Lumy.gg
Games
Terms and policies
Terms of ServicePrivacy PolicyCookiesAcceptable useCommunity guidelinesAI policyReferral termsRefundsCopyrightAccessibilitySecuritySupportData processingLaw enforcementBrand use

Data Processing Addendum

Last updated: 1 October 2026

This Data Processing Addendum ("DPA") forms part of the Terms of Service between you (the "Maker") and Lumy. It applies automatically whenever Lumy processes End User Personal Data on the Maker's behalf, that is, personal data of the people who use, play or sign in to a project the Maker builds or publishes with Lumy. Words defined in the Terms have the same meaning here. Enterprise customers may sign a separate DPA, which prevails over this one where it conflicts.

1. Definitions

  • "Data Protection Law" means all laws that apply to the processing of End User Personal Data, including the EU General Data Protection Regulation ("GDPR"), the UK GDPR and Data Protection Act 2018, the Swiss Federal Act on Data Protection, the Israeli Protection of Privacy Law, and US state privacy laws, each as amended.
  • "Controller", "processor", "data subject", "personal data breach" and "processing" have the meanings given in the GDPR. "Business" and "service provider" have the meanings given in US state privacy laws.
  • "Subprocessor" means a third party engaged by Lumy to process End User Personal Data.
  • "SCCs" means the Standard Contractual Clauses approved by the European Commission in Decision 2021/914, with the UK Addendum and Swiss adaptations where relevant.

2. Roles

  • The Maker is the controller (or business) of End User Personal Data. Lumy is the processor (or service provider).
  • Lumy is an independent controller of its own account, usage, billing, security and support data, and of de-identified or aggregated data, as described in the Privacy Policy. This DPA does not apply to that data.

3. Details of processing

Item Description
Subject matter Hosting and running the Maker's projects and their built-in backend
Duration For as long as the Maker's projects are hosted on Lumy, plus the deletion periods in Section 10
Nature and purpose Storing, hosting, transmitting and processing data as needed to provide the backend features the Maker uses: sign-ins, databases, files, cloud saves, leaderboards, online rooms, app email, AI features inside apps, and analytics
Data subjects The Maker's End Users
What the Maker sees In Backstage, the Maker can see, change and delete the records End Users create, the files they upload, the name and picture End Users sign in with, when they first and last used the project, and a log of the project's last 400 backend calls. End Users' email addresses are not shown to the Maker
Categories of data Names and player names, email addresses and sign-in identifiers, records and files End Users create, scores and saves, device and usage data, and any other data the Maker's project is designed to collect
Special categories None. The Maker must not use Lumy to process special categories of personal data, payment card data, government identity numbers or passwords for other services unless agreed in writing

4. The Maker's obligations

The Maker:

  • is responsible for the lawfulness of the processing, including having a lawful basis, giving End Users a clear privacy notice and terms, obtaining any consent required (including verified parental consent for children where the law requires), and honouring End Users' rights;
  • is responsible for the design of its project and for the data it chooses to collect, and must collect only what it needs;
  • confirms that its instructions comply with Data Protection Law; and
  • must not instruct Lumy to process data in a way that breaks the law, the Terms or the Acceptable Use Policy.

5. Lumy's obligations

Lumy will:

  • process End User Personal Data only on the Maker's documented instructions, which are the Terms, this DPA and the Maker's configuration and use of Lumy, unless the law requires otherwise (in which case we will tell the Maker first unless the law forbids it);
  • tell the Maker if, in our opinion, an instruction breaks Data Protection Law;
  • not sell or share End User Personal Data, not retain, use or disclose it for any purpose other than providing Lumy, and not combine it with other data except as Data Protection Law permits for a service provider;
  • not use End User Personal Data to train AI models, and require our AI providers not to train their models on it;
  • ensure that people authorised to process it are bound by confidentiality.

6. Security

Lumy implements appropriate technical and organisational measures to protect End User Personal Data, including encryption in transit and at rest, additional encryption for connected keys, hashed sign-in keys, sandboxing of projects, limited and logged staff access, and abuse and rate controls, as described on our Security page. We may update these measures as long as the overall level of protection is not reduced. The Maker is responsible for the security of its own project design, its accounts and the keys it connects.

