Privacy Policy — LumiYah
Last updated: 2 October 2026 — Lire en français
LumiYah respects the privacy of its users and is committed to protecting the personal data processed as part of the service.
1. Data we process
Depending on the features you use, LumiYah may process:
- the authentication credentials required by the platforms you connect (access and refresh tokens);
- the technical identifier of your connected account, together with the display name, username and avatar returned by the platform;
- the choices you make when creating a video — the song, the verse, the passage of music and the artwork, including any picture you upload;
- the caption you write and the audience setting you choose;
- a record of the publications you have made through the service, so that you can see their status.
LumiYah does not collect your TikTok password. Authentication happens on TikTok's own website, and LumiYah only receives the authorisation you grant there.
You never upload music to LumiYah: the songs come from our own catalogue. You may optionally upload a picture of your own to use as the background of a video — it is stored privately, visible only to you, and used solely to build the videos you ask for. Apart from that picture and the caption you write, you author no content on the service.
2. How we use this data
This data is used only to:
- operate the service;
- authenticate the accounts you have connected;
- prepare and publish the content you explicitly ask to publish;
- show you the status of your publications;
- keep the service secure and reliable.
Your data is never used for advertising, profiling or automated decision-making.
3. TikTok
When you connect your TikTok account, LumiYah uses TikTok's services and APIs strictly within the permissions you granted. Data received from TikTok is used only for the authorised features of LumiYah, and is never shared with third parties.
4. Storage and security
Access and refresh tokens are encrypted at rest, are never displayed in the interface, and are never written to logs. Data is stored on a server located in the European Union, in storage that is not publicly accessible.
5. Retention and deletion
Data is retained only for as long as necessary to operate the service or to meet applicable legal obligations.
When you disconnect your account, LumiYah revokes the authorisation with the platform and deletes the tokens it holds for that account. You can request the deletion of all data associated with your account by writing to the contact address below; we will action the request without undue delay.
6. Sharing
LumiYah does not sell personal data. Some data is transmitted to the platforms necessary for the service to work — for example the video and caption sent to TikTok — but only when you have explicitly asked for that publication.
7. Analytics on the public site
The public pages of lumiyah.fr — the landing page of each song and each album — use Google Analytics 4 to measure their audience. We use this only to know which songs are viewed, where visitors come from, and how many go on to a streaming platform. None of this data is used for advertising, and none of it is sold.
No analytics cookie is set until you accept. On your first visit, a banner offers Accept or Decline. Until you accept, Google Analytics runs in a restricted mode: it receives an anonymous signal, with no identifier, which cannot recognise you from one page or one visit to the next.
If you accept, the following is measured: pages viewed, the site or app you arrived from, your country, device and browser type, page scrolling, clicks through to streaming platforms, and playback of the embedded video. Your IP address is used by Google to infer the country, then not retained.
Your choice is stored for six months in your browser's local storage — not in a cookie. To change it, clear lumiyah.fr's site data in your browser: the banner will reappear on your next visit. Collected data is retained for fourteen months by Google Analytics, then automatically deleted.
The controller for this processing is LumiYah; the processor is Google Ireland Limited. This processing relies on your consent, which you may withdraw at any time.
This section covers only the public pages. The video creation app described in sections 1 to 6 uses no analytics.
8. LumiYah's official channels (YouTube, Instagram, Facebook)
LumiYah manages its own official accounts — the LumiYah YouTube channel, Instagram account and Facebook Page — using an internal tool that is not open to the public. This tool uses YouTube API Services and Meta's APIs, within the permissions LumiYah has granted to its own accounts: uploading videos, scheduling their release, posting comments, and reading these channels' statistics.
By using these services, LumiYah is bound by the YouTube Terms of Service and the Google Privacy Policy. The tool processes only LumiYah's own data (videos, captions, comments, statistics of its own channels). It does not collect personal data about viewers or visitors of these channels beyond what those platforms display publicly, such as a third party's comment on a LumiYah post.
Access authorisations for YouTube are stored on the LumiYah administrator's computer, and those for Instagram and Facebook on a restricted-access server. They are never sold, shared, or used for advertising. The access granted to LumiYah can be revoked at any time from the Google account security settings for YouTube, or from the app settings of Instagram and Facebook.
9. Your rights
Under the GDPR you have the right to access, correct, export and delete your personal data, and to withdraw your consent at any time. To exercise these rights, contact us at the address below.
10. Contact
For any question about this policy or about your data: