1. Information we collect
Depending on how you use the service, we may process:
- contact information such as your email address;
- order, quote, pricing and project-status information;
- briefs, files, messages, revision notes and other materials you submit;
- payment status and PayPal transaction identifiers, but not your full card credentials;
- customer access tokens and secure session records;
- technical and security information such as timestamps, rate-limit records and limited session-security metadata;
- email delivery events such as delivered, delayed, bounced or complained.
2. Why we use it
We use this information to prepare quotes, take payment, create and manage projects, communicate with you, store private project files, publish review copies, manage revisions, deliver final files and protect the service from misuse.
Where applicable, the legal basis may include performance of a contract, steps requested before entering a contract, compliance with legal obligations, and legitimate interests in operating and securing the service. Where consent is legally required, we will ask for it separately.
3. Service providers
Payment is processed by PayPal. Transaction and payment-status information may therefore be processed under PayPal’s own privacy terms.
Email delivery may be handled by Resend. Hosting, storage, domain, backup or monitoring providers may also process limited data on our behalf when the production infrastructure is deployed.
We do not sell customer personal data to advertisers.
5. Private project files
Customer uploads, review copies and final files are stored in private storage and are served through authorized application endpoints rather than as public files.
Do not upload sensitive information that is unnecessary for the project. Uploaded files are subject to technical validation and may also be scanned for malware at the production infrastructure layer.
6. Retention
Short-lived access links expire quickly and are stored only as hashes. Customer browser sessions have a limited lifetime and can be revoked.
Final project files are intended to remain available for at least 90 days after completion so that you can download them. Order, payment, security, tax/accounting and audit records may be retained longer where needed for legal, contractual or security purposes.
Automatic destructive deletion is not relied on until the production retention and backup process has been fully validated.
7. Security
We use measures including passwordless customer access, hashed tokens, HttpOnly sessions, Studio MFA, rate limiting, same-origin protections, private storage, upload validation and security headers.
No system can guarantee absolute security. If we discover a security incident that requires notification, we will follow the applicable legal requirements.
8. International processing
Some service providers may process data outside your country. Where data-protection law requires safeguards for international transfers, the production operator will use the appropriate contractual or legal mechanism.
9. Your privacy rights
Depending on your location, you may have rights to access, correct, delete, restrict or receive a copy of personal data, or to object to certain processing. You may also have the right to complain to your local data-protection authority.
Some records cannot be deleted immediately where we must retain them for legal, accounting, fraud-prevention or dispute-resolution reasons.
10. Privacy contact
Lilux Publishing is the service name; the production operator details will be published before public launch.
For now, contact the Studio through the Help page or your secure project workspace. The public privacy contact will be configured before launch.