> For the complete documentation index, see [llms.txt](https://lupaai.gitbook.io/documentation/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://lupaai.gitbook.io/documentation/legal/privacy-policy.md). # Privacy Policy **Last updated:** 18 August 2026 At LUPA we process personal data in order to provide our services for generating, editing and upscaling images and video using artificial intelligence. This Policy explains what data we process, why, on what legal basis, who we share it with and what rights you have. This Policy follows the layered information model recommended by the Spanish Data Protection Agency (AEPD): a summary table of key information, followed by the detailed information. *** ### Key information at a glance | | | | --------------------------- | -------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- | | **Controller** | LUPA SOFTWARE, S.L. – Tax ID B22790133 – Avinguda Cerdanyola 92, office 31, 08173 Sant Cugat del Vallès, Barcelona, Spain | | **Contact** | | | **Purposes** | Providing the service, managing your account and subscription, billing, support, security and fraud prevention, content moderation, legal compliance, marketing communications and, on certain plans, improving our artificial intelligence models | | **Legal bases** | Performance of the contract, compliance with legal obligations, legitimate interests and consent | | **Recipients** | Infrastructure providers, artificial intelligence model providers, our payment gateway, communication and analytics tools, and the competent authorities where required by law | | **International transfers** | Yes, to third countries, covered by adequacy decisions, Standard Contractual Clauses or other safeguards under the GDPR | | **Retention** | For the duration of the relationship and thereafter for the applicable statutory limitation periods | | **Your rights** | Access, rectification, erasure, objection, restriction, portability and the right not to be subject to automated decisions, by writing to , as well as the right to complain to the AEPD | *** ### 1. Data controller * **Company:** LUPA SOFTWARE, S.L. ("LUPA", "we", "us") * **Tax ID (NIF):** B22790133 * **Registered office:** Avinguda Cerdanyola 92, office 31, 08173 Sant Cugat del Vallès, Barcelona, Spain * **Registry details:** Commercial Registry of Barcelona, Volume/I.R.U.S. 1000456031357, Folio 1, Sheet B 640175, Entry 1 * **Data protection contact:** *** ### 2. LUPA's dual role: controller and processor This distinction matters, because it determines who you should approach and which rights you exercise: **2.1. LUPA acts as controller** in respect of personal data relating to you as a user: your registration details, billing data, platform usage data, support interactions and marketing communications. This Policy governs that processing. **2.2. LUPA acts as processor** in respect of the personal data of third parties that you upload to the platform, principally the data contained in the images and videos you provide. In that case **you** are the controller, and it is for you to have a legal basis, to inform the data subjects and to handle their rights requests. That relationship is governed by our Data Processing Agreement, available on request to . *** ### 3. Categories of data we process **3.1. Identity and account data.** Name or username, email address, password in encrypted form, language and country, and the identifier from your authentication provider where you sign in through a third-party service. **3.2. Billing and payment data.** Name or company name, tax identification number, billing address, subscription history and invoices issued. **We do not store or process full card details**: payments are processed entirely through our payment service provider, which acts as an independent controller in respect of that data. **3.3. Usage and technical data.** IP address, device and browser identifiers, operating system, date and time of access, pages visited, features used, models employed, number and type of operations run, Credit consumption, error logs and performance data. **3.4. Content you provide to us.** The images, videos, files and text instructions (prompts) you upload or enter, together with the Outputs generated. **This content may include the personal data of third parties**, including images of identifiable individuals. By uploading it, you warrant that you hold the necessary rights and consents in accordance with our Terms and Conditions. **3.5. Support and communications data.** The content of your enquiries, complaints and communications with our team, and data associated with handling them. **3.6. Affiliate and partner programme data.** Where you take part in Lupa Partners or in creator programmes: identification details, tax details, bank or payment account, attributed conversions and commissions earned. **3.7. Cookies and similar technologies.** As set out in our Cookies Policy, available at . *** ### 4. The nature of data contained in images: clarification on biometric data We are conscious that the greatest sensitivity in our service lies in the processing of images. **4.1.** A photograph of a person does not, in itself, constitute a special category of data. Under Article 9 GDPR and Recital 51, biometric data only falls into that category where it is processed **for the purpose of uniquely identifying a natural person**. LUPA does not use the images you upload to identify, recognise, verify or categorise individuals, and does not operate facial recognition or emotion recognition systems. **4.2.