Version: 2026-09-29-org Effective date: 2026-09-29 Last updated: 2026-09-29
LUCAMOTIVE (“LUCAMOTIVE,” “we,” or “us”) processes personal data when it provides its websites, LUCAMOTIVE accounts, direct-sale software downloads and license activation, and customer support (collectively, the “Services”). We seek to comply with applicable data-protection laws and process only the data reasonably needed to provide the Services.
This Policy applies to Services operated directly by LUCAMOTIVE. Paddle, Google, Adobe, aescripts, and other third parties may process data for their own purposes and under their own responsibility. Their privacy notices apply to that processing.
1. Controller
- Business name: LUCAMOTIVE
- Website: https://lucamotive.com
- Privacy contact: support@lucamotive.com
2. Data we process, purposes, and sources
| Context | Data | Purpose | Source |
|---|---|---|---|
| Email-code account | Internal user ID, email address, successful verification record | Create and authenticate an account, account recovery, security notices | The email entered by you and verification result |
| Google sign-in | Stable Google account identifier, email address, display name and profile image where supplied and actually used | Create and authenticate an account, prevent duplicate accounts | Google OAuth with your authorization |
| Sessions and security | Essential session cookies and server-side session records, login time, failed or blocked attempts, security events, minimum request metadata | Maintain sessions, prevent unauthorized or automated access, investigate faults | Browser/app and security systems |
| Paddle order linkage | Internal user ID, Paddle customer ID, transaction ID, product and price IDs, transaction status, currency and amount, purchase/refund/chargeback timestamps | Link an order to an account, grant or revoke entitlement, support, accounting and disputes | Paddle API and signed webhooks |
| License and devices | Product/version, entitlement status, hash of a random installation ID, a general device name supplied by you or the operating system, operating-system and host-app version, first and latest validation timestamps | Enforce the two-device limit, provide 24-hour offline validation, device deactivation, compatibility and abuse response | Product and account service |
| Operational activity | Internal user ID, product/device/activation-flow IDs, login and download events, activation and receipt verification/storage outcomes, allowlisted error categories, app version, platform, timestamps and administrator actions | Account support, activation troubleshooting and change accountability | Account service, minimal product activation reports and administrator tools |
| Discounts and complimentary grants | Coupon ID, percentage, per-account reservation/redemption status, actual discount/payment/refund amounts, administrator license grants/revocations and reasons | Apply discounts, prevent reuse, reconcile refunds and provide support | Checkout service, Paddle and administrator tools |
| Downloads | Download entitlement, release ID, issuance and expiry time, success or error records | Deliver protected installers and respond to failures or unauthorized distribution | Account service and Cloudflare R2 |
| Support | Email address, message, attachments and diagnostic data you choose to provide | Respond to requests, diagnose faults, resolve disputes and improve the product | support@lucamotive.com and support pages |
| Optional promotional email | Email address, consent status and wording version, language, timestamps and delivery/bounce results | Deliver requested updates, handle opt-out and delivery failures | Post-sign-up invitation, account settings and Resend |
| Administrator access audit | Pseudonymous administrator ID, time, action, operator IP, transformed target IDs and result count | Audit customer-data access and detect bulk access | Administrator and support tools |
| Service preferences | Language and essential settings | Remember choices and provide accessibility | Browser local storage or essential cookies |
We do not collect or store payment-card numbers, expiration dates, or security codes. Paddle, acting as the seller and Merchant of Record, processes payment and billing information.
Our plugin does not upload your project files or media to LUCAMOTIVE servers. License checks do not transmit project names, media content, timelines, or editing results.
We use a random installation ID for device activation. We do not create or store hardware serial numbers or browser fingerprints. A network provider may transiently process an IP address to deliver and secure the Service, but we do not store raw IP addresses as persistent identifiers in our customer or analytics databases.
Only authorized administrators can view account activity. These records do not contain verification codes, session or device tokens, plaintext coupon codes, project or media content, or editing-button clicks. A completed activation report describes the product verifying and securely saving its receipt. An unreported result during a connection failure is not inferred to be a success.
3. Legal bases
Depending on your location and the context, we process data where necessary:
- to enter into or perform a contract you request, including accounts, entitlements, downloads, license validation, and support;
- to comply with accounting, tax, consumer-protection, dispute, and other legal obligations;
- for legitimate interests in preventing account, payment, and licensing abuse and securing the Services, where recognized by applicable law; or
- with your consent for optional features or processing that requires consent.
You may decline optional data. However, we cannot provide a feature without information essential to it, such as an email address and verification result for an account.
