Privacy Policy

1. Introduction

This Privacy Policy explains how Anthology Group LLC (“luodastudio,” “we,” “us”) handles personal information when you use the Service. It covers two different relationships:

• For your luodastudio account, we are the controller of your personal information and this Policy applies directly.
• For the visitors of the sites you build, you are the controller and we act as your processor: we handle visitor information on your behalf and under your instructions. You are responsible for having your own privacy notice for your site’s visitors.

2. Information we collect

We collect the following categories of information about account holders:

• Account and profile information: your name, email address, and the settings you choose.
• Authentication data: a securely hashed password and, if you enable it, two-factor authentication details.
• Sign-in with Google or Apple: if you choose to sign in with Google or Apple, that provider shares the ID of your Google or Apple account, your email address and whether it has verified that address, and your name. Google also shares your profile picture, which we do not keep. We store the account ID and email address so we can recognize you when you sign in, and use your name only to name a new account. We never receive your Google or Apple password, and we do not keep the access token the provider issues, so we have no ongoing access to your Google or Apple account.
• Billing information: processed by our payment provider, Stripe. We receive limited billing metadata (such as your plan, billing status, and the last four digits and type of card); we do not store your full card number.
• Content you create: the sites, pages, blog posts, media, comments, and code you upload or publish, and content you import from other platforms such as WordPress or Squarespace.
• Support and communications: messages you send us and the contents of support tickets.
• Usage, device, and log data: IP address, browser and device type, pages and features used, timestamps, and diagnostic and security logs.
• Cookies and local storage: used to keep you signed in and to operate the editor and app (see “Cookies” below).

3. Information collected on the sites you build

When you publish a site with luodastudio, we process limited information about your visitors on your behalf so the site works and so you can understand your traffic:

• In-house analytics: we measure traffic to your site (such as page views, referrers, approximate location derived from IP address, and device type). We run analytics ourselves rather than handing your visitors to a third-party advertising network. If your site has a store, we also count how many of those anonymous visits view a product, add to the cart, start checkout and pay, within the same visit and without cookies or a lasting visitor identifier.
• Comments: comments are available on your published blog posts by default. A visitor can post one without a luodastudio account: the comment form asks for a name and an email address, and we store both alongside the comment. That email address is not shown on the published page. We keep it so you can recognise and contact a commenter. If a signed-in luodastudio user comments, we record their account instead. Any visitor can report a comment to you; likes, poll votes and comment reports are counted against a salted, one-way fingerprint derived from the visitor’s IP address and browser rather than a stored IP address or a tracking cookie. You can turn comments off for the whole site or for a single post. Comment activity may be checked against a shared spam-signal dataset we maintain to keep moderation working across the platform.
• Form submissions: information your visitors submit through contact or other forms you add.

For this visitor information, you are the controller and we are your processor. You decide what to collect on your site and are responsible for informing your visitors and obtaining any consents the law requires.

4. How we use information

We use personal information to:

• provide, host, secure, and maintain the Service;
• process payments, manage subscriptions, and prevent fraud;
• provide support and respond to your requests;
• send you service, security, and transactional messages, and (where permitted) product updates you can opt out of;
• understand and improve how the Service is used; and
• comply with legal obligations and enforce our Terms and Acceptable Use Policy.

We do not sell your personal information, and we do not share it for cross-context behavioral advertising.

We use the information Google or Apple shares when you sign in with them only to create your luodastudio account, sign you in, and keep that sign-in secure. We do not use it for advertising, do not sell it, and do not transfer it to anyone except the service providers described in “How we share information” that help us run the Service, or where the law requires. You can disconnect Google or Apple at any time under Connected accounts in Account settings, and closing your account deletes the connection. luodastudio’s use and transfer to any other app of information received from Google APIs will adhere to the Google API Services User Data Policy, including the Limited Use requirements.

5. Cookies and similar technologies

In the luodastudio app and editor we use essential cookies and local storage to keep you signed in and to make core features work. Our first-party site analytics are designed to measure traffic without building advertising profiles, and we do not use third-party advertising or cross-site tracking cookies in our own product. You can control cookies through your browser, though disabling essential cookies may prevent you from signing in.

