Privacy Notice

Leumos Private Limited, a company incorporated in India, is the controller of the information described here. We operate leumos.ai and Leumos AI Studio, a color-grading tool that runs in your browser. Write to us about anything on this page at studio@leumos.ai.

• Your account. Your email address, whether it has been verified, the name on your Google account if you sign in that way, and a normalized form of your address so the same inbox cannot be registered twice. If you set a password, our identity provider stores it hashed; we never hold it and cannot read it.
• The footage and stills you work with. What leaves your computer, and when, is set out in full in the next section.
• Your projects. A project you save is kept in our cloud: its name, the names, sizes, dates and durations of the files you are working with, the timeline you build, the grades you make, the record of each reference match, a small copy of each reference image you matched to, and small preview thumbnails taken from your frames. The footage itself is not part of the project — see the next section for when footage is stored.
• Usage and technical information. Ordinary server records of your use: when you signed in, which requests your browser made, errors, and the network address and browser your device reports.
• Which of our ads brought you. When you arrive from one of our own ads, the link carries the ad’s campaign tags (campaign, ad group and keyword). Once you sign in, we keep those tags with your account, once, along with the page you landed on and the date, so we can tell which campaign brought a sign-up or a payment. We ourselves read, keep and send no advertising click identifiers. If you accept on the cookie banner, Google is told when a visit from one of our ads leads to a sign-up or a purchase (with its amount and currency); it never receives your name, email or account. The only other party that sees the tags we keep is Razorpay, which receives the campaign name with a payment (see “Who else sees it” below).
• Payment information. If you subscribe, Razorpay takes the payment and tells us the state of your subscription and the identifiers that let us match it to your account. We never receive or store your card number.
• What you send us. Anything you put in an email to us, and — if you joined our waitlist while it was open — the address, role and comments you submitted.

Opening a clip in the Studio does not upload it. Playback, scrubbing and most of the color work read the file on your own machine. Four things do travel to us, and it is worth being exact about which. If you try the Studio before creating an account, none of them happens: your work stays in your browser until you sign in.

• A small, low-resolution copy of a clip, sent automatically when you import it. The Studio needs to know where the shots change in your edit, and it works that out on our servers. This happens without a separate click, because it has to be ready the moment the clip appears. The copy is far below the quality of your original, and the original is not sent at this point.
• Frames, when you use reference matching. Your reference image is reduced and sent, along with frames from the shots you are matching. For a very short shot, or a file your browser cannot read on its own, the Studio sends that shot’s source instead — for a short clip that can be most of the file. The Studio tells you, shot by shot, which of the two happened.
• The complete file, when you export. Exporting uploads your original to our cloud storage, produces the graded result there, and gives you a time-limited link to download it.
• A backup of your footage in your account’s cloud storage, unless you switch it off. On every plan, the Studio backs up the footage you import to your account’s cloud storage, so a project opens on another machine. You can switch this off for any project with “Keep footage in the cloud”: the upload stops, the footage stays on your device, and the cloud copy ages out.

Your footage is yours, and so are the grades and looks you make from it. We do not use either to train models, we do not sell them, and no outside AI provider receives your material — the analysis runs on infrastructure we operate.

• To provide the service you asked for — creating and securing your account, opening and saving your projects, running the work you start, delivering your exports, and taking payment for a plan. This is our performance of our contract with you.
• To keep the service working and safe — diagnosing faults, preventing abuse and unauthorized access, and understanding load in aggregate. These are our legitimate interests, and yours.
• To measure how the website is used — only if you allow analytics. This is your consent, and you can withdraw it at any time.
• To meet legal obligations — keeping the records of payments that the law requires us to keep.

The service runs on Amazon Web Services. Account records are held in its US East (N. Virginia) region; projects, uploaded footage and exports are held in its US East (Ohio) region.

Using the service therefore means your information is transferred to and stored in the United States. Where the law requires a safeguard for that transfer, we rely on our providers’ standard contractual clauses and their equivalents.

We do not sell your information and we do not share it for anyone else’s advertising. A small number of providers process it on our instructions so that we can run the service:

• Amazon Web Services — accounts and sign-in, storage of projects, footage and exports, the computing behind the service, and delivery of account email such as verification codes.
• Netlify — hosting of the leumos.ai website, while it is served there: ordinary request logs, including your network address and browser details.
• Google — signing in with Google, website analytics if you allow it, and measuring our own ads if you accept.
• Razorpay — taking subscription payments and issuing refunds. With a payment it also receives the campaign name and source of the ad that brought you, if any, as a note on the order, so we can match a payment to the campaign.
• Amplitude — optional website and product analytics and masked session replay, only after you allow analytics.
• Sentry — error and sampled performance diagnostics that help us keep the service working. We restrict these reports to coarse route categories, trace IDs, error types and timing; they do not include footage, project or file names, form entries or request bodies.
• GitHub — internal reports when an export fails, so our team can fix it. A report carries technical details such as the export’s id, the time, the plan, the codec and the cause; reports never include your name, email address or file names.
• Resend — delivery of waitlist email. The waitlist form is no longer on the site; this covers what we received while it was.

When you choose a password, we check it against a public register of passwords exposed in known breaches, in a way that never sends your password or a full fingerprint of it anywhere.

