Last updated 10 November 2026
Privacy and cookies
Lumzel collects photos from events, covers the faces of anyone who hasn't said yes, and delivers each guest the photos they're in. This page explains what we collect to do that, why, how long we keep it, and what you can ask us to do with it.
Questions or requests: email hello@lumzel.com. We're based in London and we follow the UK GDPR and the Data Protection Act 2018.
The short version
- Guests don't need an account or an app. We ask for a name and how they want to appear: Show me or Cover me.
- Anyone who doesn't choose Show me, including people who never scanned the QR code, has their face covered with tiles in every photo before anyone sees it.
- A selfie is optional. We turn it into a face pattern to find a guest's photos, never keep the selfie itself, and delete the pattern with the event.
- Photos and face patterns are deleted when the event's retention period ends: 7, 30 or 90 days after delivery, as the host chose.
- We don't sell data, we don't run ads, and our site uses no advertising or tracking cookies.
What we collect
If you sign up for the beta on lumzel.com
Your email address, and if you give them, your name or organisation and the kind of events you host. We use these to send your sign-in link, to give you access to the beta and to send occasional beta updates. You can ask us to stop at any time.
If you host an event
Your email address (to sign you in), the event details you enter, the photos you upload, and payment records if you switch on social sharing. Card payments are handled by Stripe; we never see or store your card details.
If you're a guest
- The name you type and your choice: Show me or Cover me, and whether others may tag you.
- Optionally, an email address or a notification permission, so we can tell you when your photos are ready.
- Optionally, a face pattern made from a selfie (see below).
- The photos you upload, and, if the host has switched on sharing: any post links you add, the words in your draft when you add a post's link (with links and contact details taken out; other guests at the event see them as a preview before they like it), the likes you tell us you gave, and the comment ideas written for you.
People in photos who never scanned the code
We detect faces and heads in every photo so we can cover them. We don't try to identify anyone who hasn't given us a selfie, and the detection data stays with that photo and is deleted with it.
AI stand-ins. On some paid events the host can choose AI stand-ins instead of tiles. A covered face is then replaced by a natural-looking face of a fictional person who doesn't exist. To make it, we send an image model only the photo as it already looks with every covered face tiled; it never receives the original photo or an uncovered face of anyone who didn't say yes. Only the tiled areas are changed, and we check every stand-in with face matching and discard any that resemble the person it covers or any guest, so a stand-in never contains the covered person's face. If anything fails, the photo keeps its tiles. Photos with stand-ins are labelled in the app, and the stand-in images are deleted with the photo.
Visitors to a shared photo link
We count link previews and clicks so the host and guest can see how far a post travelled. We don't build a profile of you.
Face patterns
A face pattern is a set of numbers that describes a face. It counts as biometric data, a special category of personal data, so we only create one with your explicit consent, when you choose to add a selfie. We use it for one thing: finding the photos you're in at that event, so we can show you if you said Show me and keep you covered if you said Cover me.
The selfie image is never stored. The pattern is deleted when the event's photos are deleted, when you remove it in the app, or when you choose "Forget me". You can withdraw consent at any time, and you'll simply be covered like everyone else.
Why we use it (our lawful basis)
| What | Why | Basis |
|---|---|---|
| Beta sign-up | Sign-in links, beta access and updates | Your consent; you can withdraw it any time |
| Host account and events | Running the service you asked for | Contract |
| Guest name, choice and photos | Pooling and delivering the event's photos, covering people who didn't say yes | Legitimate interests of the host and guests, balanced by covering by default |
| Face patterns | Finding a guest's own photos | Explicit consent (UK GDPR Article 9(2)(a)) |
| Payments | Switching on sharing for an event | Contract, and legal obligations for financial records |
| Site analytics | Knowing which pages are read, without identifying anyone | Legitimate interests |
Who helps us run Lumzel
Lumzel itself runs in the EU: our app, database and photos are hosted in Amsterdam. We use these providers, each under a data processing agreement. Some are based outside the UK or EU; where data is transferred, we rely on UK adequacy regulations or the UK International Data Transfer Addendum.
| Provider | What for |
|---|---|
| Railway | Hosting the app, database and photo storage, all in the EU (Amsterdam, Netherlands) |
| Resend | Sending sign-in links and photo emails |
| Stripe | Payments |
| OpenRouter and the AI model providers it routes to | A second privacy check on photos that are already fully tiled, AI stand-in faces on events that use them (from the already-tiled photo), drafting post captions, and suggesting comments guests can leave on each other's posts (from the post's words with links, email addresses, phone numbers, @mentions and the names other guests joined with taken out, the poster's first name, and the event's name and the host's description of it). They never receive an uncovered face of someone who didn't say yes. |
| Cloudflare | Domain, email forwarding and cookieless web analytics |
| Google Fonts, cdnjs and jsDelivr | Fonts and scripts on lumzel.com. Your browser contacts them directly, so they see your IP address. |
How long we keep things
- Event photos and face patterns: deleted 7, 30 or 90 days after delivery, as the host chose.
- Guest names and choices: kept with the event so it keeps working, and removed if you choose "Forget me" or ask us.
- Post links, post previews and comment ideas: kept with the event, and removed if you choose "Forget me" or ask us. If you choose Cover me, switch off tagging or choose "Forget me", previews of other guests' posts that give your full name are removed too. The posts themselves, on LinkedIn or X, belong to whoever posted them.
- Beta sign-ups: until you ask us to remove you, or the beta ends.
- Host accounts: while you use Lumzel. Ask us and we'll delete it.
- Payment records: as long as the law requires, usually six years.
Cookies
We only use cookies that are strictly necessary to make Lumzel work, so we don't ask for consent and there's no banner.
| Cookie | What it does | Lasts |
|---|---|---|
lz_host | Keeps a host signed in | 30 days |
lz_g_… | Remembers a guest at one event, so they don't have to join again | 120 days |
Our analytics are Cloudflare Web Analytics, which sets no cookies and doesn't track you across sites. The guest app may also store small preferences in your browser, such as which tab you last opened.
Your rights
You can ask us to access, correct, delete or export your data, to restrict or object to how we use it, and to withdraw consent. Guests can remove their face pattern or use "Forget me" in the app at any time. For anything else, email hello@lumzel.com and we'll reply within a month.
If you're unhappy with how we've handled your data, you can complain to the Information Commissioner's Office at ico.org.uk.
Children
Lumzel is for adults at events. It isn't intended for children under 13, and hosts shouldn't use it at events for children.
Changes
If we change how we use your data, we'll update this page and the date at the top. If a change is significant, we'll tell beta users and hosts by email.