Privacy Policy

The controller responsible for processing personal data is:

Email: support@lomar.ai

Lomar is an iOS app and web service for creating brand DNA profiles, product visuals, campaign drafts, platform-ready advertising concepts, and scheduled social posts. When you submit a URL, product link, image, prompt, or other material, Lomar processes it to provide the feature you requested.

Lomar may retrieve and analyze publicly reachable website and product information on your instruction. We do not ask you to submit private, login-only, confidential, sensitive, or unlawfully obtained material. We do not build a resale database of third-party website content, and we do not claim ownership over third-party brands or materials.

• We process personal data only where there is a lawful basis under Article 6 GDPR.
• We limit processing to what is needed to operate, secure, and improve Lomar and to provide requested features.
• Generated outputs are creative drafts. You are responsible for checking legal, brand, platform, and advertising compliance before publication.
• Do not submit special category data, confidential third-party data, private documents, or personal data that you are not allowed to use.

• App features and account-related services: performance of a contract or pre-contractual steps under Art. 6(1)(b) GDPR.
• Connecting an Instagram, Facebook, Threads, TikTok, Pinterest, or LinkedIn account and publishing content you explicitly approve: performance of the requested service under Art. 6(1)(b) GDPR. This starts only when you connect an account. It is not a cookie. You can disconnect in Lomar, revoke access in the relevant platform's settings, or email support@lomar.ai to request deletion of Lomar's stored connection. We also honour valid platform deletion requests.
• Connecting an AI assistant to your account through the Lomar MCP server and running the tools it calls on your request: performance of the requested service under Art. 6(1)(b) GDPR. This starts only when you sign in and allow access, and you can revoke it at any time.
• Brand scans, URL analysis, and product analysis requested by you: performance of the requested service under Art. 6(1)(b) GDPR where the data concerns you or your account; legitimate interests under Art. 6(1)(f) GDPR where limited public information is processed to provide the requested service functionality.
• Sharing submitted content with third-party AI services in the iOS app: your explicit consent under Art. 6(1)(a) GDPR. Lomar asks before the first transfer. You can decline and can later withdraw permission in Profile > Preferences. Withdrawal stops future AI transfers and does not affect the lawfulness of processing completed before withdrawal.
• Strictly necessary cookies and local storage (login, security, consent record, theme, checkout): Art. 6(1)(b) GDPR and TDDDG § 25(2) where they are essential to provide the service you request.
• Optional Google Ads and Meta Pixel conversion cookies and similar marketing storage: your consent under Art. 6(1)(a) GDPR and TDDDG § 25(1). They are off until you choose Allow. You may reject them as easily as allowing them, and withdraw later via Cookies in the footer.
• Security, abuse prevention, debugging, fraud prevention, and service stability: legitimate interests under Art. 6(1)(f) GDPR.
• Billing, tax, accounting, and responses to lawful requests: legal obligations under Art. 6(1)(c) GDPR.
• Subscription administration, entitlement status, receipt validation, purchase restoration, and related customer support: performance of the contract under Art. 6(1)(b) GDPR. Fraud prevention, service reliability, and aggregate subscription and purchase analytics are based on our legitimate interests under Art. 6(1)(f) GDPR.

