Privacy Notice
Last updated: October 2026
Version 2026-10.a
This notice explains how Aionluma S.r.l.s. processes your personal data across the whole AIONLUMA service — the waitlist, your account, the video sequence you upload, payment, printing and delivery of your artifact, and customer support. It describes what we actually do with your data, why, how long we keep it, who we share it with, and the rights you can exercise under the EU General Data Protection Regulation (GDPR) and Italian Legislative Decree 196/2003.
1. Who this notice covers
This notice applies to everyone who interacts with AIONLUMA: waitlist subscribers, account holders, buyers, and recipients of a gift link. It covers our website, the forge (upload and rendering) pipeline, checkout, and order fulfilment.
It does not cover third-party sites we link to, which have their own privacy notices.
2. Controller
The data controller within the meaning of GDPR art. 4(7) is:
- Aionluma S.r.l.s.
- Via Baumueller Boden 7, 39030 San Lorenzo di Sebato (BZ), Italy
- P.IVA / C.F.: 03346710217 · REA: BZ-252249
- Certified email (PEC): [email protected]
- Privacy / DSAR: [email protected]
- Legal notices: [email protected]
We have not designated a Data Protection Officer: as a micro-enterprise our processing does not meet the thresholds for mandatory designation under GDPR art. 37. Full registry details are on our Imprint.
3. Data we collect
Waitlist
- your email address, sign-up timestamp and confirmation status,
- anti-abuse challenge results, IP address and request metadata,
- language preference and optional referral/UTM parameters.
A link back while you find a video
- your email address and when you asked,
- whether you also asked to hear from us, and the single-use link to confirm that,
- the result of the anti-abuse check made when you ask.
If you ask on the home page for a link back while you look for a video, we send you that one email, with the link and three tips; it is not promotional. We delete your address 30 days after your request. The box for news beneath it is left unticked; if you tick it, a second email asks you to confirm, and only that confirmation gives the promotional-email consent in section 4.
Account & sign-in
- your email address and a unique account identifier,
- authentication session data (issued and verified by our identity provider),
- how you entered the service (e.g. via a founder or gift link).
The sequence you upload
- the video sequence you upload and the still frames we derive from it,
- the rendered artifact (print-ready booklet) produced from it,
- processing metadata (dimensions, timing, quality signals).
Orders, payment & delivery
- recipient name, shipping address, delivery phone number and country,
- edition/quantity, order status and carrier tracking,
- payment status and the last 4 digits / card brand as returned by our payment processor (we never receive your full card number),
- where you buy as a business: your company name, VAT number and country of registration, and — for Italian companies — your SdI recipient code or certified email address (PEC),
- where you buy as a private individual in Italy: your Codice Fiscale, which Italian law requires us to state on the electronic invoice,
- proof-of-consent records captured at checkout (see section 8).
Support & communications
- the content of emails and support messages you send us,
- email delivery events (e.g. bounce and complaint signals).
Technical & security data
- IP address, user-agent and standard server logs,
- rate-limit counters and bot-protection signals,
- cookies and similar identifiers as described in section 10.
4. How and why we use your data
We rely on the following legal bases under GDPR art. 6:
| Processing activity | Legal basis |
|---|---|
| Creating and operating your account | art. 6(1)(b) — Contract |
| Processing your uploaded sequence to forge and deliver your artifact | art. 6(1)(b) — Contract |
| Keeping a previewed artifact for 30 days at your request, and the emails about it | art. 6(1)(b) — Steps taken at your request before entering into a contract |
| Sending the link back and the tips you ask for on the home page | art. 6(1)(b) — Steps taken at your request before entering into a contract |
| Taking payment for your order | art. 6(1)(b) — Contract |
| Preventing payment fraud and abuse | art. 6(1)(f) — Legitimate interest |
| Printing and shipping your order | art. 6(1)(b) — Contract |
| Keeping invoices and accounting records | art. 6(1)(c) — Legal obligation |
| Keeping proof of the terms/consents you accepted at checkout | art. 6(1)(c) / 6(1)(f) — Legal obligation / legitimate interest |
| Retaining your approved sequence and artifact after delivery to handle support, conformity claims and payment disputes | art. 6(1)(f) — Legitimate interest |
| Waitlist registration and the launch announcement email | art. 6(1)(a) — Consent |
| Promotional emails about our products (opt-out in every message) | art. 6(1)(a) — Consent |
| Product analytics | art. 6(1)(a) — Consent |
| Site security, anti-abuse, rate limiting and bot protection | art. 6(1)(f) — Legitimate interest |
| Bounce / complaint suppression records | art. 6(1)(f) — Legitimate interest |
| Customer support | art. 6(1)(b) / 6(1)(f) — Contract / legitimate interest |
| Responding to lawful requests and preserving reported content | art. 6(1)(c) — Legal obligation |
5. The sequence you upload
The sequence you upload is used for one purpose only: to forge and deliver the artifact you ordered. To do that we extract still frames, colour-grade and lay out the booklet, run automated quality checks, and generate a print-ready file.
