Privacy policy

Last updated November 1, 2026

lukat.me makes AI pictures, videos and ads for businesses and, when you connect your accounts, posts them to Instagram, Facebook and TikTok. It is run by Premium P.I.H Holdings Ltd (company no. 520040403, Israel), the controller of your personal data. This policy explains what we collect, why, who helps us, and your rights. Questions: privacy@lukat.me.

What we collect

Your account: name, WhatsApp number, email if you add it, your picture if you add one, sign-in codes (we keep no passwords for code sign-in), and your settings.
What you send and make: your messages with Alfred (on lukat.me and on WhatsApp), voice notes, photos, videos, logos, product details, web pages you ask us to read, and everything we make for you, with your approvals and edits.
Faces and voices: photos, videos and recordings of people (you, or people you upload) and the presenters you create from them. These can be sensitive (biometric) information; see “Faces, voices and presenters” below.
Connected accounts: when you connect Instagram, Facebook or TikTok: access tokens, account and page names and IDs, and post results (views, reach, engagement) needed to publish and report on your posts. We don’t read your private messages.
Credits and payments: your plan, credits, purchases and invoices. Hyp and Max process the payment and your card details; we never see or keep your card number.
Proof and security: when you accept our terms we keep the version, time, and your IP address and browser (or WhatsApp number). We also keep basic logs (IP address, browser, times) to keep lukat.me secure and working.
Early-access list: your email, only to tell you when your spot opens.

Why we use it, and on what basis

To provide lukat.me (making what you ask, posting what you approve, showing results, billing, support): because it’s needed for our contract with you.
Faces and voices in what you upload, to make the content and presenters you ask for: with the consent you give when you accept our terms and upload, and the consent you confirm you have from the people shown. You can withdraw it by deleting the content or presenter.
To keep lukat.me safe and lawful (preventing fraud and abuse, checking content against our policies, keeping records, answering authorities): for our legitimate interests and legal obligations.
To improve lukat.me, only with “Improve lukat.me for everyone” on (see below).
Messages from us: service messages always; marketing messages and Alfred’s morning ideas only as the law allows, and you can stop them at any time (for ideas, tap “Stop ideas” under any idea).

We don’t sell your personal data, and we don’t use it for advertising or share it with advertisers.

Faces, voices and presenters

We use faces and voices only to make the content and presenters you ask for. We don’t use them to recognise or identify anyone, and we don’t sell them.
A presenter you create (its studio portrait, character sheet and voice) is kept in your account until you delete it or your account, so you can keep using it. We never use it, or anyone’s face or voice from your content, to make anything for another customer.
Under Israel’s Privacy Protection Law and similar laws, this can be sensitive information: you may ask us at any time to delete it, and we will.

People in your content

If you upload photos, videos or voices of other people, you’re responsible for having their consent and telling them about it, as our Terms require. Anyone who appears in content made with lukat.me, with or without an account, can ask us to remove it at privacy@lukat.me or legal@lukat.me.

Improving lukat.me for everyone

If “Improve lukat.me for everyone” is on (Preferences › Data controls on user.lukat.me, where you can turn it off at any time), we may use what you make and send on lukat.me, such as your messages to Alfred, the photos and videos you send and what you approve or reject, to improve the service and to train the AI models behind it. Before we use it we take steps to protect your privacy: we remove your name, phone number and email, we never use your connected accounts’ logins or tokens, and we never sell it or use it for advertising. Turning it off stops your new content from being used from then on.

Who helps us (processors)

These companies process data for us, only to provide their part of lukat.me, under contracts that protect it:

Vercel (website hosting, and AI Gateway, which passes prompts, pictures and videos to AI model providers such as Google and OpenAI to return results).
Kie.ai (video generation), HeyGen (presenter video), ElevenLabs (voice).
Meta (WhatsApp, Instagram, Facebook) and TikTok, when you message Alfred or connect and publish to those accounts; their own privacy policies also apply.
Hyp and Max (card payments), Google (Google Photos, only when you connect it), Serper (searching the web for pictures you ask for), Resend (email), Cloudflare (encrypted backup storage).

We may also share data when the law requires it, to protect people’s rights and safety, or with a buyer of our business, who would be bound by this policy.

Where your data is

Your data is kept on our own server in Israel, with backups at Cloudflare. Some processors are in the United States, the EU and elsewhere. When data leaves Israel or the EU, we rely on adequacy decisions, the EU Standard Contractual Clauses or similar safeguards.

How long we keep it

Your account, content and presenters: while your account is open, until you delete them.
After you delete your account (or a piece of content): removed from our live systems within 30 days, and from our backups within 60 days.
Payment and invoice records: as long as tax and accounting law requires (in Israel, generally 7 years). Records of accepted terms and of complaints: as long as needed to show what was agreed or to defend a claim.

Your rights

Depending on where you live (including under Israel’s Privacy Protection Law, the EU and UK GDPR and US state laws), you can ask to see, correct, delete or get a copy of your data, object to or limit how we use it, and withdraw consent. Email privacy@lukat.me from your account’s email or WhatsApp number; we answer within 30 days. You can also complain to your data protection authority, in Israel the Privacy Protection Authority. To delete everything, see data deletion.

Children

lukat.me is for people 18 and over. We don’t knowingly collect data from children who use it. Images of minors may be uploaded only by their parent or guardian or with their written consent, as our Terms require; a parent can ask us to delete them at any time.

Cookies

We use only the cookies needed to keep you signed in and lukat.me working. We don’t use advertising or tracking cookies.

Security

Our server is reachable only through signed requests from the lukat.me website; access tokens stay on the server and are never shown in the browser; backups are encrypted. No system is perfectly secure; if a breach affects you, we’ll tell you and the authorities as the law requires.

Changes

We’ll tell you before important changes to this policy take effect, and ask you to accept them where the law requires.

Questions: privacy@lukat.me