We may also disclose information where the law requires it, or to establish or defend a legal claim. If the business is ever sold or reorganized, information may transfer with it, subject to this notice.

If you choose “Continue with Google,” we ask Google for three things and nothing else — openid, email and profile. From those we receive the email address on your Google account, the name on it, whether Google has verified that address, and an identifier that lets us recognize you next time.

We use that for one purpose: creating your Leumos account and signing you in. We never receive your Google password. We do not request access to Gmail, Drive, Contacts, Calendar, Photos or any other Google service, and we cannot read them. You can disconnect Leumos in your Google account’s security settings at any time; that stops future sign-ins but does not by itself delete your Leumos account.

The Video Color Check browser extension has its own extension privacy policy; the extension collects no data and makes no network requests.

Essential cookies keep you signed in and protect the sign-in itself. If you open the Studio without signing in, one more essential cookie identifies this browser, not you, so that how often it can start our servers before you sign in is limited and automated visits can be told apart. Google Analytics and Amplitude are optional: neither loads until you choose “Allow analytics,” and before that choice this website sends them no analytics or session-replay request. Each runs only where it is switched on for the site you are visiting, so you may allow analytics and still meet neither. Ad personalization stays off. Advertising measurement runs only if you accept.

If you allow it, Google Analytics and Amplitude may process a query-free page path, where you arrived from, approximate location, device and browser details, page views and interactions. Amplitude Session Replay reconstructs public pages and masked Studio controls. It masks Studio text and form fields and blocks footage, previews, images, file names, project names and account details. It stays off during sign-in and on Projects, billing, payment and test-harness pages. After sign-in, Amplitude may receive a pseudonymous account identifier so activity can stay with the same account; it does not receive your e-mail address as that identifier.

On the sign-in, Projects and billing pages, where replay is off, Amplitude still receives a few named events so we can see where signing up and subscribing break down: a sign-up started or confirmed, a sign-in that succeeded or failed, a checkout started, or one that failed. A failure carries one word for the kind of failure — credentials, transient, oauth, declined or server — and nothing else: no email address, no password, no card details, no amount, no payment provider’s message, and nothing you typed. If you allowed analytics, a completed subscription payment is recorded in Amplitude with the plan, amount and currency, and the payment’s reference, against your pseudonymous identifier.

Elsewhere, if you allow analytics, Amplitude also receives which features you used — which tool was pressed, which preset slot, whether an import or an export succeeded or failed, and how many clips or shots were involved. Each of these is a word from a fixed list or a plain count. File names, project names, footage, timecodes and color values are never sent; anything outside that fixed list is discarded in your browser before the event is uploaded. After you sign in, three further facts may be attached to the pseudonymous identifier: your plan, how you signed in, and how long the account has existed as a range rather than a date. Your name and email address are never attached.

Our cookie policy lists what is set, what it is for, and how to change your mind — you can withdraw consent at any time through “Privacy choices” in the footer.

• Your account and its details — until you ask us to delete them.
• A file you upload in order to export — seven days.
• New exported files — available to download in Studio for up to seven days after rendering completes, on every plan. Download access ends then; automatic cleanup deletes the rendered file afterward, with retries if removal fails. Export requests made before the 9 September 2026 change remain under their previous retention policy.
• Footage you keep in our cloud — thirty days from the last time you open it, and in any case removed within one hundred and twenty days.
• A project you delete — gone from your account at once, and permanently removed from our storage thirty days later.
• Temporary working files made while a grade is prepared — removed automatically within about half an hour; the records that track an upload in progress expire within a day.
• The copies sent when you import and match, and the result of each match — kept on our servers so the Studio and your exports can reuse them. There is no automatic deletion period for these yet; they are deleted when you ask us to delete them.
• Google Analytics events — up to fourteen months, and only if you allowed analytics.
• Payment records — for as long as tax and accounting law requires.

Projects you have not deleted are kept while your account exists, so that your work is where you left it.

You can ask us for a copy of what we hold about you, ask us to correct it, ask us to delete it, object to or ask us to restrict a particular use, and withdraw a consent you have given. Withdrawing consent does not affect what was done before you withdrew it.

Write to studio@leumos.ai from the address on your account and tell us what you want done. There is no self-service delete button in the product yet — a person handles the request, and we will confirm when it is done. Backups may hold a copy for up to 35 days after deletion. If you are not satisfied with our answer, you can complain to the data protection authority where you live.

Information is encrypted while it travels between your browser and us, and while it is stored with our providers. Your signed-in session is held in cookies that page scripts cannot read, and sign-in tokens are never written into browser storage. Each account’s projects and footage are addressed under that account and are not reachable from another one. No system is perfectly secure, so please use a password you use nowhere else, and tell us at once if you think your account has been reached.

The service is for people aged 18 and over. It is not directed at children and we do not knowingly collect a child’s information. If you believe a child has given us information, write to studio@leumos.ai and we will delete it.

If our practices change, this notice changes with them and the “last updated” date at the top moves. If a change materially affects how we handle your information, we will try to tell you before it takes effect.

Grievance contact: Pravit Gandhi, Founder · studio@leumos.ai

We acknowledge every complaint within 48 hours.

For anything in this notice, including access, correction and deletion requests, write to the address above. Our full contact details are also on the contact page.