We do not:
- use your sequence for biometric identification or to uniquely identify anyone,
- profile you from its contents,
- train machine-learning models on it,
- display it publicly, or reuse it for any purpose beyond your order.
Your sequence may show identifiable people. You are responsible for having the right to upload it (see our Terms, sections 8 and 10). We do not knowingly seek special-category data within the meaning of GDPR art. 9 and do not process your sequence to derive it.
After your artifact is delivered we keep the sequence and the frames derived from it for a limited period — currently up to 90 days — so we can handle support requests, conformity claims under the statutory guarantee, and payment disputes. After that window they are securely purged from our production storage and compute.
You can ask us to erase them sooner once your order is delivered; note this also removes the source file we would otherwise use to assess a later conformity claim or dispute on your behalf.
If you upload and preview a sequence but never place an order, we do not keep it: an unordered preview and the sequence behind it are erased automatically within 24 hours, as is an upload on a failed or abandoned forge.
You can instead ask us to keep a previewed artifact for later. Keeping it is free: you register with your email address, and we keep the artifact and the sequence behind it in your Vault for 30 days. We email you to confirm, and once more 7 days before the period ends; these emails concern only the artifact you asked us to keep and are not promotional. If you have not ordered it by the end of the 30 days, the artifact and the sequence are erased automatically and we email you to confirm. You can erase a kept artifact sooner from your Vault at any time.
When you keep an artifact we also ask, in a separate box left unticked, whether you would like to hear from us when we have something new. Keeping works the same whether you tick it or not; that consent is the promotional-email consent in section 4.
We only retain a sequence beyond these periods once you place an order for the artifact forged from it.
6. Payments
Payments are processed by Stripe. Your card details are entered directly with Stripe and are never received or stored on our servers. We receive only the outcome of the payment and limited, non-sensitive details (such as card brand and last four digits) needed to identify and support your order.
Stripe acts as an independent controller for its own fraud-prevention and regulatory purposes; see the Stripe Privacy Policy.
7. Printing & delivery
Your artifact is produced and dispatched through our print production and fulfilment partners. To fulfil your order we share the recipient name, shipping address, delivery phone number and the print file with the production partner assigned to your destination.
Where your order is produced locally in your region, no personal data needs to leave that region for delivery. The current fulfilment providers and their data-residency postures are listed on our /subprocessors page.
To physically deliver your parcel, the shipping details (recipient name, address and phone) are passed to postal services and couriers (for example DHL, FedEx or Poste Italiane). These carriers act as independent data controllers for the delivery and customs-clearance leg of the journey, under their own terms and legal obligations.
8. Consent records we keep
To demonstrate that consent and contract terms were properly obtained, we keep two kinds of consent evidence:
Cookie & analytics consent — a timestamped record of your cookie/analytics choices, the consent-text version, and the technical metadata needed to demonstrate the decision. You can change or withdraw this at any time (see section 10).
Checkout consent evidence — when you place an order, we record which checkout you used and which acknowledgements you ticked: approval of your artifact for production and acknowledgement that, because the artifact is custom-made to your specifications, the 14-day withdrawal right does not apply to it; where you buy a gift token, your express agreement that the right applies while the token is unredeemed and is extinguished once redemption begins production; where you choose a sample first, your acceptance of the sample terms; and acceptance of the Terms, Shipping and Privacy policies. We also record the exact version and hash of the Terms in force, your IP address, browser user-agent and a timestamp. This is our record that the sale terms were accepted, kept for 10 years — the ordinary limitation period for contract claims under Italian law — to establish or defend legal claims.
