Updated July 2026
This policy explains how Lumora collects, uses, and protects your personal information. We never sell your data. You stay in control.
We collect data to personalise your skincare experience
Your facial images are processed securely
We never sell your data to third parties
Delete your data anytime in Account Settings
Lumora Beauty (“we”, “our”, or “us”) is the data controller responsible for your personal data.
Lumorabeauty Ltd, trading as “Lumora Beauty”, is registered in England and Wales (company number 17044042). Our registered office is at 4 Field End, Coulsdon, CR5 2AY.
This Privacy Policy explains how we collect, use, store, and protect your information when you use our mobile application (“the App”), and the lawful basis we rely on for each use.
Where we rely on your consent — for example, facial analysis — you can withdraw it at any time. Using the App does not by itself mean you consent to all processing described here.
The lawful basis we rely on under UK GDPR is: explicit consent for facial analysis and facial images (Article 9); performance of our contract for your account, recommendations, routines, orders, payments, delivery and returns; legal obligation for tax and accounting records; our legitimate interests for improving and securing the service; and your consent for marketing emails and push notifications, which you can withdraw at any time.
Providing your account and order details is necessary to create an account and fulfil your orders — without them we cannot provide those parts of the service. Facial analysis and marketing are optional and based on your consent.
We use trusted third-party services to operate Lumora. Where a provider processes personal data on our behalf under a direct contract with us, we put a written data processing agreement in place that limits how they may use your data. Some features rely on providers offered through their own public API or platform, where a separate agreement with us is not available; there, that provider's own published terms and privacy commitments apply.
While we implement robust security measures, no method of transmission over the internet is 100% secure.
If you are in the UK or European Economic Area, you have the following rights under GDPR:
To exercise any of these rights, contact us at info@lumorabeauty.co.uk. We will acknowledge your request within 30 days.
If you have a concern about how we handle your personal data, you can raise it directly with us. Email info@lumorabeauty.co.uk with the details, including the email address on your account so we can find your records.
We acknowledge every complaint within 30 days, investigate without undue delay, keep you updated, and tell you the outcome. If you are not satisfied with our response, you can complain to the Information Commissioner’s Office (ICO), the UK’s data protection regulator, at ico.org.uk.
The Lumora mobile app does not use traditional browser cookies. We may use similar technologies for maintaining your logged-in session, storing your preferences locally on your device, and analytics. You can clear local app data through your device settings.
Lumora is not intended for children under 18 years of age. We do not knowingly collect personal information from children under 18. If you are a parent or guardian and believe your child has provided us with personal information, please contact us immediately.
If we discover we have collected information from a child under 18, we will delete it promptly.
Some of our providers process data outside the UK. Where that happens, we take appropriate steps so your data remains protected to UK standards.
For providers we contract with directly, we put in place a data processing agreement together with a recognised transfer mechanism: the UK International Data Transfer Agreement (IDTA), the UK Addendum to the EU Standard Contractual Clauses, or the UK Extension to the EU-US Data Privacy Framework (the UK-US Data Bridge) where the provider is certified. For these transfers we rely on those safeguards rather than on your consent.
Some features are powered by providers offered through their own public API or platform, where a separate agreement with us is not available. For those, we rely on the provider’s own published terms, privacy commitments and transfer safeguards, and we only enable the feature after you give your explicit consent — which also covers the transfer of your data to the provider that powers it. Skin analysis (Perfect Corp / YouCam) works this way.
We may update this Privacy Policy from time to time to reflect changes in our practices or legal requirements. We will notify you via the updated date at the top of this policy, in-app notification for significant changes, and email notification for material changes (if you have opted in).
Your continued use of the App after changes constitutes acceptance of the updated Privacy Policy.