Withdraw consent at any time, where we rely on consent.

To exercise any of these rights, email support@hostluma.co.uk. We will respond within one month, as required by law. You also have the right to complain to the UK's data protection regulator, the Information Commissioner's Office (ICO), though we'd appreciate the chance to resolve any concern directly first.

Children's privacy

HostLuma.app is not directed at children, and accounts require you to be at least 18 years old, or the age of legal majority in your jurisdiction. We do not knowingly collect personal data from children.

Ask Luma, the Host Luma AI Assistant

Public pages include “Ask Luma”, the Host Luma AI Assistant. Questions you type are sent to Host Luma’s own backend, which answers from approved Host Luma product information. The assistant has no access to customer accounts, deployments or billing records. Please do not enter passwords, API keys, payment-card details or sensitive personal information. Host Luma keeps anonymised usage and reliability metrics for the assistant, not the content of your questions.

Changes to this policy

We may update this policy as the service or the law changes. We'll update the “Last updated” date above, and where a change is material we'll tell you by email or a notice in the portal before it takes effect.

Contact and complaints

For privacy questions or to exercise your rights, contact support@hostluma.co.uk, or reach us via the routes on our support page.