Who we are
Lumé is the app used by the organizer of the celebration to collect photos, videos and wishes from their guests. Contact person: Giorgos Bikouvarakis — mpikouvarakis.g@gmail.com
For requests and accounts, the same person is the data controller.
The organizer of each event decides what is collected and who can see it. Lumé stores the material on the organizer’s behalf.
What we collect from guests
- The name you enter yourself. Whatever you type. We do not verify it, ask for identification, or require an account.
- The photos, videos and wishes you upload.
- An identifier for your device. It is used so that you do not lose what you uploaded if you reopen the link.
- A cryptographic fingerprint (hash) of your IP address, for security.
- The time you uploaded.
We do not ask guests uploading material for an email address, phone number, address or payment details. We have no advertising. We do not sell anything to third parties. We do not use facial recognition.
Why we collect guest material
To create the celebration album so that the organizer can have it.
Who can see what
Before each upload, you choose:
- Private — only the organizer can see it. It is never included in the shared album.
- For everyone’s album — guests can see it. They see the content, not your name.
Whatever you choose as private stays private. This is not a promise; it is locked in the database: even the organizer cannot move it to the shared album.
At baptisms, everything starts as private, to protect the child.
Where it is stored
On Supabase servers running on AWS infrastructure, in Ireland (eu-west-1), within the European Union. For providers and any access or transfers outside the EU, see the requests and accounts section below.
For how long
We keep the event material until deletion is requested. There is currently no automatic deletion after a predetermined period, and the album link does not close on its own.
The organiser can delete individual items or the entire event at any time. Each guest can request deletion of their own material — we do it and confirm it.
Your rights concerning material you uploaded
You can request access, correction, deletion or restriction of processing of your details, and object to processing. Email mpikouvarakis.g@gmail.com and tell us which event you attended and under what name. We reply within 30 days.
If we delete what you uploaded, it is also removed from the organizer’s album.
Children
At baptisms and celebrations involving children, the material concerns minors. Parents or guardians, as organizers, decide what is collected and what is shared. If you are a parent and want material featuring your child to be removed, write to us and we will do it.
Requests, accounts and providers
What we ask for and why
- For an access, children’s party or planner request, we ask for your email and celebration type or the planner option. Your name and celebration date are optional. We also use the form language and request type to handle your request and contact you.
- For interest in a package, we use your email, chosen package and language to contact you about your interest.
- A children’s party request uses the same form. There are no separate fields for a child’s name, age or photo. The date refers to the celebration.
- For sign-in, we use your email, account identifier and session information through Supabase. If present, we use the profile language and, when you write a planner note, the profile name to identify its author.
Who sees requests and how long we keep them Access, children’s party, planner and package-interest requests are stored in Lumé’s database. Only the platform administrator can view them in the admin request list. The team also receives an email notification. Requests are automatically deleted 12 months after submission, at the next daily cleanup. Notification emails are also deleted within 12 months of request submission.
If neither storage nor sending succeeds and an email link appears, you need to open it and send the message yourself, using your email app.
Your account and sign-in You sign in using a link sent to your email or, if the option is available, through Google. Your account stays for as long as you use it. To delete it, write to mpikouvarakis.g@gmail.com. Signing out does not delete your account. The duration of your sign-in session is set by Supabase’s security settings. The provider sending sign-in links depends on the Supabase configuration.
Theme from your invitation If you upload a photo of your invitation to create a theme, the image is stored with the event and sent to Anthropic, which reads it on our behalf: colours, style and celebration details such as names, date and venue. Before the details are saved, we remove phone numbers, emails and links. Processing is based on the service you ask for (Article 6(1)(b) GDPR).
Our providers
- Supabase: accounts, database and files, on AWS infrastructure in Ireland (eu-west-1).
- Vercel: application hosting. The application servers run in Dublin.
- Resend: sending email.
- Anthropic: reading the invitation photo, only if you create a theme from your invitation.
- Google: only if you choose Google sign-in, when it is available.
Supabase, Vercel, Resend and Anthropic are companies based in the United States. Where access or transfers outside the EU occur, the safeguards in their data processing terms apply, including standard contractual clauses. Providers keep logs and backups for a limited time, in accordance with their terms.
Protecting request forms from abuse To protect request forms, we keep only a cryptographic fingerprint (hash) of the IP, not the address itself, and an attempt counter in server memory. These form-protection details are not written to a database and are lost when the server process ends.
The basis for processing and your choices For requests and accounts, processing is based on the steps you ask us to take to use the service (Article 6(1)(b) GDPR). For protection against abuse, it is our legitimate interest in keeping the service secure (Article 6(1)(f) GDPR).
We do not use your details for advertising or newsletters without separate consent. A request or signing in does not provide that consent.
You can request access, correction, deletion or restriction of processing, and object to processing. Write to mpikouvarakis.g@gmail.com, stating the email used for your request or account and what you need. Do not send a sign-in link or access code. We reply within 30 days. You also have the right to lodge a complaint about your personal data with the Hellenic Data Protection Authority (www.dpa.gr).
Cookies
We use Supabase sign-in cookies for people who sign in to an account. We also use browser local storage for application features. We do not use tracking or advertising cookies.
Changes
If anything material changes, we update this page and the date.
Last updated: 29 October 2026