Luma Dream Machine

Luma explicitly trains AI models on user input and output. For free users, the license grants rights to 'create, test, improve, train, or otherwise develop' AI models. For paid users, similar training rights are retained. No opt-out mechanism exists; training is a core business practice.

“[ToS] 'create, test, improve, train, or otherwise develop the artificial intelligence or machine learning models, systems, architecture, weights or related technology used by Luma in connection with the Services' (applies to both paid and free tiers)”

Luma claims perpetual, irrevocable, worldwide, sublicensable rights to user input and output. For free users, the license is exceptionally broad, including rights to 'publicly display, publicly perform, create derivative works, and distribute' content. For paid users, rights are somewhat narrower but still perpetual and irrevocable with respect to content reflected in outputs or aggregated data.

“[ToS] 'During Free Use: worldwide, non-exclusive, irrevocable, royalty-free, fully paid right and license (with the right to sublicense through multiple tiers) to host, store, transfer, publicly display, publicly perform...create derivative works, and distribute Input...in whole or in part, in any media formats'”

Luma shares personal information with service providers and professional advisors under Data Processing Agreements, but the Privacy Policy lacks specificity on sub-processor lists or detailed sharing restrictions. Usage Data and Aggregated Data are owned by Luma and can be used for lawful business purposes. Third-party sharing for advertising is mentioned but controls are vague.

“[Privacy] 'We may share your personal information with third party companies and individuals that provide services on our behalf' and '[ToS] Luma owns and retains all right, title, and interest...in and to the Aggregated Data and Usage Data'”

Retention periods are vague and discretionary. The ToS states Luma has 'no responsibility or liability for the deletion or failure to store any Input or Output' and can change retention limits 'at any time, in its sole discretion, with or without notice.' The Privacy Policy mentions deletion 'when no longer necessary' but provides no specific timelines.

“[ToS] 'Luma has no responsibility or liability for the deletion or failure to store any Input or Output maintained or used in connection with the Services. You further acknowledge that Luma AI reserves the right to change these general practices and limits at any time, in its sole discretion, with or without notice.'”

While Luma assigns output ownership to the customer, significant caveats apply. Luma retains perpetual, irrevocable rights to use outputs for training, improvement, and derivative works. Outputs may not be unique or exclusive, and customers may not be able to secure IP rights in all jurisdictions. The assignment is qualified and limited.

“[ToS] 'Customer owns and retains all right, title, and interest in and to the Output and Luma hereby assigns to Customer all of Luma's right, title, and interest in and to the Output' BUT 'Customer acknowledges and agrees that it can only use the Outputs for commercial purposes if the Outputs were produced during an active Subscription Term under Customer's paid subscription'”

No compliance certifications (SOC 2, ISO 27001, GDPR, HIPAA) are mentioned in either document. The ToS explicitly disclaims HIPAA compliance and states 'Luma is not a Business Associate as defined under HIPAA.' No security documentation, trust page, or DPA is referenced.

“[ToS] 'Customer acknowledges that the Services are not intended to meet any legal obligations for these uses, including HIPAA requirements, and that Luma is not a Business Associate as defined under HIPAA.'”