Privacy Policy

Effective date: 30 October 2026.

Who operates LuckyLoki

Griffonix Inc., Delaware, United States operates https://lucky-loki.com and is responsible for the personal data described in this policy. For privacy, account and legal requests, use the Contact page at https://lucky-loki.com/contact. This policy covers our website and creative service; PayPal and other independent providers also publish their own notices where they act independently.

Data we process

Account data includes your email address, display name, password hash, authentication sessions, age confirmation and the legal-document versions accepted at registration. Authentication may record an IP address and user agent. We collect an adult-age attestation, not your date of birth or identity documents. Do not put unnecessary sensitive information in your profile or requests.

Creative inputs include prompts, stories, reference images, voice notes, transcripts, lyrics and generation settings. We process intermediate text and finished images, video and audio to provide the requested tool. Voice recording starts only when you choose it and grant microphone access. Recording/uploading audio does not by itself mean we build a biometric voice identity; the current service processes that audio as creative input.

Billing data includes payment and subscription identifiers, package, amount, currency, dates, status and credit-ledger activity. PayPal receives the payment information you provide through its interface. LuckyLoki does not receive or store your full card number or card security code. Sandbox payment records are test records, although the account and creative information you enter may be real personal data.

Support and legal contacts may include the category, message and account or creation identifiers you choose to submit. Message text and the reply address are encrypted and retained for up to 30 days for review, including when you contact us without an account. We use the reply address to handle the request. Contact references let us locate a request; they do not provide public access to its contents. Technical data includes request identifiers, timings, error codes and connection/security logs. Our application logs are designed to avoid creative payloads and authentication secrets; web-access and security logs can contain IP addresses and requested paths.

Purposes and legal bases

We use account, creative and transaction data to provide the service you request, administer subscriptions and credits, authenticate access, deliver results and send necessary account emails. Where GDPR or similar law requires a legal basis, this processing is necessary to perform our contract with you or take steps you request before a contract.

We process limited security, diagnostic, misuse and support information for legitimate interests in protecting users, preventing fraud, resolving problems and operating a reliable service, subject to your rights. We retain records and respond to legally valid requests when necessary for legal obligations. Where a feature requires consent, such as browser microphone access, you may decline or withdraw that permission. This does not erase earlier lawful processing or replace the contractual basis for processing a recording you deliberately submit. We do not use a registration checkbox as blanket consent to unrelated marketing.

Providers and international processing

Google Cloud processes creative inputs and outputs for Vertex AI models and hosts private media storage. We use Gemini for supported text, transcription and image tasks, Veo for video, and Lyria for songs and instrumentals. Some are preview models. The configured Google endpoints include global endpoints and U.S. regional endpoints; a global endpoint is not a promise of storage or processing exclusively in one country.

Google's Cloud terms restrict training on customer data without permission or instruction. We do not instruct Google to train models on your private creations. Google may retain or review data where its applicable terms permit, including abuse monitoring; we do not promise zero retention across every model. We use stateless processing where the selected API supports it, including disabled interaction storage. Our 24-hour workspace period does not override a provider's own required retention. Relevant information: https://cloud.google.com/terms/data-processing-addendum and https://docs.cloud.google.com/vertex-ai/generative-ai/docs/data-governance.

Amazon Web Services hosts the application and encrypted database backups in the United States. Google Cloud stores private media in the United States. Brevo provides transactional email delivery and processes recipient addresses, necessary message content and delivery information. Email service providers may keep delivery and security records under their policies. We do not include your creative prompts, lyrics or recordings in account-notification emails. PayPal handles payment processing and its own fraud/compliance obligations under the policy applicable to your account: https://www.paypal.com/legalhub/privacy-full. Brevo's notice is at https://www.brevo.com/legal/privacypolicy/.

Processing can involve countries outside your country of residence. Where applicable privacy law requires safeguards, transfers must use an available lawful mechanism, such as applicable contractual safeguards, recognized adequacy arrangements or a specific legally permitted exception. Our providers' global operations do not mean we have independently certified every country as adequate. We do not promise EU-only residency or that a provider's independent processing is controlled entirely by LuckyLoki.

Retention and deletion

Finished user media is accessible for 24 hours after readiness. The service closes access at expiry and schedules background physical deletion. Creative text is encrypted with per-item keys outside database backups; keys are destroyed by retention/deletion processing. Song drafts and their versions normally expire 24 hours after their latest generated lyric version. Unattached uploads normally expire after about one hour; failed/cancelled inputs normally expire about one hour after closure. An unresolved generation has a maximum 24-hour request lifetime before closure. Jobs can retry physical deletion after a temporary storage or network failure; access does not remain open merely because physical cleanup is pending.

Account deletion revokes sessions and removes or pseudonymizes account identity during the deletion process. Submitted generations and provider cancellation can require settlement after access is revoked. Payment records, credit-ledger entries, legal-acceptance evidence and minimal security/deletion records can be retained for applicable accounting, tax, dispute, fraud-prevention and legal periods. These records are not all subject to the 24-hour creative-content limit. The retention criteria are the relevant legal obligation, outstanding transaction/dispute, purpose and need to prevent a deleted account or erased content from being restored. Pseudonymous financial identifiers are not anonymous data.

Encrypted operational database backups rotate separately from working data; the configured local backup window is seven days. Media files and the per-item content key store are excluded from database backups. Restoration applies deletion records before reopening restored data. Backup rotation does not reinstate a right to read expired private content. Copies you download and content held independently by a payment or model provider are outside our workspace-deletion mechanism.

Public promotional examples are separately authorized copies with their own publication purpose; they are not automatically deleted when an unrelated user's workspace results expire. We do not publish users' private outputs as examples merely because they were generated on LuckyLoki.

Cookies and website measurement

The current application uses essential authentication/session cookies and limited browser state for continuity, such as opaque identifiers needed to check an interrupted request without starting another paid creation. Creative prompts are not deliberately saved in browser storage for this purpose. No advertising pixels or optional marketing analytics are currently installed in the application. If optional tracking is introduced, we will provide information and any consent controls required before it is used. Independent services you visit, such as PayPal, have their own cookie notices.

Your choices and rights

You can manage account details, download available results, cancel renewal and request account deletion through the service. Depending on the law that applies, you may have rights to access, correct, erase, restrict or object to processing, receive portable data, and withdraw consent where consent is the basis. Rights can be subject to necessary identity verification and lawful exceptions, including required financial-record retention. We do not charge a fee for an ordinary valid rights request unless applicable law permits one.

Contact us through the site's legal/privacy contact route, identifying the right you wish to exercise and enough information to locate your account without sending passwords, full payment-card details or unnecessary identity documents. We respond within the period required by the applicable law. Where applicable, you may complain to your local data-protection authority, including in your place of residence, work or the alleged infringement. These rights are not waived by accepting the Terms.

Children, disclosure and policy changes

LuckyLoki's generation service is for adults aged 18 and above. If you believe a minor has provided personal data, contact us so we can investigate and take appropriate action. We do not sell private creative content or share it for targeted advertising. We may disclose limited information to comply with a valid legal requirement, protect people or the service, or complete a lawful business transfer with appropriate safeguards and notice where required.

We publish an effective date and version for this policy. Material changes are subject to the notice and, where required, consent rules that apply to them. A revised notice does not silently expand the permitted use of your private creations for training or advertising.