4. Retention
We keep personal data only for as long as needed for its purpose, unless law requires longer retention. Where required, legally retained records are separated and access-limited.
| Data | General retention period |
|---|---|
| Account and Google-link data | For the separately consented 30-day recovery period after closure, then removed by the hourly deletion job. You can request deletion through the contact channel below if you do not want that period or withdraw consent. Legally retained records are separated. |
| Email codes and verification records | Codes are stored as hashes and valid for five minutes. Used or expired codes cannot authenticate; remaining records are removed by cleanup procedures. Minimum technical activity is retained for 90 days. |
| Active session | Until logout, revocation or expiry; configured for up to seven days and may renew with activity. |
| Entitlement and Paddle transaction identifiers | While the account remains open; contract/withdrawal and payment/supply records retained for five years where Korean law or another applicable law requires it |
| Consumer complaints and disputes | Up to three years where required by applicable law |
| Advertising records | Up to six months where required by applicable law |
| License and device records | Until account or entitlement termination; deactivation and minimum security records retained for up to 90 days |
| Minimum operational activity | Technical login, download and activation records are marked to expire after 90 days and removed through cleanup. Order/refund evidence and administrator entitlement grants follow the relevant transaction/support retention policy. |
| Support requests | Up to three years after the last handling action for support and disputes; you may request earlier deletion of unnecessary attachments |
| Email consent and delivery records | Consent validity and change history: up to two years; individual delivery records: up to90 days. Account deletion also removes associated consent and promotional delivery records. Non-identifying campaign totals are kept separately. |
| Administrator records | Administrator visits:30 days; customer-data and attachment-access audits:366 days, then cleaned up. |
| Anonymous aggregate analytics | One-minute totals:45 days; five-minute and daily non-identifying totals are retained long-term for service statistics. Optional browser attribution state lasts up to30 days. |
Account deletion and purchase refunds are separate processes. Deleting an account does not itself refund a purchase. Because a perpetual license may still require online revalidation, deletion can prevent later reactivation or reinstallation. We will clearly explain this consequence before deletion.
5. Disclosures and Paddle payments
We do not sell personal data. We disclose it only with consent, where needed to perform the Services, or where another legal basis permits or requires it.
For transactions through Paddle Checkout, Paddle acts as the payment seller and Merchant of Record and independently handles payment, tax calculation and collection, receipts, refunds, fraud prevention, and payment support. To connect a transaction to your authenticated account, we may send Paddle an internal user ID, product and price information, and, where needed, your email. We receive order status and transaction identifiers from Paddle. Paddle’s processing is governed by the Paddle Privacy Notice and its buyer terms.
6. Processors, providers, and international processing
We use the following providers to deliver the Services. International processing and retention are described below.
| Provider | Role and data | Location and duration |
|---|---|---|
| Cloudflare, Inc. and affiliates | Workers, D1, R2, DNS, security and delivery; account, entitlement, device, download and minimum security-log data | Cloudflare’s global processing network, including the United States. Storage is not restricted exclusively to Korea.; for LUCAMOTIVE’s applicable retention period |
| Google LLC and affiliates | Google sign-in selected by you and OAuth result | According to Google’s disclosed locations, periods and your Google Account settings |
| Resend | Verification codes, essential notices, separately consented promotional email and delivery results; recipient address and message content | United States; Message content and delivery logs are retained for 30 days by default, subject to records separately required for legal or security purposes. |
| Zoho | Support email receipt and replies; email address, messages and attachments | Processed through Zoho Mail’s US data center. Inquiries follow the support retention period above. Messages removed from Trash remain recoverable at Zoho for an additional 30 days before deletion, subject to applicable legal preservation requirements. |
| OpenAI | Support draft and translation assistance; necessary inquiry content | May be processed through Codex in the United States and other OpenAI service locations. Retention follows the service and account settings; deletion requests are generally processed within 30 days, with exceptions for security or legal retention. |
| Meta and Google | Consented public-site advertising measurement; events and browser information described in section 7 | Processed in the providers’ global systems, including the United States, with retention and deletion governed by their privacy policies and user settings. LUCAMOTIVE does not send account or license information through advertising tags. |
| Paddle.com Inc. for US buyers, Paddle.com (Canada) Ltd. for Canadian buyers, and Paddle.com Market Limited for buyers elsewhere and Paddle affiliates | Merchant of Record, tax, receipts, refunds and fraud prevention; buyer, payment and transaction data | Under the Paddle policy and legal-retention period applicable to the buyer’s region |
Data is transmitted using HTTPS or comparable safeguards. You may choose email verification instead of Google sign-in, and you may decline to purchase so payment information is not sent to Paddle. Refusing a particular provider’s processing may mean that Google sign-in, verification email, or direct purchase is unavailable.
7. Cookies, optional measurement and promotional email
Sign-in uses essential session cookies and short-lived OAuth security information. The browser may remember language and display preferences. Blocking essential cookies may prevent sign-in, checkout linkage, downloads or device management.
Cloudflare Web Analytics and our anonymous counters measure aggregate page views, campaigns, countries and device categories. Our counters do not store email addresses, user IDs, raw IP addresses, browser fingerprints or visitor-identifying cookies, and are not joined to account data at an individual level.