** However, if the content you upload reveals special categories of data — for example information about the health, ethnic origin, religious beliefs, sexual orientation or political affiliation of identifiable individuals — you are the controller of that processing and must rely on a valid exception under Article 9(2) GDPR, normally the data subject's explicit consent. **4.3.** We never use content that we identify as containing special categories of data to improve our models. *** ### 5. Purposes and legal bases | Purpose | Data | Legal basis | | ------------------------------------------------------------------------------------------------------ | ------------- | --------------------------------------------------------------------------------------------------------------------------------- | | Creating and managing your account and providing the service purchased | 3.1, 3.3, 3.4 | Performance of the contract (Art. 6(1)(b) GDPR) | | Processing payments, managing subscriptions and issuing invoices | 3.1, 3.2 | Performance of the contract and legal obligation (Arts. 6(1)(b) and 6(1)(c)) | | Retaining accounting and tax documentation | 3.2 | Legal obligation (Art. 6(1)(c)): Spanish Commercial Code and General Tax Act | | Handling enquiries, support and complaints | 3.1, 3.5 | Performance of the contract and legitimate interests | | Ensuring platform security and preventing fraud, abuse of free plans and creation of multiple accounts | 3.1, 3.3 | Legitimate interests (Art. 6(1)(f)) | | Moderating content and detecting prohibited uses | 3.4 | Legal obligation (Regulation (EU) 2022/2065) and legitimate interests | | Complying with transparency obligations on AI-generated content | 3.4 | Legal obligation (Regulation (EU) 2024/1689) | | Analysing aggregate use of the service in order to improve it | 3.3 | Legitimate interests | | Sending you communications about the service, contractual changes and security notices | 3.1 | Performance of the contract and legal obligation | | Sending you marketing communications about LUPA products and features | 3.1 | Consent (Art. 6(1)(a)) or legitimate interests within the scope of Art. 21.2 of the Spanish E-Commerce Act for existing customers | | Advertising measurement and remarketing via pixels and conversions API | 3.1, 3.3 | Consent (Art. 6(1)(a)) | | Improving and training our artificial intelligence models, on the plans where this applies | 3.4 | Legitimate interests (Art. 6(1)(f)), with a right to object — see Clause 6 | | Managing affiliate programmes and settling commissions | 3.6 | Performance of the contract and legal obligation | | Bringing and defending claims, including recovery of sums owed | 3.1, 3.2, 3.3 | Legitimate interests and compliance with legal obligations | Where we rely on legitimate interests, we have carried out and documented the corresponding balancing assessment between our interests and your rights. You may request information about that assessment by writing to . *** ### 6. Improving our artificial intelligence models This is one of the points on which we consider it most important to be clear. **6.1. Premium, Business and Creator Plans.** We **do not use** your Input Content or the Outputs you generate to train, fine-tune or improve artificial intelligence models. **6.2. Free plan and Try and Pro Plans.** We may use your content for that purpose on the basis of our legitimate interest in improving the quality of the service. **You may object at any time**, free of charge and without giving reasons, from your account settings or by writing to . Exercising this right does not affect your access to the service or its features. **6.3. Exclusions applicable to all plans.** We do not use for this purpose any content we identify as containing special categories of data, any content marked as private by the user, or any content subject to a third-party complaint. **6.4. Effect of an objection.** An objection takes effect prospectively. Models that have already been trained cannot technically be reversed to extract the contribution of a specific item of content; in that case, deletion applies to the source content and to future training datasets. *** ### 7. Automated decision-making **7.1.** We use automated systems to detect content that breaches our Acceptable Use Policy, and to detect fraud, abuse of free plans and the creation of multiple accounts. These systems may result in a specific operation being blocked or your account being suspended. **7.2.** Where an automated decision may produce legal effects or similarly significantly affect you — in particular the cancellation of your account — **you have the right to obtain human intervention, to express your point of view and to contest the decision**, in accordance with Article 22 GDPR. You may do so by writing to within the period set out in our Terms and Conditions. **7.3.** The logic involved consists, in essence, of comparing your content and instructions against safety classifiers, and of analysing technical and behavioural signals to detect patterns of abuse. The envisaged consequences are the blocking of the operation, the restriction of features or the suspension of the account. **7.4.