LuminaOS Privacy Policy
This policy explains how Chengdu Hotack Technology Co., Ltd. ("Hotack", "we") processes personal data when you use the Lumina services: on a projector running LuminaOS, on a projector with the Whale TV home screen that includes Lumina services, and in the Lumina apps. It is written for users outside mainland China and gives the information required by the EU and UK General Data Protection Regulation (GDPR) and by US state privacy laws. The separate EU Data Act Information describes the data the product and its connected services generate and how you can access and share it.
- Who we are and how to contact us
- Services covered
- Our principles
- What we process, why, and on what legal basis
- What we do not do
- Who receives data
- Projectors with the Whale TV home screen
- Where data is stored and international transfers
- How long we keep data
- Your choices and controls
- Your rights
- Children
- Security
- Additional information for US residents
- Changes to this policy
1. Who we are and how to contact us
| Controller | Chengdu Hotack Technology Co., Ltd. (成都市和天创科技股份有限公司) |
|---|---|
| Address | 16F, Building 2, No. 979 Jinfenghuang Avenue, Jinniu District, Chengdu, Sichuan [postcode], People's Republic of China [confirm against business licence] |
| Privacy contact | privacy@luminago.app |
| EU representative (GDPR Art. 27) | [name and address of appointed EU representative] |
| UK representative | [if sold in the UK] |
If your projector was sold under another brand, that brand is the seller and distributor. Hotack remains the controller for the Lumina services listed in Section 2. If the brand provides services of its own, it informs you separately.
2. Services covered
| Service | What it is | Online? |
|---|---|---|
| LuminaOS system services | Software updates (OTA), setup wizard, Settings › Privacy, help and manual pages, device activation | Yes |
| Lumina App Store | Installing and updating apps on projectors with the LuminaOS home screen (not on Whale TV projectors, see Section 7) | Yes |
| Diagnostics and Lumina Manager | "Report a problem", network test, security check, cleaning tools | Only when you use them |
| LuminaVoice | Voice search and voice commands with the remote's voice button | Yes, while you press the voice button |
| Lumina Go | Phone remote control app (Android, iOS, HarmonyOS), the receiver on the projector, and the optional voice-assistant cloud link (Amazon Alexa, Google Home) | Partly; the cloud link is optional |
| LuminaLink (LuminaCast) | Screen mirroring receiver (AirPlay, DLNA, LuminaLink protocol) | Local network only |
| LuminaAura (LuminaWall) | Ambient screen with photos, clock and optional weather | Only for weather and artwork |
| LuminaHome | Home screen with movie and series discovery (on models that include it) | Yes |
| Lumina Files | File manager and media player for USB drives and network shares | Local network only |
| Remote assistance helpers | Accessibility helpers that let the remote control streaming apps | No |
Pre-installed third-party apps (for example Google Play, YouTube, Netflix, Office, or the Whale TV home screen and store) are not covered. See Third-Party Services and Section 7.
3. Our principles
- The projector works offline. You can use it as a projector, with USB media and local screen mirroring, without connecting it to the internet.
- One consent record, by purpose. Every optional data flow belongs to one of eight purposes (Section 10). Each purpose has its own switch in Settings › Privacy, is off until you turn it on, and stops at once when you turn it off. Lumina components do not keep consent records of their own.
- Only what a service needs. Each online feature sends only the data listed in Section 4 for that feature.
- Pseudonymous identifiers. Our services identify the projector with a random installation ID that you can reset, and a one-way hash of the serial number used only for software updates and warranty. The Wi-Fi and Bluetooth MAC addresses never leave the projector. FIX-01 FIX-02 FIX-08
- Encrypted connections. All connections to our servers use HTTPS/TLS. Requests are signed with a key generated on the projector. FIX-01 FIX-02 FIX-16
- European data stays in Europe. For users in the EEA, the UK and Switzerland, our services run in a data centre in Frankfurt, Germany. FIX-10 FIX-11
4. What we process, why, and on what legal basis
The legal bases are those of GDPR Art. 6(1): (b) contract: needed to provide the product or a service you asked for; (a) consent: you can withdraw it at any time; (c) legal obligation; (f) legitimate interests: you can object (Section 11). The purpose names in brackets are the switches you see in Settings › Privacy.
