1. Who collects your data, and what this covers
Your data is collected by 悠藍微光有限公司 (Tax ID 62148730), the operator of Yuralume Cloud. Our support email (danny@yuralume.com) and the full disclosure are on the Merchant and support information page. This policy covers the notification form on yuralume.com, the Hosted demo, the Yuralume Cloud account center, and the live Hosted service.
If you deploy Self-host Core yourself, you manage your own database, characters, memories, and model keys by default. Unless you deliberately connect Cloud features or a third-party provider, Yuralume Cloud does not receive your character content simply because you run Self-host.
2. Why we collect data, and what kinds
| Situation | Data that may be involved | Purpose |
|---|---|---|
| OAuth sign-in | Discord / Google identifier, display name, email address, avatar, sign-in records | Creating your account, verifying who you are, keeping sign-in secure |
| Hosted service | Character settings, chats, memories, schedules, generation requests, usage and error records | Providing the AI character service you asked for, debugging, and running the service securely |
| Orders and payments | Order number, product, amount, payment status, payment provider transaction ID, refund and dispute records | Delivering the service, reconciliation, refunds, fraud prevention, statutory accounting |
| Lumes (closed-loop AI credits) | Paid and gifted balance, and records of Lumes granted, held, spent, refunded, and expired | Metering, showing your balance, resolving disputes |
| Support and security | What you write to us, IP address, device / browser information, audit and anti-abuse events | Answering complaints, protecting your account and the service |
| Arriving through a promotional link | The utm parameters in the address (utm_source, utm_medium, utm_campaign, utm_content), ref, and the page you landed on | Measuring how each promotional channel performs |
3. How long we keep personal data, where it is processed, who receives it, and how
- How long: only as long as the purposes above require. After your account is deleted or the contract ends, anything still needed for the law, accounting, dispute handling, or backup rotation is kept for the necessary period, then deleted or de-identified.
- Where: we operate mainly in Taiwan. When we use OAuth, cloud infrastructure, email, payment, or AI providers, your data may be processed in the regions where those services run.
- Who: Yuralume's operations staff, plus the service providers we need in order to complete sign-in, send email, collect payments, host, monitor, or deliver the AI capabilities you request. Where the law requires it, we may also provide data to the competent authority or a court.
- How: through automated systems, the human support that is genuinely needed, and security checks. Yuralume does not sell personal data, and does not hand private character content to third parties for advertising unrelated to delivering the service.
Payment is processed by an authorised third-party payment service provider, which receives only the order and payment data needed to complete the transaction. The main categories of service provider we rely on are as described in this section.
4. Browser storage and third-party sign-in
The site may use necessary cookies, localStorage, or sessionStorage to keep your sign-in state, language, OAuth PKCE verification data, and CSRF / security state. If you turn that necessary storage off, sign-in and account features may stop working; purely public pages can still be read.
Alongside that necessary storage there is one non-essential entry, for marketing attribution: if you arrive through a promotional link carrying utm parameters or ref, we keep that first visit's parameters and landing path in your browser's localStorage for 30 days, purely to measure how the channel performed. It is never created if you did not arrive through such a link, clearing your browser storage removes it, and its absence has no effect on sign-in, purchases, refunds, or any part of the service.
Discord, Google, payment providers, and any AI provider you choose handle the data sent to them under their own policies. Yuralume only sends what the feature you chose needs, and limits how it may be used through service settings and contract terms.
5. Your rights, and how to exercise them
Under Taiwan's Personal Data Protection Act you may ask to look up or review your data, receive a copy, have it supplemented or corrected, stop its collection, processing, or use, and have it deleted. The account center offers data export and deletion where available; you can also send a request through our support channels.
When you delete a single AI character, that character's active data (its settings, chat, memory, and schedule) and media files are deleted; generation-usage and accounting/audit records are kept for the necessary retention period under the accounting and dispute-handling exception described above.
To stop someone acting in your name, we may need to verify your identity in a reasonable way. If data must still be kept for accounting, a dispute, a security incident, or another statutory obligation, we will explain why and when it will be deleted.
6. Whether you have to provide data, and what happens if you don't
Without the account, contact, and order data the Hosted service needs, you may not be able to sign in, complete payment, receive the service, get a refund, or have a complaint handled. Optional character details only affect the personalized features built on them.
7. Security, minors and updates to this policy
We apply access controls, transport protection, auditing, backups, and incident handling proportionate to how sensitive the data is. If an incident could affect your rights, we assess it, act on it, and notify as the law requires.
Minors need their legal representative's consent before using paid services. We announce material changes on the site and notify users who have given us contact details before those changes take effect. We do not treat continued browsing as consent to using your data in ways unrelated to the original purpose.