This policy explains how Sazae Technology (Lumrec, we, us), based in Ho Chi Minh City, Vietnam, collects, uses and shares personal data when you use lumrec.com, the Lumrec mobile and desktop apps, our browser extension and related services. It also explains your choices and how to contact us about your data.
01Who this policy covers
This policy covers account holders, workspace members, people who watch or interact with shared content, and people who contact us. A recording or screenshot may contain information about other people as well as its creator.
Lumrec handles account, service-operation and support data to run the service. If you use a workspace for an employer or another organisation, that organisation also decides why content is created, who can access it and how its workspace is administered. Contact its administrator about those decisions; you can also contact us about data handled by Lumrec.
02Information we collect
We receive data you provide, data generated by your use of Lumrec, and limited information from a sign-in or payment provider when you choose that service. We associate service data with your account or workspace when you are signed in.
- Account and workspace information: name, email address, profile image, language and preferences, account and workspace identifiers, memberships, roles, invitations, workspace name, logo and configured email domain.
- Your content: recordings, uploaded videos and audio, screenshots, images, video backgrounds, titles, descriptions, summaries, transcripts, chapters, edits, annotations, comments, reactions, folders, playlists, spaces and sharing settings. Content can contain personal or sensitive information that you choose to capture or upload.
- Playback and activity: videos and screenshots opened, playback sessions, watch duration, completion and resume position, reactions, comments, notifications and related timestamps. For anonymous viewers we use a browser-specific identifier for view and reaction features.
- Technical and security information: IP address, browser and operating system, user agent, client type, app version, sign-in method and time, request or processing errors and operational logs. Devtools recordings collect additional information described below.
- Support and billing: contact-form name, email, topic, message and IP address; subscription identifiers, plan, billing interval, seats, payer or billing email, payment status and invoice/transaction records. PayPal handles checkout and payment-card details on its own service; Lumrec does not provide a card-entry form or store your full card number.
- Sign-in providers: if Google or Apple sign-in is offered and you choose it, we receive your provider identifier, email and the basic name or profile information the provider supplies. Apple may supply a private relay email. Google sign-in does not request access to Gmail messages, Google Drive files or contacts.
03Recording, device permissions and local files
You choose the screen, window, browser tab, area, camera or file to capture, subject to the features available on your device. Screen recording, microphone, camera and media selection use browser or operating-system permission controls. Previewing a camera or microphone level can use those inputs while the recorder is open, before a recording starts. You can turn inputs off or revoke permission in device settings; the affected feature will stop working.
Video recordings are saved on your device first and enter the upload queue after you stop. Media you select for upload and captured screenshots are sent when you use those features. Finished uploads can resume when Lumrec runs again. Temporary recording files, upload progress, searches, preferences and sign-in tokens may be kept in app or browser storage.
Widgets and system controls can show recording state, upload counts and recent video titles on your device. Consider who can see your home or lock screen. Deleting an account through the mobile app clears app-owned local recordings, upload jobs, searches and widget data on that device. It does not remotely erase local copies on other devices, originals selected from your photo library, or files you separately saved or exported.
Recording may capture confidential information or other people. Obtain the notices or permissions required for your recording and check the content before uploading or sharing it. Lumrec does not request your address book or precise device location for its recording features.
04Devtools recordings
When you deliberately start a Devtools recording in the Lumrec Chrome extension, the selected tab is recorded with console messages and errors, visited URLs, network request and response metadata and text payloads, clicks, input lengths, form submissions, navigation, scroll positions, browser/OS details, viewport, language and time zone. This collection is specific to that recording; it is not a browsing-history feed from unrelated tabs.
The collector masks known credential headers, secret-looking fields and password, one-time-code and payment inputs before sending log entries from the page. Input values are not recorded as action events. Masking cannot identify every sensitive value in page content, console output or network payloads, and it does not hide information visible in the recording itself.
The Devtools log is uploaded with the video and can be opened by anyone permitted to watch that video. Choose sharing permissions accordingly and do not record pages containing data you are not authorised to disclose.
05How we use information
We use the information above to provide the functions you choose, maintain reliable operation, protect accounts, communicate with you and administer paid workspaces. Where applicable law requires a legal basis, processing relies on providing the requested service, applicable legal obligations, legitimate interests in security and service operation, or consent where required.
- Create and authenticate accounts; deliver sign-in codes; accept invitations and apply workspace membership and sharing permissions.
- Store, upload, process, play, edit, search, organise and share your content, including thumbnails, transcripts, summaries and chapters when the relevant processing is enabled.
- Restore playback position, provide Recent and Continue watching, display comments and reactions, deliver activity notifications, and show engagement statistics to authorised creators/editors and workspace administrators.
- Enforce quotas, operate subscriptions, issue invoices, respond to support requests, investigate errors, prevent abuse and protect the service.
- Send necessary account, invitation, security, support and billing messages. Optional notification settings control supported comment, reaction and digest emails.
- Lumrec does not sell personal data, use it for targeted advertising, or use advertising identifiers to track people across other companies’ apps or websites. AI-generated titles and summaries are not used to make legal or similarly significant decisions about you.
06Transcription and AI processing
When configured, speech in an uploaded video is sent to our self-hosted Whisper transcription service. The audio is processed to produce a transcript; the service uses temporary audio files during processing. The resulting transcript is stored with the video and follows its access permissions.