4.1 Software updates (OTA) [essential]
| Data | One-way hashed serial number, installation ID, model, firmware version, sales channel code, result of the last update; IP address (technical) |
|---|---|
| When | Once after start-up when the network is available, then about once a day, and when you select "Check for updates" FIX-01 |
| Why | To find and deliver the correct security and software updates for your exact model and production batch, and to stop updates going to the wrong hardware |
| Legal basis | Contract (Art. 6(1)(b)); legal obligation to provide security updates for the support period (Art. 6(1)(c)); legitimate interest in product safety (Art. 6(1)(f)) |
| Not dependent on consent | Update checks run whether or not you accept the optional purposes in the setup wizard, because security updates must reach every device. You can stop them only by disconnecting from the internet. Our servers cannot restart the projector or run commands on it. FIX-01 |
4.2 Device activation and warranty record [essential]
| Data | Chip ID, serial number, DRM certificate request, IP address, date of first connection |
|---|---|
| When | Once, the first time the projector connects to the internet (retried for up to 7 days if it fails) FIX-14 |
| Why | To confirm that the device is genuine, to register its DRM certificate so that licensed streaming apps can play HD content (Google Widevine), and to handle warranty claims |
| Legal basis | Contract (Art. 6(1)(b)); legitimate interest in preventing counterfeits (Art. 6(1)(f)) |
4.3 Lumina App Store [essential] (LuminaOS home screen only)
| Data | Sales channel code, model, firmware version, store version, installation ID; to find updates: package names and versions of installed apps that are offered in the App Store; when you install an app: package name, version and size FIX-02 |
|---|---|
| When | When you open the store; once after start-up to check the store licence and app updates; after each installation |
| Why | To show apps compatible with your model and region, to deliver app updates, to check that the store licence is valid for this device, and to count downloads |
| Automatic installs | Apps are installed or updated in the background only if you allow automatic updates. The only exception is updates to Hotack system components that fix security problems. The store does not remove apps you installed. FIX-02 |
| Not collected | How you use apps, what you watch |
| Legal basis | Contract (Art. 6(1)(b)); download statistics: legitimate interest (Art. 6(1)(f)) |
4.4 Setup, settings, help pages and the consent record [essential]
The setup wizard stores your language, region, network and privacy choices on the projector. Help pages, manuals and the FAQ are downloaded from our server when you open them; only the language and the IP address needed to deliver the page are sent. FIX-03 FIX-16
When you accept or withdraw an optional purpose, the projector records the purpose, the policy version, the time and the screen where you made the choice, and sends this consent receipt (with the installation ID) to our server so that we can prove that consent was given, as GDPR Art. 7(1) requires. Legal basis: legal obligation and legitimate interest (Art. 6(1)(c), (f)).
4.5 Diagnostics: "Report a problem" [diagnostics]
| Data | A full Android diagnostic report. It contains system and app logs, device state, the list of installed apps, the Wi-Fi network name and router identifier, local IP address, names of paired Bluetooth devices, the serial number and, if the security check is on, recent website domains looked up by the device. We also receive the installation ID, model, firmware version and channel code. If you fill in the web form, we also receive your problem description and, if you give them, your name and email address. From the IP address we derive your country, region and city. FIX-04 |
|---|---|
| When | Only after you open "Report a problem", read the notice listing the contents and select "Agree and send". Nothing is sent before you agree, including when you retry with the QR code. FIX-04 |
| Why | To investigate and fix the problem you reported and to improve product quality |
| Automated analysis | Reports may be analysed with the help of AI language-model services that work for us under contract (Section 6). These services do not make decisions about you and may not use the data to train their models. FIX-04 |
| After upload | You receive a ticket number. With it you can ask us to delete the report before the 30-day retention period ends. |
| Legal basis | Consent (Art. 6(1)(a)) |
4.6 Lumina Manager tools [security_scan]
- Network test runs only when you start it. It contacts public test servers to measure connectivity and speed and to find the projector's public IP address. Results stay on the projector.