** This route does not apply to cases of child sexual exploitation material or non-consensual intimate content, where cancellation is immediate and permanent and the matter is reported to the competent authorities. *** ### 8. Recipients and processors We share data with the following recipients, strictly to the extent necessary for the purposes indicated: | Recipient | Purpose | Location | | ----------------------------------------------------- | -------------------------------------------------------------------------------------------- | ------------------------------------------------------------- | | Cloudflare, Inc. | Hosting, content storage, content delivery network and protection against attacks | USA, with processing in the configured region | | Artificial intelligence model providers | Running generation, editing, upscaling and animation operations on images and video | EU, USA and other third countries. See the sub-processor list | | Stripe, Inc. and Stripe Payments Europe, Ltd. | Processing payments, managing subscriptions and handling payment disputes | Ireland and USA | | MailerLite Limited | Sending marketing communications | European Union | | Resend, Inc. | Sending transactional and service emails | USA | | PostHog, Inc. | Product analytics and usage measurement | European Union | | Crisp IM SAS | Chat and customer support management | France | | FirstPromoter | Managing the affiliate programme, attributing conversions and settling commissions | European Union | | Advertising platforms | Conversion measurement and remarketing via pixels and conversions API, subject to consent | USA | | Legal, tax and accounting advisers | Legal compliance, accounting and defence of claims | Spain | | Debt collection agencies and credit reference systems | Management of unpaid debts, in accordance with Article 20 of the Spanish Data Protection Act | Spain | | Authorities and law enforcement | Where there is a legal requirement or evidence of a criminal offence | Spain and European Union | In addition to the above, we use analytics tools developed in-house and hosted on our own infrastructure, which do not involve any disclosure of data to third parties. Because the range of artificial intelligence models available evolves continuously and we add and remove models frequently, **the named and up-to-date list of model providers, indicating their location and the safeguards applicable to each transfer, is published and maintained at** [**https://lupa.art/legal/subprocessors**](https://lupa.art/legal/subprocessors), a page which forms an integral part of this Policy. That same list covers our other processors and sub-processors, indicating the service each provides. We have entered into the data processing agreements required by Article 28 GDPR with all of them. We will notify the addition of any new processor with access to personal data by updating that page and, where the change is material, in accordance with Clause 16. We do not sell your personal data and we do not disclose it to third parties for their own advertising purposes. *** ### 9. International transfers **9.1.** Providing the service requires transferring data to providers located outside the European Economic Area, in particular infrastructure providers and artificial intelligence model providers. **9.2.** These transfers are covered by one or more of the following mechanisms: European Commission adequacy decisions, including the EU–US Data Privacy Framework where the importer is certified; Standard Contractual Clauses approved by the European Commission; or the remaining safeguards provided for in Articles 44 to 49 GDPR. **9.3.** Some of the models we integrate are operated by providers established in countries for which **no adequacy decision exists**. In those cases we apply Standard Contractual Clauses, carry out a transfer impact assessment and adopt supplementary measures, including encryption in transit, minimisation of the data sent and limitation of retention periods at the provider. You can consult the destination country and the safeguards applicable to each provider in the sub-processor list, and you may request a copy of those safeguards by writing to . **9.4.** If you would prefer that your content not be processed by models operated from particular countries, you may select only those models whose provider and location are indicated in the interface of each tool. *** ### 10. Retention periods | Data | Period | | ------------------------------------------ | ----------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- | | Account and identity data | For the life of the account and, following its deletion, for up to thirty (30) days, being the time needed for our backups to rotate | | Input Content and Outputs | For the life of the account. Following termination, fifteen (15) calendar days for download in accordance with Clause 9.4 of the Terms and Conditions, after which they are deleted | | Billing and accounting data | Six (6) years from the last entry, in accordance with Article 30 of the Spanish Commercial Code, and four (4) years for tax limitation purposes | | Access logs and technical security data | Up to twelve (12) months | | Support communications | Up to twenty-four (24) months from closure of the ticket | | Data relating to breaches, fraud or blocks | For as long as necessary to prevent repetition and, in any event, until the applicable legal claims become time-barred | | Affiliate programme data | For the life of the programme and the applicable tax periods | | Consent to marketing communications | Until consent is withdrawn and, as evidence that it was obtained, for a further three (3) years | Once these periods have elapsed, data is deleted or irreversibly anonymised. Where a legal retention obligation applies, data will be blocked and accessible only at the request of the competent authorities, in accordance with Article 32 of the Spanish Data Protection Act. *** ### 11. Your rights You may exercise the following rights at any time: * **Access:** find out what data we process and obtain a copy. * **Rectification:** correct inaccurate or incomplete data. * **Erasure:** request deletion of your data where it is no longer necessary. * **Objection:** object to processing based on our legitimate interests, including the use of your content to improve models and the receipt of marketing communications. * **Restriction:** ask us to suspend processing while a challenge is verified. * **Portability:** receive your data in a structured, commonly used format, or request its transmission to another controller. * **Not to be subject to automated decisions:** obtain human intervention in accordance with Clause 7. * **Withdraw consent** at any time, without affecting the lawfulness of processing carried out beforehand. **How to exercise them.