9. Retention
We keep personal data only as long as necessary for the purpose it was collected, then delete or anonymise it.
| Data category | Retention period | Outcome |
|---|---|---|
| Uploaded sequence & derived frames — delivered order | Up to 90 days after delivery (support, conformity claims, disputes), or sooner on request | Securely purged from storage and compute |
| Uploaded sequence & derived frames — previewed, never ordered and not kept | Within 24 hours | Securely purged from storage and compute |
| Uploaded sequence & derived frames — previewed and kept at your request | 30 days from your request, or sooner if you erase it; one reminder 7 days before the end | Securely purged from storage and compute |
| Uploaded sequence & derived frames — failed or abandoned forge | Media within 24 hours; the record up to 7 days | Securely purged from storage and compute |
| Account data | For the life of your account | Deleted on account closure (except records we must keep by law) |
| Order, invoice and accounting records | 10 years | Retained per Italian tax law (art. 2220 Civil Code), then deleted |
| Checkout consent evidence | 10 years | Retained for the ordinary limitation period for contract claims (art. 2946 Civil Code), then deleted |
| Unconfirmed waitlist registrations | 30 days | Deleted in full |
| Confirmed waitlist registrations | 12 months from last meaningful interaction | Irreversibly anonymised |
| Email address given for a link back from the home page | 30 days from your request | Deleted in full |
| Cookie-consent records | 13 months | Re-consent requested |
| Security and abuse-prevention logs | Up to 24 months | Deleted automatically |
| Bounce / complaint suppression records | Indefinitely | Retained in suppression systems — deleting them would let us email you again, which is the outcome the record exists to prevent |
10. Cookies and similar technologies
| Cookie / Technology | Purpose | Category | Duration |
|---|---|---|---|
aionluma_consent | Stores your cookie/analytics preferences | Strictly necessary | 13 months |
aionluma_consent_fp | Correlates a pre-login consent decision to your session | Security / compliance | 13 months |
aionluma_locale | Stores your language preference | Strictly necessary | 1 year |
aionluma_clearance | Pre-launch access / session handling | Strictly necessary | Session |
aionluma_origin | Remembers how you entered (e.g. gift link) | Strictly necessary | 24 hours |
aionluma_blank_token | Holds the gift link you opened until you redeem it | Strictly necessary | 12 months |
aionluma_golden_token | Holds the founder invitation you opened until you redeem it | Strictly necessary | 90 days |
cf_chl_* | Cloudflare anti-bot challenge | Strictly necessary | Up to 30 minutes |
__stripe_mid / __stripe_sid | Stripe fraud prevention during checkout | Strictly necessary (payment) | Session – 1 year |
sentry-* (session storage) | Error and performance diagnostics — groups the events from a single visit | Analytics (consent required) | Session |
Vercel Web Analytics | Device fingerprinting (per-day hash) for anonymous counting of pageviews and of the steps from the home page to checkout | Analytics (consent required) | 24 hours (hash rotates daily) |
Two of these are set by our providers rather than by us, and each publishes its own account of what it collects: the anti-bot challenge by Cloudflare, described in the Cloudflare Turnstile Privacy Addendum, and the checkout fraud-prevention pair by Stripe, described in the Stripe Cookies Policy.
The consent banner offers two categories: strictly necessary, which cannot be switched off, and analytics, which is off until you switch it on. There is no marketing category, because we run no advertising, retargeting or attribution technology on this site. Our product emails are a separate opt-in, which you can give in your account, when you keep an artifact or when you ask for a link back on the home page, and withdraw from your account or from any of those emails; they place nothing on your device.
Analytics technologies — including any that identify a device without setting a cookie — are loaded only after you grant analytics consent. With the same consent we count how many visitors reach each step from the home page to checkout, for example asking for a link back, choosing an edition or opening the payment page, so we can see where the service is unclear. These counts carry no name, email address, file name or anything about your video. You can change or withdraw your choice at any time through the consent interface, or by clearing the consent cookie.