- Security check keeps, on the projector only, a log of the internet domains contacted by apps, so it can warn you about known malicious sites. The full log is kept for 2 days and warnings for 30 days. It is never uploaded on its own, but it is included in a diagnostic report if you send one. Only the list of risky domains is downloaded, from our server. The security check is on by default and can be switched off in Settings › Privacy. FIX-19
4.7 LuminaVoice [voice_cloud]
| Data | A recording of what you say while you hold the voice button (up to 30 seconds), the recognised text, the names of up to 40 installed apps (so that "open …" commands work), the installation ID, the product model, language and region |
|---|---|
| When | Only while you hold the voice button, and only after you have turned on cloud voice recognition on the first press. There is no always-listening wake word. The screen shows a recording indicator while audio is captured. FIX-10 |
| Processing | Speech recognition, understanding of the command and spoken replies are processed by our LuminaCloud service and its speech and language-model providers (Section 6). Recordings and recognised text are processed in memory and are not stored after the reply. We store only usage counters (time, feature, duration) linked to the installation ID. FIX-11 |
| Improve recognition | A separate switch, off by default, lets us keep recordings for up to 90 days to improve recognition for your language. We do not turn it on for you. |
| Legal basis | Consent (Art. 6(1)(a)) |
4.8 Lumina Go
| Feature | Data | When | Purpose switch · legal basis |
|---|---|---|---|
| Remote control over your home network or Bluetooth | Commands and the projector's state are exchanged directly between phone and projector, after you pair them with the code shown on the projector | While you use it | — · Contract |
| App statistics | Connection result and time, connection type, projector model, app and OS version, a one-way hash of the app's installation ID FIX-07 | When you connect or disconnect, and once a day, after you allow statistics | analytics · Consent |
| Help centre AI assistant | Your questions, the conversation, language, brand; your feedback on answers if you rate them. Questions are not stored together with the installation ID. | When you ask a question, after you accept the assistant notice | ai_assistant · Consent |
| Title search | Search words and region | When you search | — · Contract |
| Voice input in the phone app | Speech is converted to text by your phone's own speech service (Google on Android, Apple on iOS), which may process it in the cloud under its own terms | While you hold the voice button | — · Contract |
| Voice-assistant cloud link (off by default) | The installation ID, an access token, model, supported functions, and the projector's power, volume, mute and input state; the commands you give through Alexa or Google Home. Command content is not written to logs. | Only after you turn on "Cloud link" on the projector. Then a connection stays open, the state is reported about every 5 minutes and after each change, and the projector shows a cloud icon while linked. | cloud_link · Consent and contract |
Turning off the cloud link, or unlinking the projector in the Alexa or Google Home app, deletes the link records on our side immediately; backups are overwritten within 35 days. FIX-06 Features for creating children's stories or cloning a voice are not offered in the EEA, the UK, Switzerland or the United States. FIX-07
4.9 LuminaLink (screen mirroring) [essential]
The projector announces a device name on your local network so that phones and computers can find it. The name is the model plus four random characters, not the serial number. Mirrored audio and video go directly from your device to the projector and are not recorded or sent to us. By default the projector asks you to confirm a new device before it can mirror. FIX-17 LuminaLink uses no Hotack cloud service. Android requires location permission to read the Wi-Fi network name; LuminaLink uses it only for that and does not determine your location.
4.10 LuminaAura [weather_location]
- Your photos and videos are copied from your phone over your home network, or from a USB drive, and stay on the projector. They are never uploaded to us. Face and subject detection for framing photos runs on the projector.
- If you turn weather on, the projector asks our weather service about every 30 minutes. The service uses your IP address to estimate your location to about 5 km and does not store it. With weather off, the ambient screen shows the clock only and no request is made. Weather is off until you turn it on. FIX-09
- Artwork from our catalogue is downloaded from our server. Only the IP address is used.
Legal basis: weather: consent (Art. 6(1)(a)); artwork: contract (Art. 6(1)(b)).