• Account and contact data, such as email address and user identifiers, if account features are used.
• Social-platform connection data for accounts you connect, such as account, page, or board identifiers, display names, usernames, profile images, granted permissions, encrypted access and refresh tokens, and token expiry. For posts you approve, we process the selected destination, creative, caption, title, description or link where applicable, scheduled publication time, and publication status.
• Support data, such as messages you send to support@lomar.ai.
• Submitted content, such as prompts, URLs, product links, uploaded images, product photos, and generated drafts.
• Public website or product information retrieved when you submit a URL for analysis, such as page text, metadata, brand colors, product descriptions, and publicly visible media references.
• Transaction-related data for subscriptions, credits, or purchases, such as products, purchase and subscription status, transaction or receipt information, entitlement status, timestamps, and renewal, cancellation, refund, or restoration events. Apple handles App Store payments and Stripe handles web payments; Lomar does not store full payment card numbers.
• RevenueCat subscription data, including a pseudonymous Lomar account identifier (the Supabase user UUID), purchase and subscription history, product and entitlement information, locale and currency, and limited device, app-version, connection, and last-seen information. Because Lomar uses its own account identifier, this information is linked to your account. Lomar does not send your prompts, Brand DNA, uploaded images, name, or email address to RevenueCat through this integration.
• Device, usage, and technical data, such as device type, operating system version, timestamps, error logs, and security logs.
• Cookie and similar identifiers described in section 16, including a stored consent record and, only after opt-in, Google Ads conversion identifiers.

Lomar does not send submitted content to a third-party AI service until you give explicit permission in the iOS app. The consent screen appears before the first AI-powered brand scan or generation and identifies the data and recipients below. If you decline, the transfer does not occur and the AI-powered feature does not start.

• Data that may be sent: prompts and campaign directions; website and product URLs; public page text, metadata, product descriptions, Brand DNA, and creative settings; photos you select or upload; and relevant logos, product images, or website references.
• Muse Spark (Meta): receives the relevant prompts, extracted brand or product text, creative settings, and relevant images needed for text analysis, creative planning, and generating the images you request.
• Google AI: receives the relevant prompts and extracted brand or product text for text analysis and creative planning only from iOS app versions released before October 8, 2026, until you update the app.
• Microlink and Jina AI Reader: receive a URL only when you ask Lomar to retrieve and analyze a public website or product page. They return rendered metadata, screenshots, or readable public page content used for the requested Brand DNA workflow.
• Supabase: receives requests as Lomar's backend processor and secure relay and also provides authentication, database, and storage services. Lomar account identifiers are used by the backend for authentication and owner-scoped storage, but are not intentionally added to Muse Spark or Google AI prompts.

Lomar uses this material only to provide the feature you request, operate safety and abuse controls, and return the result. Lomar does not sell submitted content or use it for advertising. Do not submit special-category, confidential, sensitive, or third-party personal data. Generated output may be inaccurate, similar to existing creative work, or unsuitable for a particular campaign, and you must review it before use.

Information being publicly accessible does not mean that all uses are unrestricted. Lomar is designed to create transformative creative drafts from public brand signals and user-provided material. You must not use Lomar to copy protected third-party assets, impersonate another brand, mislead users, bypass access restrictions, or violate intellectual property, privacy, publicity, platform, or advertising rules.

The service providers relevant to Lomar's current services are Supabase (hosting, authentication, database, storage, and Edge Functions), Muse Spark by Meta (AI text processing, creative planning, and image generation), Google AI (AI text processing in iOS app versions released before October 8, 2026), Microlink (URL metadata and screenshot retrieval), Jina AI Reader, now governed by Elastic's processing terms (URL-to-readable-content retrieval), and RevenueCat (subscription infrastructure, receipt and entitlement processing, purchase restoration, customer history, and subscription analytics). Apple processes App Store purchase and subscription data and Stripe processes web payments under their respective terms and privacy notices. If you allow marketing cookies, Google Ireland Limited / Google LLC receives conversion-measurement data through Google Ads. Meta Platforms Ireland Limited / Meta Platforms, Inc. also receives website event data through the Meta Pixel, as described in section 16.

RevenueCat receives the pseudonymous Lomar account identifier described above and the subscription, purchase, entitlement, and limited technical information needed to provide these functions. RevenueCat acts as a processor for this information under its data processing terms. It does not receive Lomar creative content through the RevenueCat integration and is not used by Lomar for third-party advertising or cross-app tracking.

