x-pression design Privacy

Version: 2026-10-12-platform-2

Effective Date: When this version is published on Pumpit.app

Operator: Luka AI, Inc.

Brand: Pumpit.app

1. Scope and contact

Luka AI, Inc., a Delaware corporation at 8 The Green, Ste R, Dover, DE 19901, United States, operates Pumpit.app and Pumpit-hosted products. This Notice covers visitors, customers, creators, Connectors and business counterparties. Product- or feature-specific notices supplement it where relevant. Privacy requests may be sent to support@pumpit.app.

2. Information we handle

Depending on the service, we receive account and contact details, creator briefs and supplied materials, assessment responses, conversations, progress, uploads, support communications, product usage, device/security information and communication preferences. We also handle purchase, subscription, payment, payout, tax and reconciliation records.

For creators, we record dashboard agreement presentation and acceptance, the authenticated creator identity, versions, exact accepted text or content hashes, displayed language and timestamps. Separate campaign and feature acceptances have their own scope and records. An acceptance record does not prove that the person read every word.

Payment settings may include a provider account identifier or a bank account holder's legal name, country, currency, IBAN or required local account/routing details, plus account-change history and payment references/status. Full bank details are access-restricted and masked in ordinary dashboard responses. Saving an account is not a completed payout.

For Connectors, we record identity/contact details, invitation/access status, approved creator/product assignments, attribution dates, accepted agreement versions and content hashes, commissions, corrections, caps, statements, payment references and optional payment-provider information. Connectors see only their assigned products and their own financial information, not customer identities, assessments, conversations or private Creator Briefs.

A valid product-referral link may store a first-party attribution token for up to 90 days. Referral records include creator/product identifiers, acceptance/version, checkout status, release status, account termination cutoffs, processor transaction times, adjustments, fraud signals and payouts. Cookie notice or consent is provided where required.

An enabled voice feature may process creator recordings, trained voice identifiers, sample approvals, scoped authorization and withdrawal records, and customer audio or transcripts needed for the feature. It is not enabled merely by accepting general platform terms or uploading a recording.

3. Purposes and lawful grounds

We use information to deliver, personalize, secure, support, bill, moderate, troubleshoot and measure the relevant service; administer accepted programs and payouts; reconcile records; prevent fraud; comply with law; and protect rights and safety. Where applicable, grounds include performing a contract, steps requested before a contract, legal obligations, legitimate interests in operating and protecting the service, and consent for purposes that require it. We assess the applicable ground for the purpose and location; agreeing to Terms is not blanket consent to all processing.

Before Creator Agreement acceptance, brief information and supplied materials may be used for direct communications with that creator, internal analysis and platform improvement, but not in a Pumpit product. Any marketing consent or opt-out required by applicable law is handled separately.

Shared platform evaluation and cross-product learning use aggregate or de-identified information. Identifiable creator materials and identifiable customer conversations are not an unrestricted source for another creator's product. Contractual content licensing is governed by the relevant agreement, not granted by this Notice.

4. Creators and customer access

Luka administers raw service data subject to individual rights and applicable law. Creators receive aggregated product reporting by default. They do not receive raw conversations, assessment responses or identifiable user data by default. Any later user-level creator access requires a Luka-controlled authorization defining the recipient, purpose, scope, duration and withdrawal method.

5. Providers and disclosures

The service uses Supabase for authentication, databases and storage; Vercel and Cloudflare for hosting/delivery and security; Stripe for payment processing and connected payouts; Resend for email; PostHog and Google Analytics for restricted usage/funnel analytics; and Sentry for error monitoring. AI interactions use the AI provider configured for the relevant product, including Anthropic's Claude and Google's Gemini where configured. An enabled voice feature uses its configured voice provider, currently including ElevenLabs. These providers receive only information relevant to their function and configuration. Raw assessment answers, chat text, email addresses, bank details and authentication/payment tokens do not belong in ordinary funnel analytics.

Payment providers may process information under their own terms and privacy notices as well as for Luka. We do not promise that every provider handles data identically. Feature notices and consent explain additional relevant uses before they occur. We may disclose necessary information to advisers or authorities when required by law, to protect rights/safety, or in a corporate transaction subject to applicable safeguards. We do not sell creator materials or customer conversations as an unrestricted cross-creator data source.

6. Retention and deletion

We retain information only as reasonably needed for the relevant service, security, support, accounting, payout reconciliation, disputes, legal obligations and lawful operations. We may retain accepted agreement text, acceptance and withdrawal records, attribution, termination cutoffs, original transactions, corrections, tax records and payout references after an account or relationship ends where needed to document rights, calculate surviving earnings or comply with law. Retention does not create a new license to use removed creator-specific material.

Individuals may request deletion and other applicable rights. Necessary legal/accounting records and properly de-identified information may remain subject to applicable law. Ending participation or declining updated terms does not erase earned amounts or their evidence. Historical agreement copies and statements remain available through the account or a verified support request, subject to security and law.

7. Security

We use reasonable administrative, technical and organizational safeguards, including access controls and restricted handling of bank details. No system guarantees absolute security. We do not request unnecessary identity documents or birth dates simply to administer the general age policy.

8. International processing and rights

Information may be processed in the United States and other locations used by relevant providers. Where required, applicable safeguards and transfer requirements apply. Depending on location and processing, rights may include access, correction, deletion, restriction, objection, portability, withdrawing consent and complaining to a relevant data-protection authority. Withdrawal does not invalidate prior lawful processing. Mandatory rights are not replaced by platform terms.

Account-related requests should come from the registered email address so Luka can verify them. People without an account may use the email through which they communicated with Pumpit. Additional verification is requested only when reasonably necessary. Contact support@pumpit.app.

9. Age and sensitive information

Pumpit's creator and customer services are intended for people aged eighteen (18) or older. Do not submit another person's information without authority. Sensitive data is handled only for relevant disclosed purposes and subject to any additional legal conditions or consent required. Products do not replace professional care or emergency services.

10. Changes

We publish revised Notices with a version and effective date and provide additional notice or consent where required. A Notice change alone does not authorize a new contractual license or a processing purpose requiring separate consent.