4.11 LuminaHome
| Home screen configuration [essential] | Installation ID, partner/brand code, model, country, language, app version and IP address. Each time the home screen starts, it asks our server for the right content layout and rows for your region. The request is sent only after the first-start notice. FIX-08 |
|---|---|
| Search and discovery [essential] | Search words you type, and the title and region when you open a title. These are sent to our content service and to movie-database providers (TMDB, Watchmode, Streaming Availability) to find titles and the services where they are available. |
| Usage statistics [analytics] | If you allow statistics, the app sends usage events (app opened, row or platform selected, search used with length of the query only, theme changed) and crash reports to Google Firebase. Off by default. FIX-08 |
| Legal basis | Configuration and search: contract (Art. 6(1)(b)). Statistics and crash reports: consent (Art. 6(1)(a)). |
4.12 Lumina Files
Lumina Files reads media on USB drives and on network shares you add. Share addresses and login details are stored only on the projector, in encrypted form. FIX-18 Nothing is sent to us.
4.13 Remote assistance helpers
To let the remote's buttons control some streaming apps (Netflix, YouTube), an Android accessibility service, switched on at the factory, reads the on-screen controls of those apps only while the app is in the foreground. It can see the keys you press. It has no internet access and stores nothing. You can switch it off in Settings › Accessibility. FIX-20
4.14 Music player
When you play a song that has no lyrics file, the built-in music player can look up lyrics and cover art online. It sends the song title and artist to lyrics services (see Third-Party Services). This is off by default outside mainland China and can be turned on in the player's settings. FIX-21
4.15 Support by email
If you write to us, we use your name, email address, the content of your message and any device details you give us to answer you. Legal basis: contract or legitimate interest.
4.16 Server logs and security
Our servers record technical request data (IP address shortened to the network part, time, requested address, result, and the country derived from the IP) to run the service and to protect it against misuse. We do not log the content of voice requests, assistant questions or commands. FIX-06 FIX-11 Legal basis: legitimate interest (Art. 6(1)(f)).
5. What we do not do
- We do not sell personal data and do not use it for targeted advertising. Lumina services do not use an advertising ID. (The Whale TV home screen has its own advertising settings, see Section 7.)
- There is no always-on microphone. Audio is captured only while you hold the voice button. Models with automatic focus or keystone correction have a small camera that looks at the projected image. Its pictures are processed on the projector, are never stored or sent, and the camera component has no internet access.
- We do not record what you watch, which apps you use, or the content you mirror.
- We do not make decisions about you based solely on automated processing.
- LuminaOS does not include proxy, "bandwidth sharing" or remote-access software. No component lets a third party use your internet connection, and our servers cannot run commands on your projector.
6. Who receives data
We share personal data only with the following categories of recipients. Each is bound by contract to use it only on our instructions (GDPR Art. 28), except where noted.
| Recipient | Role | Data | Location |
|---|---|---|---|
| Tencent Cloud | Hosting of update, app store, diagnostics, help, weather and voice services; storage of diagnostic reports | As in 4.1–4.7, 4.10 | Frankfurt, Germany for users in the EEA, UK and Switzerland FIX-10; Hong Kong SAR and United States for other regions |
| Cloudflare | Hosting of LuminaHome configuration, Lumina Go services, the voice-assistant link and this website | As in 4.8, 4.11 | Global network with EU data localisation for European users [confirm Data Localisation Suite] |
| Google (Firebase) | Optional usage statistics and crash reports for LuminaHome | As in 4.11, only with consent | United States / global |
| Google (Widevine) | DRM certificate registration | Chip ID and certificate request | United States |
| Speech and AI providers: [OpenAI / MiniMax; final list per region] | Speech recognition, command understanding and speech synthesis for LuminaVoice; Lumina Go assistant answers | Recording, text, language | [EU / United States]; zero-retention mode, no training on your data |
| Zhipu AI; Alibaba Cloud (DashScope) | Lumina Go assistant answers to questions asked in Chinese, for users outside the EEA, the UK and Switzerland only | Question and conversation text, language | People's Republic of China FIX-07 |