Instagram, Facebook, and Threads (Meta). When you connect one of these services, Lomar uses the relevant Meta API to obtain the profile or Page information and permissions needed for publishing. Facebook publishing is limited to Pages you manage; Threads publishing uses the profile you authorize. When you schedule a post, Lomar sends the approved creative, text, destination, and publication settings to the selected service. Meta Platforms Ireland Limited (EEA/UK) or Meta Platforms, Inc. independently processes this information under Meta's terms and privacy policy.

TikTok. When you connect TikTok, Lomar uses TikTok's Login Kit and Content Posting API with the permissions user.info.basic, video.upload and video.publish to identify your account and read the posting options TikTok allows for it, such as available privacy levels. When you schedule a post, Lomar sends the approved media, caption, title, chosen privacy level, comment setting and AI-generated-content label to TikTok and checks the publishing status. TikTok Technology Limited (EEA/UK) processes this information under TikTok's terms and privacy policy.

Pinterest. When you connect Pinterest, Lomar uses Pinterest's API to identify your account and available boards. When you schedule a Pin, Lomar sends the approved image, selected board, title, description, and optional destination link to Pinterest. Pinterest processes this information under its terms and privacy policy.

LinkedIn. When you connect LinkedIn, Lomar uses LinkedIn's API to identify the member profile you authorize. When you schedule a post, Lomar sends the approved image and text to that profile. Company Page publishing is not currently included. LinkedIn processes this information under its terms and privacy policy.

Lomar stores the access tokens needed for user-directed scheduled publishing in encrypted form and does not receive your social-platform passwords. We do not sell connection data or use it for independent advertising. You can disconnect each account in Lomar to stop future publishing.

Connected AI apps (MCP). You can connect an AI assistant, such as Claude (Anthropic) or Codex (OpenAI), to your Lomar account through the Lomar MCP server. The assistant gets access only after you sign in to Lomar and select Allow access, and only while you have an active Lomar subscription, which is checked on every request. It then receives what the tools it calls on your request return: your Brand DNA kits, your Library images with download links that expire after one hour, your Planner posts and social-account connection status, and the results of actions such as generating an image or scheduling a post. Lomar receives the tool inputs the assistant sends, such as prompts, titles, captions, publication times, and reference image URLs, and processes them as it would the same input in the Lomar app. Lomar does not receive your conversations with the assistant. The assistant's provider processes the data it receives from Lomar under its own terms and privacy policy. You can review and revoke connected AI apps at any time under Profile > Connected AI apps or at www.lomar.ai/oauth/connections.

Lomar requires processors that handle personal data on our behalf to provide the same or equivalent protection described in this policy and required by applicable law. Where required, they are bound by data processing agreements under Art. 28 GDPR, confidentiality and security obligations, purpose limitations, deletion or return duties, and appropriate international-transfer safeguards. We otherwise share personal data only where necessary to provide the service and you have consented, where required by law, or where necessary to establish, exercise, or defend legal claims.

Some providers may process data outside the European Economic Area. Where required, we use appropriate safeguards such as EU Standard Contractual Clauses, adequacy decisions, or other lawful transfer mechanisms.

RevenueCat, Inc. is based in the United States and uses subprocessors in the United States and other locations. Where applicable, transfers are governed by RevenueCat's data processing addendum and EU Standard Contractual Clauses or another valid transfer mechanism.

Meta, Pinterest, LinkedIn, and, if you allow marketing cookies, Google may process data in the United States and other countries. Those transfers follow the safeguards those providers publish, including Standard Contractual Clauses where required.

We keep personal data only as long as needed for the purposes described above, unless longer retention is required by law. Account and submitted content may be kept while your account or project exists. Technical logs are generally kept for a limited period needed for security, debugging, and abuse prevention. Accounting and transaction records may be retained as required by commercial and tax law.

Social-platform tokens are retained while the account remains connected and are encrypted at rest. Scheduled-post records and delivery status are retained while needed to provide the planner, document publication, resolve delivery errors, or meet legal obligations. Revoking platform access prevents future publishing; related records are deleted or anonymized when no longer needed. Cookie consent records are kept for up to 12 months, after which we ask again.

