Privacy policy

The personal data controller is [company name], a company registered in the Emirate of [emirate], UAE, licence or registration number [licence or registration number] (“we”). Contacts are in section 13.

This policy covers data we receive through the lac.pics website, the personal account area, the lacuna app for Windows and the API.

We honour user rights to the extent provided by the EU General Data Protection Regulation (GDPR); they are described in section 10.

Terms are used as defined in the terms of service.

We process only the data needed to run the service.

We do not ask for a phone number, identity documents or bank card data. You may link an email address if you wish — for notifications only: it cannot be used to sign in or to recover the login key. Otherwise we only get your email address if you write to us.

Personal metadata is removed from images on upload: location, device serial numbers, XMP, IPTC and comments. For videos we keep one version — the one you uploaded (the app and the website compress it on your device beforehand) — repackaged without metadata: it is the one that is watched and the one that is downloaded if you allowed downloads. The original file is not kept on the server.

The app for Windows processes screenshots and recordings on your computer. Only files you upload yourself reach the server. If you turned on automatic upload (it is off by default), the app also uploads new screenshots. The app keeps its API key in Windows Credential Manager.

While the app is open, every minute or two and when its window opens it asks the server whether its key still works and reports its own version and the Windows version. This way a disconnected device or a blocked account reaches the app at once. No files are sent for this.

Video editing and compression and file conversion in the browser run on your device. A file reaches the server when you save it.

We do not analyse content for advertising or profiling and do not recognise faces — we do not establish who is shown. The check for illegal content is described in section 4.

Performance of the agreement with you — the terms of service: account, content, links, sessions, API, subscription, invitations, export, support. This includes service security, request limits, moderation and protecting the free trial from repeated registrations: without them the service cannot be provided safely and fairly.

Obligations imposed on us by law: payment accounting, responses to lawful requests of state bodies.

Protecting our rights and handling disputes: the history of payments and report decisions.

Your choice: you make your public profile and content shared by link or publicly available to others yourself, and you can close access at any time.

Processing is automated: collection, recording, organisation, accumulation, storage, updating, retrieval, use, transfer (provision, access), blocking, deletion and destruction.

Decisions to block an account or delete content after a report are made by a person, not an algorithm.

Uploaded images and videos may be checked automatically by an external processing service for illegal content — above all child sexual abuse material — and for violations of the sharing rules. The service receives a reduced copy of an image or a few frames of a video, not the original file and not the whole video, and returns only scores. We choose a processor that acts on our instructions, does not use the images for its own purposes and does not keep them after the check. If a score is high, the content is visible only to you until a moderator decides, and the moderator receives a report. The final decision is made by a person; you can contest it through support.

We do not sell data or use it for advertising.

Other users and visitors — according to your settings:

• private content is visible only to you;
• unlisted content is visible to anyone with the link;
• public content may appear in the public feed and in your profile;
• the page of content shared by link or publicly shows its title, your name and nickname — they also appear in link previews in messengers and social networks;
• your profile — name, nickname, “about” text, avatar — is visible to signed-in users;
• your invitations show your nickname unless you turned this off.

A link recipient can save a copy, forward the link or record the screen. If you close access or delete content, copies kept by recipients and previews in external services remain.

Administrators see service data of accounts — for example the nickname, name, dates, storage used, payments and the API request log. An administrator can open content, including private content, only through the private review tool — to review a report, check a violation or comply with the law. Every opening is logged.

Payment services receive the data needed for the payment:

• Platega (platega.io) — the amount, order number, account identifier and nickname, which its anti-fraud system requires;
• Heleket (heleket.com) — the amount, currency and payment number;
• you enter card, account or wallet details on the payment service page. Payment services process data under their own rules, including outside the EU and the UAE.

Hosting: the servers that run lacuna and store files are provided by a hosting provider in Poland (EU). Files on the servers are stored encrypted.

Emails are sent by our own mail server in Poland (EU). An email is delivered to the mail service that handles your address (for example Gmail or Yandex Mail) and is then processed under its rules. We do not use third-party mailing services; if we start using one, we will update this policy.