11. Recipients, subprocessors & international transfers
We share personal data only with service providers that process it on our behalf under a data-processing agreement, each receiving only what its function requires. The categories of third-party recipients we use include:
- Cloud infrastructure, database, and edge computing providers
- Print production and order fulfilment partners
- Payment processing services
- Transactional and marketing email delivery services
- Analytics, error monitoring, and performance tracking tools
- AI-assisted customer support and routing providers
The complete, current list of our specific sub-processors — with the exact data each provider receives — is maintained at /subprocessors.
Certain infrastructure and payment providers — specifically Stripe, Resend, Vercel, and Cloudflare — also process limited transaction or technical data as independent data controllers for their own service operation, security, billing, and product-improvement purposes. Cloudflare is named here because of the bot check: it acts on our instructions when protecting our forms, and on its own account when it uses the same signals to improve its bot detection.
To answer your support requests efficiently, we use AI-assisted drafting tools. These tools assist our team but do not make automated decisions; a human reviews and sends every reply. Your data is never used to train these models. The exact operational safeguards and providers are detailed on our /subprocessors page.
Where a provider processes data outside the EU/EEA, the transfer is legally protected by an adequacy decision, the EU–US Data Privacy Framework, or the European Commission's Standard Contractual Clauses. We never sell or rent personal data.
12. Your rights
Subject to applicable law, you have the right to:
- access your personal data,
- rectify inaccurate data,
- request erasure,
- restrict certain processing,
- withdraw consent (without affecting prior processing),
- and receive your data in a portable format.
Your right to object. You have the right to object at any time, on grounds relating to your particular situation, to processing of your personal data based on our legitimate interests (see section 4). You also have the right to object at any time, and without giving any reason, to processing for direct-marketing purposes. Where you object we will stop the relevant processing unless we can demonstrate compelling legitimate grounds that override your interests, or the processing is needed to establish, exercise or defend legal claims.
To exercise any of these, write to [email protected]. We respond within the statutory time limits. Withdrawing consent to marketing or analytics does not affect processing we carry out to fulfil your orders or meet a legal obligation.
13. Children and age limits
AIONLUMA is not directed at young children. You must be at least 14 to use the service or receive a gift link, and at least 18 to place a paid order. The 14-year threshold reflects the Italian digital-consent age under art. 8 GDPR and art. 2-quinquies of the Italian Data Protection Code.
If we learn that we hold data about a child below these thresholds without a proper basis, we will delete it. A parent or guardian may write to [email protected] and we will erase the data without undue delay.
14. Automated decision-making
We do not make decisions with legal or similarly significant effects about you based solely on automated processing within the meaning of GDPR art. 22.
We do use automated tools to screen uploads for prohibited content, to detect fraud and abuse, and to filter spam and email complaints.
Automated screening of your upload. Every sequence is screened for explicit content before it is processed, and this happens before you can preview or order anything — no artifact is made and no payment is taken. If the screening rejects your upload, that decision is automatic and takes effect immediately; it is not reviewed by a person beforehand. Two things follow from that, and we would rather state them plainly than leave you to discover them.
- A rejection does not always mean we judged your video. The screening is deliberately built to stop rather than guess, so if the scanner is unavailable or fails, your upload is refused too. That outcome says nothing about your content.
- If you think a rejection is wrong, contact [email protected] promptly and a person will look at it. We keep the screening result, but the video itself and the frames taken from it are deleted within 24 hours of the rejection, so after that window there is nothing left for us to re-examine. You are free to upload again at any time.
Where an order that has already been placed would be refused or cancelled — for example on fraud grounds — that decision is taken by a person.
We also use AI assistance to draft suggested replies to the support emails you send us. These drafts are always reviewed, edited where needed, and sent by a person — no reply to you is produced solely by automated means.
15. Complaints and supervisory authority
You can lodge a complaint with a data-protection supervisory authority. Our lead authority is:
- Garante per la protezione dei dati personali (Italy)
If you live in another EU/EEA country, you may also complain to your local authority; the European Data Protection Board (EDPB) lists all supervisory authorities.
16. Changes to this notice
We may update this notice as the service evolves or the law changes. The version in force when you interact with us is the one that applies.
Material changes update the version number and, where legally required, ask you to renew your consent. We'll surface significant changes on the website or by email.