6. How we share information

We share personal information only as described here:

• Service providers (sub-processors): trusted vendors who help us run the Service under contract, including our payment provider (Stripe), our transactional-email provider, and our cloud hosting, object storage, and DNS/SSL providers. They may process information only to provide services to us.
• Our AI provider (Anthropic), and only if you turn AI features on. They are off by default. When you ask for a suggestion, the image or text you are asking about is sent to be described, along with nearby page text used as context. Turning the feature off stops this; we do not send your content for suggestions you did not ask for.
• Legal and safety: when we reasonably believe disclosure is required by law or legal process, or is necessary to protect the rights, safety, or property of luodastudio, our customers, or the public.
• Business transfers: in connection with a merger, acquisition, financing, or sale of assets, in which case we will require the recipient to honor this Policy or notify you of any material change.
• With your direction or consent: for example, when you connect a third-party service.
• Aggregated or de-identified data, which cannot reasonably be used to identify you.

7. Data retention

We keep personal information for as long as your account is active and as needed to provide the Service, then for a limited period as required for legal, tax, security, and dispute-resolution purposes.

• Locked sites, whether the trial or the paid plan ended, are deleted if no payment is received within 30 days after they lock.
• When you delete content or close your account, we remove it from the live Service and delete it from routine backups on our normal backup cycle.
• Logs and security records are kept for a limited retention window and then deleted or de-identified.

8. Your rights and choices

You can access and update much of your information directly in the app, export your site content, and delete content or close your account. Depending on where you live, you may also have the rights described below; to exercise them, contact privacy@luodastudio.com. We will verify your request and respond within the time the law requires, and we will not discriminate against you for exercising your rights.

If you are in the European Economic Area or the United Kingdom: our legal bases for processing are performance of our contract with you, our legitimate interests in operating and securing the Service, your consent where we ask for it, and compliance with legal obligations. You have the right to access, correct, delete, restrict, and object to processing, and to data portability. You may withdraw consent at any time and lodge a complaint with your local supervisory authority. Where we transfer information internationally, we use appropriate safeguards such as Standard Contractual Clauses.

If you are a California resident: you have the right to know the categories and specific pieces of personal information we collect, use, and disclose; to request deletion or correction; and to opt out of the “sale” or “sharing” of personal information. We do not sell or share personal information as those terms are defined under California law. You may use an authorized agent to make a request, and we will not discriminate against you for exercising your rights.

9. How we protect information

We use technical and organizational measures to protect personal information. Everything travels over encrypted connections (TLS/SSL). Your site’s own records (its pages and design, blog posts, comments, and the contact and form submissions your visitors send you) are held in a separate database schema for that site, reached through a database user whose privileges are scoped to that schema and nothing else. The records we hold once for the whole platform rather than once per site (store orders and customers, newsletter subscribers, page access rules, and site analytics) are held in a shared database, where each row is tied to a site and separated by access controls and per-site scoping in the application rather than by a schema boundary. We also encrypt stored credentials, two-factor secrets and our disaster-recovery backups at rest, and we support two-factor authentication on your account. No method of transmission or storage is completely secure, so we cannot guarantee absolute security. If a breach affects your information, we will notify you and the authorities as required by law.

10. International data transfers

We and our service providers may process personal information in countries other than your own. Where we transfer information across borders, we rely on appropriate legal safeguards for that transfer.

11. Children’s privacy

The Service is not directed to children under 16 (or under 13 where permitted with the required consent), and we do not knowingly collect their personal information for account creation. If you operate a site that is directed to children, you are responsible for complying with the laws that apply to your audience. If you believe a child has given us personal information, contact privacy@luodastudio.com and we will delete it.

12. Third-party links, plugins, and themes

Sites you build may link to or embed third-party services, and you may install third-party plugins and themes. Their privacy practices are governed by their own policies, and we are not responsible for them. Review those policies before you rely on them.

13. Changes to this policy

We may update this Policy from time to time. When we make material changes, we will update the date at the top of this page and, where appropriate, notify you through the Service or by email.

14. Contact us

For privacy questions or to exercise your rights, contact us at privacy@luodastudio.com, or by mail to Anthology Group LLC, 1104 West Broad Street #1191, Falls Church, VA 22046.