Privacy Policy

We take your privacy seriously. This policy explains what personal data we collect, what we use it for, and what rights you have over it, under Regulation (EU) 2016/679 (GDPR) and Spanish Organic Law 3/2018 (LOPDGDD).

Data controller

• Controller: LUAU FASHION BRANDS S.L. (NIF B75780734)
• Address: C/ Girona 36, 43877 Sant Jaume d'Enveja, Tarragona, Spain
• Privacy contact: [email protected]

What we collect

• Account data: email and password (your password is stored encrypted, never in plain text).
• Billing data: payment details (card number, etc.) never pass through our servers — our payment processor, Stripe, handles them directly. We only receive confirmation of payment, the amount charged, and your billing country.
• Essential cookies: a session cookie that keeps you signed in. It's strictly necessary for the service to work and doesn't require consent.

What we use it for

• Managing your account and giving you access to the subscription.
• Processing payments.
• Sending the transactional emails the service requires (welcome, failed-payment notice, cancellation confirmation).
• Meeting our legal and tax obligations.

We don't send newsletters or marketing emails unless you explicitly opt in. We don't share your data with third parties for purposes beyond what's described here.

Legal basis

We process your data because it's necessary to perform the subscription contract (GDPR art. 6.1.b) and to meet legal obligations, such as tax and accounting requirements (GDPR art. 6.1.c).

Who we share your data with

These providers act as processors under our instructions:

• Supabase — authentication and database.
• Cloudflare — file storage (R2) for audio/preset files, and site protection/CDN.
• Stripe — payment processing.

Some of these providers may process data outside the European Economic Area (Stripe, for instance, is US-based); in those cases the provider has the safeguards GDPR requires (standard contractual clauses or an equivalent mechanism).

How long we keep your data

We keep your data while your account is active. If you cancel, we retain it only for as long as tax and commercial law requires (generally up to 6 years for accounting records). Registered accounts that never subscribe are automatically deleted after 48 hours.

Your rights

You can exercise your rights of access, rectification, erasure, objection, restriction of processing, and portability by writing to [email protected]. You also have the right to file a complaint with the Spanish Data Protection Agency (www.aepd.es) if you believe we haven't handled your data correctly.