Last updated: 1 September 2026
This Privacy Policy explains how List or Lift Ltd ("Lumi", "we", "us", or "our") collects, uses, and protects your information when you use the Lumi mobile application and related services (the "App").
We are the data controller for your information. If you have any questions, contact us at listorlift@gmail.com (see "Contact us" below).
Please read this policy carefully. By using the App, you agree to the collection and use of information as described here.
To provide the App's core features, we process photos of your face and skin. Depending on where you live, this may be treated as sensitive personal information or biometric data under laws such as the UK GDPR, the EU GDPR, and certain US state laws. We only process this information with your consent, and only to generate and store your results. You can withdraw your consent, and delete your scans or your whole account, at any time from inside the App. See "Your face and scan data" below for the specifics.
We only ask for the camera and photo library permissions needed to let you scan and try on looks. You can change these permissions at any time in your device settings.
We use your information to:
Provide the core features of the App, including analysing your scans and generating your personalised results, routines, and recommendations.
Create and secure your account, and let your data sync across your devices.
Power Lumi, our AI assistant, using the context you have shared (such as your scan and shelf) so its answers are personal to you.
Process your subscription and manage your access to premium features.
Send you optional reminders and notifications that you have turned on (for example, a routine reminder).
Maintain, protect, and improve the App, and to prevent fraud and abuse.
Comply with our legal obligations.
Measure our own advertising: whether an ad we ran on Meta or TikTok led to an install, a trial, or a subscription.
We do not show third-party ads inside Lumi, we do not sell your personal data, and we never use your scan photos, scan results, chat messages, or anything about your skin, hair, or body for advertising. What advertising partners receive is limited to the identifiers and events described above.
Where the UK GDPR and EU GDPR apply, we rely on the following legal bases:
To generate your results, the photos and text you submit are sent securely to trusted AI providers that perform the analysis and image generation on our behalf, including Google. These providers process your content only to return a result to us. They do not use your content to train their general-purpose models for this use case, and any short-term retention they perform is limited to operating their service and monitoring for abuse, under their own terms. Your scan photos are stored in our secure backend so you can see your history, and you can delete them at any time.
We do not use your face or your photos to build advertising profiles, and we do not sell them.
Because face and skin data is sensitive, we want to be specific about how we handle it.
We do not sell your personal data. We share information only with service providers who process it on our behalf, under contract, and only as needed to run the App.
Each of them is bound by a written agreement to protect your information to a standard equal to the one described in this policy: to use it only for the purpose we engaged them for and on our documented instructions, not for their own purposes, never to sell it, to keep it secure, and to delete or return it when we ask. Where they are involved in the processing of your face or scan data, that includes the specific commitments set out in "Your face and scan data" above.
Retailers and affiliate networks. When you tap a shopping link, you leave Lumi and go to a retailer's own website. Some of those links are affiliate links, which means the retailer or its affiliate network records that the visit came from us so we can be paid a commission if you buy. That record identifies Lumi, not you: we do not pass them your name, email, scan results, shelf, or anything else from your account. Once you are on their site you are subject to their privacy policy, not this one. Using an affiliate link never changes the price you pay, and we say so next to any link that earns us a commission.
We may also disclose information if required by law, to enforce our terms, or to protect the rights, safety, and property of our users or others. If our business is involved in a merger or acquisition, information may be transferred as part of that transaction, subject to this policy.
We are based in the United Kingdom. Some of our providers process data in the United States or other countries. Where we transfer personal data outside the UK or the European Economic Area, we rely on appropriate safeguards such as the UK International Data Transfer Agreement, the EU Standard Contractual Clauses, or an adequacy decision.
We keep your information for as long as your account is active, so the App can show your history and track your progress over time. Your scan photos are kept while your account is active and are removed when you delete them or your account. You can delete individual scans, or permanently delete your account and all associated data, from inside the App at any time. After you delete your account, we remove your personal data from our active systems, except where we must keep limited records to comply with legal obligations or resolve disputes.
Depending on where you live, you have rights over your personal data. For UK and EU users, these include the right to:
To exercise any right, use the tools in the App or contact us at the email below. You also have the right to complain to your local data protection authority. In the UK, this is the Information Commissioner's Office (ICO) at ico.org.uk.
If you are a resident of California, Colorado, Connecticut, Utah, Virginia, or another US state with a comprehensive privacy law, you have rights over your personal information. These may include the right to:
We do not sell or share your personal information, and we do not use it for targeted advertising or that kind of profiling. We will not discriminate against you for exercising any of these rights.
To exercise these rights, use the in-app tools or contact us at listorlift@gmail.com. We may need to verify your identity, using information already associated with your account, before we act on your request. You may use an authorised agent to submit a request with proof of authorisation. If we decline a request, you may appeal by contacting the same email, and California residents may also raise a complaint with the California Privacy Protection Agency or Attorney General.
Some browsers and devices offer a "Do-Not-Track" (DNT) signal. There is no common industry standard for how to respond to DNT, so we do not currently respond to browser DNT signals.
On iOS there is a standard and we do follow it. Before anything is used to measure our advertising, we ask through Apple's App Tracking Transparency prompt. If you decline, we do not use your advertising identifier, and you can change your answer at any time in Settings, Privacy and Security, Tracking. Turning off "Allow Apps to Request to Track" for your whole device has the same effect.
If you are in Australia, New Zealand, Switzerland, or another country with its own privacy law, you may have additional rights, including to access or correct your personal information. Contact us at listorlift@gmail.com and we will handle your request in line with the applicable law. You also have the right to complain to your local privacy regulator.
We use industry-standard measures to protect your information, including encryption in transit and access controls on our backend. No method of transmission or storage is completely secure, but we work hard to protect your data and to keep our providers held to the same standard.
Lumi is not intended for children under 13, and we do not knowingly collect personal data from children under 13. During onboarding we ask for your birth year. If you are under the age of majority where you live, you should use the App only with the involvement of a parent or guardian. If you believe a child under 13 has provided us with personal data, please contact us and we will delete it.
We may update this Privacy Policy from time to time. If we make material changes, we will update the "Last updated" date above and, where appropriate, notify you in the App. Your continued use of the App after changes take effect means you accept the updated policy.
If you have any questions about this Privacy Policy or your data, contact us at:
List or Lift Ltd Email: listorlift@gmail.com 71-75 Shelton Street, Covent Garden, London WC2H 9JQ, United Kingdom