Connected AI app grants and their access tokens are kept until you revoke the app, the tokens expire, or you delete your account. Revoking an app stops all further access through it.

AI, URL-processing, and subscription infrastructure providers may retain request, customer, transaction, generated-media, and limited technical data for the periods needed to provide their service, maintain security, prevent abuse, resolve billing issues, or meet legal obligations, subject to their processing terms. Provider-hosted generated media may remain available for a limited provider-controlled period. Contact support@lomar.ai to request deletion of data held by Lomar and, where applicable, deletion assistance with its processors. Some transaction records may need to be retained where required by accounting, tax, fraud-prevention, or other law.

Where the GDPR applies, you may have the right to request access, rectification, erasure, restriction of processing, data portability, and objection to processing based on legitimate interests. Where processing is based on consent, you may withdraw consent at any time with effect for the future.

To exercise your rights, contact support@lomar.ai. We may need enough information to verify your identity and locate the relevant data.

You can withdraw optional cookie consent at any time via Cookies in the website footer, with effect for the future. In the iOS app, you can also withdraw permission for future AI transfers at any time under Profile > Preferences > AI data sharing. Turning it off prevents all protected AI endpoints from receiving new content until you explicitly allow processing again.

You have the right to lodge a complaint with a data protection authority. Our establishment is in Germany; the competent authority for North Rhine-Westphalia is the Landesbeauftragte für Datenschutz und Informationsfreiheit Nordrhein-Westfalen (LDI NRW). A list of EU supervisory authorities is available from the European Data Protection Board.

Some data is required to provide Lomar's requested features. If you do not provide a URL, image, prompt, account detail, or transaction information that is necessary for a feature, we may not be able to provide that feature. Optional cookies are not required to use Lomar. Connecting a social account is optional and needed only when you want Planner to publish to that account for you.

We do not use solely automated decision-making, including profiling, that produces legal effects concerning you or similarly significantly affects you within the meaning of Article 22 GDPR, unless we introduce a separately disclosed mechanism in the future.

Lomar does not sell personal data. We do not share social-platform connection data with third parties for their independent advertising. Optional advertising cookies, if allowed, are used for Lomar advertising and measurement.

This website uses cookies and similar storage (local storage and session storage). Under TDDDG § 25, non-essential storage is used only after consent. The banner lets you reject optional cookies as easily as allowing them. Your choice is stored locally for up to 12 months.

Necessary (always on). These are required to provide the site you asked for: authentication and session (Supabase), security, the cookie-consent record itself, appearance (theme), checkout return state, and Stripe payment fields when you pay. They are not used for advertising.

Marketing (off until you allow). Advertising cookies from Google Ireland Limited / Google LLC (Google Ads, measurement ID AW-17776729325). If you allow them, Google may set cookies such as click and conversion identifiers for Lomar advertising and measurement. They are not loaded, and Consent Mode stays denied, until you choose Allow. Rejecting them does not block the product. Meta Pixel (Meta Platforms Ireland Limited / Meta Platforms, Inc., website dataset 1113689631167622) measures page views, account registration, checkout starts, confirmed trial activation and paid checkout completion. Meta may receive the website URL, browser/device information, IP address, event time and advertising cookie identifiers such as _fbp and _fbc. We do not enable automatic advanced matching or send your name, email address, creative content or Stripe checkout tokens through this integration. The Meta Pixel loads only after Allow; withdrawing consent stops future events and removes its first-party cookies where accessible. Advertising event deduplication records are stored locally to avoid counting the same registration or checkout repeatedly.

Not cookies. Connecting a social account for Planner scheduling is an account connection you start yourself. Brand Kit may load a typeface from Google Fonts only when you preview that kit, so the chosen font can render. Extra advertising tools stay off until you allow optional cookies.

We may update this Privacy Policy when our practices, providers, features, or legal requirements change. The version published on this page is the current version. A material change to optional cookies will reset the banner so we can ask again.