Lomalins

Lomalins

Privacy Policy

Last updated: 8 July 2026

Template — have legal counsel review before launch. This document is provided for informational purposes and does not constitute legal advice.

1. Introduction

This Privacy Policy explains how Lomalins("we", "us", "our") collects, uses, stores, and shares personal data when you use Lomalins(the "Service") — our software-as-a-service platform for social content creation, AI video generation, scheduling, analytics, and publishing.

We are committed to protecting your privacy and processing personal data in accordance with applicable data protection laws, including the UK General Data Protection Regulation (UK GDPR) and the Data Protection Act 2018.

Data controller: Lomalins, United Kingdom. For privacy enquiries, contact us at privacy@lomalins.com.

2. Data we collect

We collect the following categories of personal and usage data:

Account and identity data

  • Name, email address, and password (stored via our authentication provider)
  • Email verification status and account preferences
  • Organisation and team membership details

Brand and business profile data

  • Company or brand name, website URL, niche, market region, and onboarding answers
  • Brand voice, tone, and content preferences you provide
  • Publishing profiles and platform-specific settings

Social platform connection data

  • OAuth access and refresh tokens for connected social accounts (e.g. Instagram, TikTok, YouTube, LinkedIn, Facebook, X/Twitter), stored in encrypted form
  • Platform usernames, profile identifiers, and connection status
  • Content and metadata retrieved from connected platforms for analytics, research, and publishing (where you authorise us to do so)

Content you create or upload

  • Scripts, captions, hashtags, and text posts generated or edited in the Service
  • Source media, generated videos, thumbnails, and related assets
  • Scheduled and published posts, including publication status and timestamps
  • Campaign, competitor research, and analytics data derived from your use of the Service

Billing and subscription data

  • Subscription plan, trial status, and billing history
  • Payment information is processed by Stripe; we do not store full card numbers on our servers

Usage, technical, and diagnostic data

  • Log data, IP address, browser type, device information, and session identifiers
  • Feature usage, API calls, job queue activity, and error reports
  • Cookies and similar technologies (see Section 8)

3. How we use your data

We use personal data for the following purposes:

  • Providing the Service — creating accounts, authenticating users, generating scripts and videos, scheduling and publishing content, syncing analytics, and running autopilot workflows you enable
  • AI and media processing — sending prompts, scripts, and media to AI and rendering providers to produce content on your behalf, in line with your instructions
  • Social platform integration — connecting to third-party platforms to publish content, refresh tokens, and retrieve performance data
  • Billing and account management — processing subscriptions, trials, invoices, and support requests
  • Security and fraud prevention — protecting accounts, detecting abuse, and maintaining the integrity of the Service
  • Improvement and analytics — understanding how the Service is used, fixing bugs, and developing new features (using aggregated or anonymised data where possible)
  • Communications — sending transactional emails (verification, password reset, publication notifications, billing receipts) and, where permitted, product updates
  • Legal compliance — meeting legal obligations and responding to lawful requests

Our lawful bases under UK GDPR may include: performance of a contract, legitimate interests (e.g. security and product improvement), consent (where required, such as non-essential cookies or certain marketing), and legal obligation.

4. Sharing and third-party processors

We do not sell your personal data. We share data with trusted service providers who process it on our behalf to operate the Service, including:

  • Firebase (Google) — authentication and identity management
  • Stripe — payment processing and subscription billing
  • Cloudflare R2 — secure storage of media assets and generated videos
  • OpenAI and Google Gemini — AI text generation, analysis, and content assistance
  • ElevenLabs — AI voice synthesis for video narration
  • Remotion and Amazon Web Services (AWS) — video rendering and cloud compute
  • Zernio / Upload-Post — social media publishing and aggregator connections
  • Resend — transactional email delivery
  • Additional providers — we may use other subprocessors for scraping, analytics, queue infrastructure, or platform APIs as needed to deliver features you use

These providers are authorised to process data only as necessary to perform services for us and are subject to contractual data protection obligations where applicable.

We may also disclose data if required by law, to protect our rights or users, or in connection with a merger, acquisition, or sale of assets (with notice where practicable).

Some providers may process data outside the UK. Where we transfer personal data internationally, we implement appropriate safeguards such as Standard Contractual Clauses or equivalent mechanisms.

5. Data retention

We retain personal data for as long as your account is active or as needed to provide the Service. Specific retention periods depend on data type:

  • Account data — retained while your account exists and for a reasonable period after deletion to handle disputes, backups, and legal requirements
  • Content and media — retained while you keep it in the Service; deleted content may persist in backups for a limited time
  • Social tokens — retained while a connection is active; revoked or deleted when you disconnect an account or close your account
  • Billing records — retained as required for tax, accounting, and legal purposes (typically up to seven years in the UK)
  • Logs and diagnostics — retained for a limited period for security and troubleshooting, then deleted or anonymised

You may request deletion of your account and associated data subject to legal retention obligations (see Section 7).

6. Your rights

If you are in the UK or EEA, you have the following rights in relation to your personal data, subject to applicable exceptions:

  • Access — request a copy of the personal data we hold about you
  • Rectification — ask us to correct inaccurate or incomplete data
  • Erasure — request deletion of your data in certain circumstances
  • Restriction — ask us to limit processing in certain circumstances
  • Portability — receive your data in a structured, commonly used format where technically feasible
  • Objection — object to processing based on legitimate interests or for direct marketing
  • Withdraw consent — where processing is based on consent, you may withdraw it at any time

To exercise these rights, contact privacy@lomalins.com. We will respond within one month, or inform you if we need more time.

You also have the right to lodge a complaint with the UK Information Commissioner's Office (ICO) at ico.org.uk, or your local supervisory authority if you are in the EEA.

7. Cookies and similar technologies

We use cookies and similar technologies to keep you signed in, remember preferences, maintain session security, and understand Service usage.

  • Strictly necessary cookies — required for authentication and core functionality; these cannot be disabled without affecting the Service
  • Functional cookies — remember settings and improve your experience
  • Analytics cookies — help us understand usage patterns (where enabled)

Where required by law, we will ask for your consent before placing non-essential cookies. You can manage cookies through your browser settings; disabling certain cookies may limit functionality.

8. Contact us

For privacy questions, data subject requests, or concerns about this policy, contact:

For terms-of-use questions, see our Terms of Service or contact legal@lomalins.com.

9. Changes to this policy

We may update this Privacy Policy from time to time to reflect changes in our practices, the Service, or legal requirements. We will post the updated policy on this page and revise the "Last updated" date. For material changes, we may notify you by email or through the Service. Continued use after changes take effect constitutes acceptance of the updated policy where permitted by law.