Last updated 2026-09-13
What we know about you.
This notice is written from the database schema, not from a template. Every field below exists somewhere in the code, and the reason it is there is given beside it. If something here is wrong, that is a bug and we want to hear about it.
The short version
There is no analytics on this site or in the television application. No tag manager, no advertising pixel, no third-party font, no session recorder, no advertising identifier. We do not know what you watch — the channels, favourites, positions and locks live on your television and in your own backup, and are never sent to us. The address of your IPTV provider is erased from our side the moment your television has collected it.
What is left is what a licence needs in order to belong to someone: an account, a payment, and a way for a television to prove it is entitled to play.
Who is responsible
The controller of this processing is Erkan Dogru, auto-entrepreneur (entreprise individuelle), registered at 4 rue du Clos Saint-Nicolas, 94510 La Queue-en-Brie, France, registration number [SIREN / RCS].
For anything in this notice, including a request to exercise a right below, write to support@lumentv.app. There is no data protection officer: the processing here does not meet the conditions of article 37 GDPR that would require one.
What is collected, and why
Your television
| Field | Why it exists | Legal basis |
|---|---|---|
| A device identifier | A SHA-256 of the set’s network address and model, computed on the television. It is what a licence seat is attached to, and what tells a trial it has already been used on this set. We never receive the raw address — only the hash. | Contract |
| Model, firmware and SDK version | To say whether the set can run the app, and to make a support conversation possible without asking you to read numbers off a menu. | Contract |
| A device secret | Thirty-two random bytes issued to the television, stored here only as a hash. Without it, anyone who learned your set’s identifier could ask for a licence token in its name. | Legitimate interest — securing your licence |
| A six-character support code | Derived, not issued. It is what you read out to support so a set can be found without you reciting a hash. | Contract |
| Last seen | The date of the last licence check, so a seat that no set has used for a long time can be recognised. | Contract |
Your account
| Field | Why it exists | Legal basis |
|---|---|---|
| Email address | A licence belongs to a person, and that person has to be reachable and recoverable. | Contract |
| Password, hashed | Stored as a one-way hash. Nobody here can read it, including us. | Contract |
| Google account identifier, name and picture | Only if you choose to sign in with Google. It is the identifier, the display name and the avatar URL Google returns — nothing else, and no access to anything in your Google account. | Contract |
| Licence, plan and seats | What you bought and which televisions are using it. | Contract |
Your payment
Payment is handled by Stripe. Your card number never reaches this site or our servers — the fields you type are served by Stripe and go to Stripe. What we store is the identifier Stripe gives the payment, so that a licence can be matched to it and a refund can be found later, and the identifiers of the events Stripe has already sent us, so the same event is not applied twice.
Pairing a playlist, and backups
When you add a playlist from your phone, the address you paste is held in a single row for at most ten minutes and erased the moment your television collects it. The same is true of a backup sent to a set. Both hold credentials — an Xtream address carries your provider username and password in its path — which is why neither is kept and why the audit log records only the host name, never the credentials, and never the full address.
Logs and abuse prevention
The API keeps an audit log of what happened to a licence — issued, checked, refused, refunded, revoked — because that is what makes a dispute answerable. Requests are rate limited, which requires holding an IP address briefly in memory. Web server logs record request lines and IP addresses in the ordinary way.
Partner links
If you arrive through a partner’s link, and only if you agree on the
page that asks you, a cookie named lumen_aff records which
partner sent you, for ninety days, so their commission can be
calculated. The click itself is recorded with the browser’s user-agent
string and the referring page. If you decline, no cookie is set and
nothing about you is recorded. The
cookie page covers this in full.
Who else sees it
Three, and this is the whole list.
| Who | What for | Where |
|---|---|---|
| Stripe Payments Europe, Ltd. | Taking the payment and issuing refunds. | Ireland, with transfers outside the EU governed by the European Commission’s standard contractual clauses. |
| OVH SAS | The virtual server this site, the API and the database run on. | France (Hauts-de-France) |
| An email provider | Sending a password reset or a receipt. Not in use today — email is switched off, and this row will name the provider on the day it is switched on. | To be named |
The database is not a third party’s: it runs on the same server as the rest of it, and it is not shared with anyone. Nothing is sold, rented, or handed to an advertising network, because there is no advertising network in this product.
How long it is kept
| What | How long |
|---|---|
| A playlist address or a backup waiting to be collected | Until the television collects it, and at most ten minutes. |
| An expired pairing code | Deleted the next time any television asks for one, and in any case within a day. |
| Your account and licence | For as long as the account exists. A lifetime licence has no end, which is the point of it. |
| Invoices and payment records | Ten years, because commercial and tax law requires it (article L123-22 of the French Commercial Code). |
| The audit log | Twelve months. |
| Partner click records | Ninety days, the same as the cookie. |
| Web server logs | Twelve months, the ceiling French law sets for connection data. |
What you can ask for
Under the GDPR you may ask for a copy of your data, ask for it to be corrected, ask for it to be deleted, ask for the processing to be restricted, ask for it in a portable form, and object to processing based on legitimate interest. Where processing rests on your consent, you may withdraw it at any time, and withdrawing it is as easy as giving it was.
Write to support@lumentv.app from the address on the account. We answer within one month, which is the limit article 12 sets.
Deleting your account deletes the account, its licences and its seats. It does not delete an invoice, because we are required to keep those, and it cannot delete a payment record held by Stripe.
If you think this processing breaks the law, you may complain to the supervisory authority. In France that is the CNIL, 3 place de Fontenoy, TSA 80715, 75334 Paris Cedex 07 — cnil.fr/fr/plaintes. You may also complain to the authority of the country you live in.
Things this product does not do
- No automated decision-making with legal or similarly significant effect, and no profiling.
- No advertising, no advertising identifier, no audience measurement.
- No sale, rental or exchange of personal data. There is no arrangement under which that could happen.
- No data knowingly collected from children. The product is sold to adults and requires a payment method.
When this notice changes
The date at the top moves and the change is listed in the changelog, like everything else. A change that alters what is collected or why will be told to account holders by email before it takes effect.