7. Subprocessors

  • The Maker gives general authorisation for Lumy to use Subprocessors. Our current Subprocessors fall into these categories: cloud hosting and storage; AI systems; email delivery; sign-in providers; and support tooling. Where a Maker connects its own payment or code account, that provider acts under the Maker's own agreement with it, not as our Subprocessor.
  • We impose data protection obligations on each Subprocessor that are no less protective than this DPA, and we remain responsible for their performance.
  • We will give at least 30 days' notice of any new Subprocessor category or material change by updating this page. A Maker may object on reasonable data protection grounds by opening a ticket at /support?cat=legal within that period. If we cannot reasonably address the objection, the Maker may stop using the affected feature or close its account as its sole remedy.
  • A list of Subprocessors is available on request through /support?cat=legal, subject to confidentiality.

8. Assistance

Taking into account the nature of the processing, Lumy will provide reasonable assistance to the Maker:

  • to respond to End Users' requests to exercise their rights, by giving the Maker tools or, where not available, by acting on the Maker's documented request. If an End User contacts us directly, we will pass the request to the Maker where we can identify it and will not respond ourselves unless the law requires;
  • with data protection impact assessments and prior consultations with authorities, where required and to the extent the information is available to us.

We may charge reasonable fees for assistance beyond what the product provides.

9. Personal data breaches

Lumy will notify the Maker without undue delay, and aims to do so within 72 hours, after becoming aware of a personal data breach affecting End User Personal Data. The notice will describe, as far as known, the nature of the breach, the data and people affected, likely consequences and the measures taken or proposed. We will provide further information as it becomes available and take reasonable steps to contain it. Notifying a breach is not an admission of fault or liability. The Maker is responsible for any notifications it must make to authorities and End Users.

10. Deletion and return

  • The Maker can export its project as a single HTML file or push it to GitHub at any time. On request through /support, we will provide a copy of End User Personal Data held in a project's backend in a commonly used format.
  • When a project is deleted or the Maker's account ends, we delete End User Personal Data from live systems within 30 days and from backups within 90 days, unless the law requires us to keep it.

11. Audits

Lumy will make available the information reasonably necessary to demonstrate compliance with this DPA, primarily through written documentation, answers to reasonable security questionnaires and summaries of our measures, no more than once in any 12-month period unless required by an authority or following a personal data breach. Any on-site audit requires reasonable prior notice, must be agreed in writing, must not disrupt our operations or compromise other customers' data, is subject to confidentiality, and is at the Maker's cost.

12. International transfers

End User Personal Data is hosted in the United States and may be processed in other countries by our Subprocessors. To the extent a transfer from the EEA, UK or Switzerland requires it, the SCCs (Module 2, controller to processor, and Module 3, processor to processor, as applicable) are incorporated into this DPA by reference, with Lumy as data importer and the Maker as data exporter. For the SCCs: the optional docking clause does not apply; Option 2 (general authorisation) applies to Subprocessors with the notice period in Section 7; the governing law and courts are those of Ireland; and the annexes are completed by Section 3 and Section 6 of this DPA. The UK Addendum and Swiss adaptations apply as needed. If the SCCs conflict with this DPA, the SCCs prevail.

13. US state privacy laws

Where US state privacy laws apply, Lumy acts as a service provider or processor, will comply with the obligations those laws place on service providers, and will notify the Maker if it can no longer meet them. The Maker may take reasonable steps to stop and remedy unauthorised use of End User Personal Data.

14. Liability

Each party's liability arising out of or related to this DPA, including the SCCs to the extent the law allows, is subject to the exclusions and limitations of liability in the Terms of Service, and counts toward the same cap. Nothing in this DPA limits either party's liability to data subjects that cannot be limited by law.

15. General

This DPA lasts as long as Lumy processes End User Personal Data for the Maker. If this DPA conflicts with the Terms, this DPA prevails for the processing of End User Personal Data. It is governed by the law set out in the Terms, except where the SCCs or Data Protection Law require otherwise. Questions: /support?cat=legal or our notices address, hello@luminary.gg.

Lumy.gg
TermsPrivacyCookiesCommunity guidelinesContact
© 2026 Lumy. Build games your friends love.