Privacy Policy
Last updated: September 2026 · MD Media 25 EOOD
At LumenPanda, operated by MD Media 25 EOOD, we take your privacy seriously. This policy explains how we collect, use, and protect your personal information when you use our platform.
1. Information We Collect
We collect information you provide directly to us when you create an account, purchase points, or contact our support team. This includes your name, email address, and payment information (processed securely by our third-party payment provider - we do not store card details). We also collect usage data, including prompts, generated images, and platform interaction logs to improve our services.
2. How We Use Your Information
We use your information to: provide and maintain the LumenPanda platform; process point purchases and manage your account; respond to your support enquiries; send important service notifications; and improve our AI models and platform features. We never sell your personal data to third parties.
3. Your Generated Images
You retain full ownership of all images you generate on LumenPanda. We store generated images to power your gallery and enable download functionality. We do not use your generated content to train our AI models without explicit consent.
4. Data Security
We use TLS encryption in transit, access controls, hashed passwords, restricted administrative access, validation and security monitoring. We do not claim that any system is completely secure.
5. Cookies
We use three categories: essential storage (sign-in and checkout), functional storage (language and theme) and analytics (Google Analytics, only after you accept). Examples, names and expiry are in the table on this page and in the Cookie Policy. You can accept, reject, customise or withdraw consent at any time through Cookie settings in the footer.
| Name | Category | Purpose | Expiry |
|---|---|---|---|
| lp_cookie_consent | essential | Stores cookie preferences, policy version and consent time. | 12 months |
| pc_theme | functional | Remembers the selected light or dark theme. | Until deleted |
| lumenpanda_language | functional | Remembers the selected language for the browser session. | Browser session |
| pc_token / pc_user | essential | Keeps a signed-in customer authenticated and displays their account. | Until logout or token expiry |
| pc_pending_checkout_id | essential | Reconnects the browser to a payment result after returning from the provider. | Browser session |
| _ga / _ga_* | analytics | Measures visits and page usage after analytics consent. | Up to 2 years |
6. Data Retention
We keep your account, prompts and generated files while the account is open. From your profile you can download a copy of your data and close the account. Closing the account deletes the profile details, prompts and generated files. We keep purchase records (date, amount, currency, card brand and last four digits) for accounting and tax duties. We do not keep full card numbers or CVC codes.
7. Your Rights (GDPR)
As a Bulgarian, EU-based company, we process personal data under the General Data Protection Regulation. You have rights including: access to your personal data; correction of inaccurate data; deletion of your data ("right to be forgotten"); data portability; and the right to object to certain processing. You can use these rights from your account profile or by writing to support@lumenpanda.com. You may also lodge a complaint with the Commission for Personal Data Protection of the Republic of Bulgaria (Комисия за защита на личните данни), 2 Prof. Tsvetan Lazarov Blvd., Sofia 1592, https://www.cpdp.bg.
Sharing with third parties
We share data only as needed with our payment provider (card payments), Google (image and video generation, and Google Analytics only after you accept analytics cookies), Cloudinary (storage of generated files) and our email provider (transactional messages such as receipts and password resets) and WhatsApp (Meta), only if you choose to open our WhatsApp chat link; nothing is sent to WhatsApp until you do. We do not sell personal data.
Card data
We do not store full card numbers or CVC codes. Under the current direct integration, encrypted card details pass through our server to the payment provider; we retain only limited metadata such as card brand and last four digits. Payments are handled by a PCI DSS-compliant payment provider. We are not the store of raw cardholder data.
International transfers
Some of these providers may process data outside the European Economic Area, including in the United States. Where a transfer is not covered by an adequacy decision, it is made under the provider’s contractual safeguards, such as Standard Contractual Clauses, together with technical measures such as encryption in transit.
Payment security
Card payments are sent over HTTPS. If your card issuer or the payment provider requires an extra authentication step, such as 3-D Secure (Visa Secure or Mastercard Identity Check), checkout sends you to that step before the payment is completed.
3D Secure
3-D Secure is enabled for card payments on this account. Your bank may ask you to confirm the payment before it completes.
8. Contact
MD Media 25 EOOD is the data controller for LumenPanda. Incorporated: 05.09.2025. CEO: Mladen Emilov Dosev. For privacy enquiries, contact: support@lumenpanda.com. Registered address: Aprilsko Vazstanie 7, Razgrad, Bulgaria. Company number: 208472001 EIK.