The automatic checking service, when the check is on, receives reduced copies of uploaded images and video frames — to check them for illegal content (section 4).

hCaptcha (Intuition Machines, Inc.), when the “I am not a robot” check is on, receives the IP address and technical data about the browser and device during registration, sign-in after several failed attempts and reports sent without an account, to tell people from bots. Without hCaptcha a built-in check runs that sends nothing anywhere.

State bodies — only on the grounds and in the manner established by law.

Servers and databases with personal data are located in Poland, in the European Union, where the GDPR applies. [to verify: the service also targets users in Russia — Russian language, rouble payments; storing Russian users’ data in Russia may be required]

Data leaves the EU only for payments — to the payment services — and, when hCaptcha is on, for the “I am not a robot” check: its servers are in the USA (section 5). Emails to a linked address are delivered to the mail service of that address, which may also be outside the EU. We choose an automatic checking service that processes data in the EU. Any other transfer abroad is made only on conditions permitted by applicable law.

We use only necessary cookies — without them sign-in and protected links do not work. There are no advertising or analytics cookies and no third-party counters.

Browser storage (localStorage and sessionStorage) keeps the language, appearance, player and upload settings, the queue of unfinished uploads, the chosen plan or free trial before sign-in, dismissed free trial reminders, the last payment number and an invitation code before registration. This data stays on your device and contains no keys or passwords.

You can delete cookies in your browser settings — you will then need to sign in again.

Files are stored encrypted (AES-256-GCM); encryption keys are kept separately from the files.

The login key, API keys and link passwords are stored only as hashes.

Connections to the service are protected with HTTPS.

Administrator access is role-based, requires a second factor and is logged. The administration console is closed to all addresses except allowed ones.

Backups are encrypted.

If a breach occurs that may affect your data, we will notify the UAE Data Office where the law requires it and inform users in the service. Please report a suspected leak or vulnerability to support.

We keep data while it is needed for the purposes in section 2 and delete it when the purpose is achieved or you delete the data.

Deleted content becomes unavailable immediately; its files are removed from storage in the background.

Account deletion is in the settings and is confirmed with the login key and the nickname. Access closes immediately: sign-in, sessions, API keys, links and profile. Content, albums, favourites, keys and the request log are deleted in the background.

After account deletion the following remain: payment records — without a link to the account, for the period in section 2; the history of report decisions — without the reporter’s data; the free trial mark — up to 30 days from its start; the administrator action log and internal notes — as long as they are needed for security and handling violations.

Backups are kept for up to 28 days, pinned backups (for example, those made before a service update) for up to 30 days, and backups in the separate storage for up to 41 days. We keep a backup longer only if this is needed to investigate an incident or required by law. Until a backup is deleted, it contains data of deleted accounts and content.

Deletions of accounts and content are recorded in a separate journal — internal identifiers and times only. If a backup has to be restored, every deletion made after it was created is repeated from this journal before access opens.

You can:

• access your data: learn what data we process and why, and get a copy;
• correct your data: the profile in the settings, anything else through support;
• delete your data: content and the account in the settings, anything else on request unless the law requires us to keep it;
• export your data in a machine-readable format — as an archive in the account settings;
• object to processing or ask us to restrict it, for example while we check your request;
• withdraw consent where processing is based on consent — this does not affect processing before withdrawal;
• complain to a supervisory authority: the UAE Data Office or, if you live in the EU, the data protection authority of your country.

Send your request through support in the account area — this way we immediately see it comes from the account owner. Without access to the account, write to [email for legal notices]; we may ask you to confirm that the account is yours.

We reply within 30 days. For complex requests the period may be extended — we will tell you why.

An export covers up to 1,000 files and 10 GB at a time. If you have more data, contact support.

The service is not intended for persons under the age stated in clause 3.5 of the terms of service. If you learn that a child created an account without parental consent, write to us and we will delete the account.

We publish a new version on this page with its date. We announce material changes in the service in advance.

If new ways to sign in appear, for example with Google, Yandex, VK, Telegram, Discord or GitHub, we will describe here what data we receive from those services before they launch.