Privacy Policy

Controller

luma 2, Switzerland.
Email:luma2dev@gmail.com

Scope

This privacy policy applies to the MiWave iOS app and the backend services operated by luma 2 to deliver it ("the Service"). It does not apply to the studio website at luma2.com, which has its ownprivacy policy.

Account data

• When you sign in with Apple or Google, we receive your name, email address, and profile image, as shared by the sign-in provider.
• For each sign-in session we store the IP address and the user agent (device and app version information) used.

Your content

• We store your songbook: the song prompts, lyrics, and titles you write. Your original input is preserved as authored.
• We store the audio files that are generated for you, including previews and released songs.

AI providers (only with your consent)

Generating a song relies on external AI providers. Your content is only sent to them after you give explicit consent in the app:

• OpenAI receives your prompt and lyrics to shape them into a production direction (style, mood, structure).
• AtlasCloud / Suno receives the resulting production package to generate the music and vocals.

You can withdraw this consent at any time in the app; withdrawal applies to future processing. Please avoid including sensitive personal information in your prompts and lyrics.

Push notifications

If you enable notifications, we store your Apple Push Notification service (APNs) device token so we can deliver notifications about your songs.

Subscriptions

Purchases are processed by Apple through the App Store. Via RevenueCat, we receive purchase and entitlement data in order to provide the features of your subscription.

Product analytics

We use PostHog to understand how MiWave is used and to fix problems:

• Event and screen analytics are tied to your account ID once you are signed in.
• Session replay records app screens in screenshot mode, with all text inputs and images masked.
• We do not track you across other companies' apps or services, and we do not sell or share your data for advertising.

Anonymous usage before account creation

Before you create an account, usage of the Service is recorded under a device-scoped anonymous identifier that is not linked to your name or email address.

Security and abuse prevention

To keep the Service secure and prevent abuse, we process on the basis of our legitimate interest:

• Device attestation via Apple App Attest.
• Security audit events and abuse signals.
• Legal acceptance records: IP address, user agent, app version, and country code at the time you accept terms or consents.

Server logs

Our hosting provider temporarily stores technical server logs, including IP addresses, to deliver the Service and protect it against misuse.

Legal bases

• Performance of a contract: account, songbook, song generation, subscriptions, and notifications you request.
• Consent: sending your content to AI providers, and product analytics including session replay.
• Legitimate interest: security and abuse prevention, and temporary server logs.

Retention

• Your songbook and songs are kept until you delete them.
• Deleting your account in the app initiates deletion of your account and content after a short grace period.
• Other records are kept only as long as necessary for the purposes above or as required by law.

International data transfers

Some of our providers, including OpenAI, AtlasCloud / Suno, RevenueCat, PostHog, and our hosting provider, are based in the United States or other countries outside the EEA and Switzerland. Where data is transferred, appropriate safeguards such as standard contractual clauses or the EU-US Data Privacy Framework apply.

Your rights

If you are located in the EU or EEA, you have the right under the GDPR to access, rectify, or erase your personal data, to restrict or object to processing, to data portability, and to withdraw consent at any time. You may also lodge a complaint with your supervisory authority.

If you are located in Switzerland, the revised Swiss Federal Act on Data Protection (revDSG) gives you the right to access, rectify, and erase your data, and to data portability. You may contact the Swiss Federal Data Protection and Information Commissioner (FDPIC).

To exercise any of these rights, contact us atluma2dev@gmail.com.

Children

MiWave is not directed at children under 13, and we do not knowingly collect personal data from children under 13.

Changes to this policy

We may update this policy from time to time. The date above always reflects the current version.