** Write to from the address linked to your account, indicating which right you wish to exercise. We may ask you for additional information to verify your identity where there is reasonable doubt. We will respond within one month, extendable by a further two months in complex cases, notifying you of any extension. You can also manage most of your data directly from your account, including editing your profile, downloading your content and invoices, configuring marketing communications, objecting to the use of your content for model improvement, and deleting your account. **Complaint to the supervisory authority.** If you believe we have not handled your request properly, you may lodge a complaint with the Spanish Data Protection Agency (C/ Jorge Juan 6, 28001 Madrid, [www.aepd.es](http://www.aepd.es)). We would appreciate the opportunity to resolve the matter first. *** ### 12. Rights of third parties whose images are processed If you are a person whose image appears in content processed through LUPA by a user of the platform, LUPA acts as processor and the controller is that user, to whom you should direct the exercise of your rights. You may nevertheless write to us at and, so far as technically possible and legally appropriate, we will pass your request on to the relevant user and take suitable measures. If the content breaches our Acceptable Use Policy — in particular in cases of non-consensual intimate content or impersonation — we will act directly in accordance with Article 16 of Regulation (EU) 2022/2065 and may remove the content and suspend the account responsible. *** ### 13. Minors Our service is intended exclusively for persons aged eighteen (18) or over. We do not knowingly collect data from minors. If we become aware that an account belongs to a minor, we will suspend it and delete the associated data. If you hold parental responsibility or guardianship and believe that a minor in your care has provided us with data, please write to . *** ### 14. Security measures We apply appropriate technical and organisational measures in accordance with Article 32 GDPR, including: access control and authentication; encryption of data in transit using TLS and encryption at rest; segregation of environments; logging and monitoring of access and security events; encrypted backups; a patching and update policy; documented incident management procedures; periodic risk assessments; and confidentiality undertakings and training for all personnel with access to data. In the event of a security breach posing a risk to your rights, we will notify the Spanish Data Protection Agency within seventy-two (72) hours and, where the risk is high, we will notify you directly without undue delay. *** ### 15. California residents If you reside in California, the California Consumer Privacy Act, as amended by the California Privacy Rights Act, gives you additional rights: to know the categories of personal information collected, the purposes and the recipients; to request its deletion; to correct inaccurate information; to limit the use of sensitive personal information; and not to be discriminated against for exercising these rights. LUPA **does not sell personal information** and does not share it for cross-context behavioural advertising within the meaning of that legislation, except to the extent that the use of pixels and advertising measurement tools may be regarded as such, for which we obtain your prior consent through our cookie banner. You may exercise your rights by writing to . *** ### 16. Changes to this Policy We may update this Policy to reflect regulatory, technical or service changes. Where changes are material we will notify you by email or by prominent notice on the platform at least thirty (30) calendar days in advance. The date of the last update appears at the top of this document, and we retain previous versions, available on request. *** LUPA SOFTWARE, S.L. 2026. All rights reserved. --- # Agent Instructions This documentation is published with GitBook. GitBook is the documentation platform designed so that both humans and AI agents can read, navigate, and reason over technical content effectively. Learn more at gitbook.com. ## Querying This Documentation If you need additional information that is not directly available in this page, you can query the documentation dynamically by asking a question. Perform an HTTP GET request on the current page URL with the `ask` query parameter, and the optional `goal` query parameter: ``` GET https://lupaai.gitbook.io/documentation/legal/privacy-policy.md?ask=&goal= ``` `ask` is the immediate question: it should be specific, self-contained, and written in natural language. `goal` is optional and describes the broader end goal you are ultimately trying to accomplish on behalf of the user. GitBook uses it to tailor the answer towards what is most useful for that goal. The response will contain a direct answer to the question and relevant excerpts and sources from the documentation. Use this mechanism when the answer is not explicitly present in the current page, you need clarification or additional context, or you want to retrieve related documentation sections.