With optional analytics consent, limited attribution state is stored in the browser for up to30 days. The server records hourly totals grouped by first/recent campaign, visit depth and broad return-visit ranges; it does not retain original URLs or arbitrary UTM values.
With separate advertising-measurement consent, the public website sends Meta Pixel page-view and Adobe outbound-click events, and a Google Ads Adobe outbound-click conversion. These indicate a visit to an external seller, not an actual Adobe purchase or revenue. The providers may process page addresses, ad-click identifiers, cookies, browser and network information. We do not send account email or license information, and do not use Google enhanced conversions or advertising-personalization signals. These advertising tags are not loaded on account, administrator or legal-document pages.
You can change optional analytics and advertising measurement separately in Cookie settings. Choices are stored in the browser; the website remains usable with essential cookies only. On withdrawal we attempt to remove the relevant optional state and site-managed cookies and stop subsequent measurement. Information already received by an advertising provider must be managed through that provider's privacy tools.
Promotional email is sent only with separate consent through the post-sign-up invitation or account settings. It is off by default and declining does not affect accounts or licenses. You can opt out without signing in through the email link, or change the choice in account settings. Opt-out, closure, expiry, bounces or spam complaints exclude the address from new promotional sends. A message already submitted to the delivery provider cannot be recalled. Sign-in codes and essential security/license notices are independent of this choice.
Email links do not carry recipient-specific tracking IDs, and we do not use email-open pixels. Shared campaign-link counts can include repeat clicks or security-scanner requests and do not represent reads or unique people.
8. Your rights
Subject to applicable law, you may request:
- confirmation and access to your personal data;
- correction of inaccurate data;
- deletion or restriction of processing;
- withdrawal of consent and disconnection of a sign-in provider; and
- where applicable, portability or an objection to processing.
Privacy-rights request channel: support@lucamotive.com. We may verify your identity through an authenticated account, verification email, or another proportionate method. An authorized agent may need to provide evidence of authority. We may limit a request where retention is legally required or needed to protect others’ rights or security, and will explain the reason where required.
You may disconnect Google through your Google Account’s third-party connection controls. LUCAMOTIVE account deletion is a separate process in account settings. Disconnecting a provider does not immediately erase legally retained transaction records.
Depending on where you live, you may also complain to your local data-protection authority. In the Republic of Korea, current complaint information is available through the Privacy Portal.
9. Closure, recovery and deletion
After identity verification and confirmation in account settings, closure ends web sessions and stops online validation, downloads and device linking. Previously issued offline access may not be immediately revoked. If you separately consent to recovery retention, you must sign in within30 days of confirmation and explicitly restore the account to resume service. Signing in alone does not cancel closure.
After the deadline, recovery is unavailable. An hourly job deletes account, authentication, license, device and unnecessary operational records. Failures are retried or handled by an operator. Signing up again does not automatically restore previous licenses. Closure and refunds are separate, and mandatory consumer rights remain unaffected.
Legally retained transaction and dispute records are access-limited and managed separately from the service account. Closure-completion records are kept for90 days to confirm processing. Only a deleted account's random internal ID and deletion time are retained separately to prevent late payment notifications from reviving old entitlements; no email or profile is included.
If you do not want a recovery period, wish to withdraw retention consent or exercise deletion rights, contact support@lucamotive.com. Following necessary identity checks, eligible data is handled without undue delay, excluding legally retained records. Existing manual requests are not treated as consent to the new automated closure process.
Expired electronic records are removed using reasonable technical deletion procedures; paper is shredded or otherwise securely destroyed. External providers and backups follow their applicable retention/deletion procedures, and completed closures are reapplied when a backup is restored. We do not promise an unverified universal backup-deletion deadline.
10. Security
We use reasonable safeguards including least-privilege access, encryption in transit, separate secret management, hashing of verification codes and device authentication tokens, multi-factor access for administrators, rate limits and bot protection, security updates, log minimization, and backup and recovery testing. We use Paddle-hosted checkout so payment-card information does not pass through LUCAMOTIVE servers.
11. Children
The Services are not directed to children under 14, and we do not intentionally create an account for a child under 14 without legally required parental consent. If we learn that such an account exists, we will take appropriate steps to verify consent or delete the data.
12. Contact
- Privacy contact: LUCAMOTIVE Privacy
- Email: support@lucamotive.com
13. Changes
We may update this Policy when laws, providers, or the Services change. We will give advance notice of material changes through the website or account email, and obtain consent before new processing where required. Prior versions and their effective dates will remain available.
Organization administrators can see member email addresses, roles, product license assignments and invitation status. They do not receive per-device usage or project activity. Invitation emails and token hashes support acceptance, expiry, cancellation and abuse prevention. The organization owner manages that organization’s orders and receipts.