For AI screenshot titles, Lumrec sends a resized screenshot image to the configured vision provider. For video titles, summaries and chapters, it sends timestamped transcript text to the configured text provider. As of this policy’s update, these services are configured to use DeepSeek. Automatic processing can run after eligible content is uploaded; naming a provider here does not mean you have a separate account with it.
Lumrec does not train its own generative AI models on your recordings, screenshots or transcripts. This statement is about Lumrec’s use; it is not a promise of zero retention or no training by an external provider. Provider processing is subject to the terms and data-protection arrangements applicable to the configured service. Ask support@lumrec.com about current AI processing and available controls before uploading content whose disclosure would be inappropriate.
AI outputs can be inaccurate. Review titles, transcripts and summaries before relying on or sharing them. Removing content from Lumrec does not itself prove that every temporary or provider-held copy has been removed.
08Service providers and other disclosures
Operating Lumrec involves infrastructure and delivery providers. Cloudflare R2 stores uploaded media, images and derived files in private buckets. Hosting and email-delivery services process information needed to run the application and send service messages. Our transcription service and the configured AI providers receive the content described above.
Google and Apple process their own sign-in flows when offered and selected, and PayPal processes payment approvals, subscriptions and financial records when you choose these services. Their own privacy policies apply to their services. Lumrec receives the limited account or transaction information needed for the corresponding function.
Authorised Lumrec personnel may access information to support you, investigate abuse or operate the service. Private-media access through the staff console requires an authorised role, a reason and a time-limited access window, and is audited.
We may disclose information when required by a valid legal obligation, to protect rights or safety, or in connection with a business transfer subject to applicable protections and notice requirements. We limit disclosures to the purpose concerned. Contact support@lumrec.com for information about the providers and safeguards applicable to your workspace.
10Retention, archive and deletion
We retain active account and content data while needed to provide the service. Archive is different from deletion: archived content remains stored until it is deleted or a workspace’s configured archive-cleanup period applies. Payment downgrades alone do not remove content.
Successful sign-in history is kept for 90 days. Eligible video originals are scheduled for removal after processing, currently after 24 hours; the playback copy remains available. This original-file rule is configurable and does not apply to failed processing or older recordings outside its scope.
Interrupted recording caches and multipart upload sessions have a 7-day recovery period. Local expiry cleanup runs when the client resumes, and server cleanup runs in background jobs. Completed or discarded recording caches are removed through the upload/discard lifecycle. Unattached direct-upload reservations normally expire after 24 hours.
In the mobile app, More → Personal settings → Delete account permanently removes your account and account-owned data from the active service after confirmation. Owned media, comments, reactions, visits and sign-in information are removed; media-file purges run in the background. Shared workspaces keep other members’ content. A remaining active member can become administrator, and workspaces without other active members are closed after their subscriptions are cancelled.
Storage cleanup is asynchronous and failures can delay removal of file copies. We do not promise immediate or independently verified deletion of every stored copy. Limited records may remain where necessary for accounting, legal obligations, security, disputes or operational cleanup; provider-held financial records and copies exported by other people are outside account deletion. Contact us for the status of a deletion request or remaining copies.
11How we protect information
We use HTTPS for production transfers, private media storage, temporary signed storage URLs, account authentication and role/access checks. Cloudflare R2 encrypts stored media at rest. These controls do not make the service end-to-end encrypted: processing systems and authorised personnel can access content for the purposes described in this policy.
Keep your email account and sign-in methods secure, review link permissions and revoke unnecessary device permissions. No internet service can guarantee absolute security. Report suspected unauthorised access to support@lumrec.com.
12Your choices and privacy requests
You can update supported profile and notification settings, change content-sharing permissions, download available content, delete individual items and use account deletion in the mobile app. Turning off a device permission affects only the feature needing it. You can stop using the service and contact us about withdrawal of consent; withdrawal does not undo processing already lawfully completed.
Depending on applicable law, you may request access, correction, deletion or a portable copy of your personal data, object to or restrict certain processing, or complain to the competent data-protection authority. Send requests to support@lumrec.com from your account email where possible. Describe the account/workspace and request; do not send a password or active sign-in code.
We may verify identity or authority to protect other people’s data and assess applicable legal requirements and exceptions. If an organisation controls the workspace content concerned, we may direct or coordinate the request with its administrator. We explain any limitations rather than treating a support request as proof that deletion has completed.
13International processing
Lumrec is operated from Vietnam. Hosting, storage, email and AI services can involve processing outside your country. DeepSeek is a provider based in China. A cloud-storage location or an AI provider’s location should not be assumed to match your workspace’s country.
Where transfer safeguards, consent or other conditions are required by applicable law, they must apply to the relevant processing. Contact support@lumrec.com to ask about the current locations and arrangements for your data; this policy does not claim that all content stays in one country.
14Age and children’s data
Lumrec is intended for people who meet the Terms’ minimum age of 16, or a higher applicable age requirement. It is not a service directed at children under that age. We do not request children’s data for advertising.
If you believe a child below the applicable minimum age has provided personal data, contact support@lumrec.com so we can investigate and address the request. People creating recordings remain responsible for lawful collection and sharing of information about others.
15Changes to this policy
We update this policy when service functions or data-handling practices change. The date at the top identifies the current version. Material changes will be communicated through an appropriate service notice or other notice required by applicable law. Updated wording is not a substitute for any consent legally required for new processing.
16Contact Lumrec
Sazae Technology · Ho Chi Minh City, Vietnam. For privacy questions, access or deletion requests, AI-processing questions or a security concern, email support@lumrec.com or use the Contact page linked below. Please identify the relevant account or workspace without sending credentials.