| AI analysis services used by our support team: [Anthropic / OpenAI] | Help analyse diagnostic reports you sent | Extracts of logs and your problem description | [EU / United States] FIX-04 |
| TMDB, Watchmode, Streaming Availability (RapidAPI); Open-Meteo / MET Norway | Independent providers of film data and weather data | Search words, title, region; coarse location for weather (sent by our server, not by the projector) | United States / EU / Norway |
| Amazon (Alexa), Google (Google Home) | Independent controllers when you link the projector to their assistant | Projector state and commands | Under their own policies |
| Whale TV PTE. LTD. (Zeasn) | Independent controller of the Whale TV home screen on projectors that include it (Section 7) | Serial number, brand and product codes, a consumer ID | Singapore and its own providers |
| Authorities, courts, advisers | Where required by law, or to establish or defend legal claims | As required | — |
7. Projectors with the Whale TV home screen
Some models use the Whale TV home screen and app store from Whale TV PTE. LTD., 6 Raffles Quay #14-02, Singapore 048580 ("Zeasn"). On these models:
- Zeasn is an independent controller for the home screen, the Whale TV app store, recommendations, advertising, usage statistics and the cookie-consent banner. Its Terms of Use and Privacy Policy are shown on first start and can be reopened in the Whale TV settings under "User Agreement" and "Personalisation Service". Hotack does not receive the data Zeasn collects.
- So that the home screen can work, the projector makes the serial number, the brand and product codes and a consumer ID generated on first start available to the Zeasn software on the projector. Zeasn uses them to identify the device for its services and may only use them for that. [Zeasn data-sharing agreement to be signed]
- The Lumina services on the same projector (software updates, LuminaVoice, Lumina Go, LuminaLink, LuminaAura, diagnostics, Settings › Privacy) are provided by Hotack under this policy. Your Lumina choices are separate from your Whale TV choices and are managed in Settings › Privacy.
- Requests about Zeasn's processing that reach us are forwarded to Zeasn within 5 business days, and vice versa.
8. Where data is stored and international transfers
We are established in China. For users in the EEA, the UK and Switzerland, the Lumina services and their data are hosted in Frankfurt, Germany, by Tencent Cloud and Cloudflare, and voice and assistant requests are processed by providers in the EU or in the United States. FIX-10 FIX-11 Data leaves Europe only in these cases: support emails you send us are read by our support team in China; activation and warranty records are kept with our manufacturing records in Hong Kong SAR; diagnostic reports you choose to send may be read by our engineers in China. For these transfers we use the European Commission's Standard Contractual Clauses (2021/914), the UK International Data Transfer Addendum, and additional measures such as encryption and pseudonymisation. [Legal to confirm that SCCs are signed with each recipient and that a transfer impact assessment exists for China] You can ask us for a copy of the safeguards at the contact in Section 1.
For users elsewhere, our services are hosted in Hong Kong SAR and the United States.
9. How long we keep data
A detailed schedule is in Data Retention and Data Requests. In short: update check records 90 days; diagnostic reports 30 days; device update and warranty records for the support period of the device plus 12 months; voice recordings are not stored; usage counters 13 months; cloud-link records until you unlink; consent receipts for 3 years after the consent ends. After these periods, data is deleted or irreversibly anonymised. FIX-12
10. Your choices and controls
Settings › Privacy on the projector shows one switch per purpose, the policy version you accepted, the installation ID, and the actions "Export my data", "Delete server data" and "Reset installation ID". Each switch takes effect at once.
| Purpose switch | Covers | Default | Also where |
|---|---|---|---|
| Essential services | Software updates, activation, local screen-mirroring discovery, help pages, consent receipts | On; cannot be switched off while connected | Setup wizard, "LuminaOS services" page (notice only) |
| Diagnostics | "Report a problem" uploads | Off | Asked again before every upload |
| Cloud voice recognition | LuminaVoice | Off | First press of the voice button |
| AI assistant | Lumina Go help assistant | Off | Lumina Go › Settings › Privacy |
| Cloud link | Lumina Go cloud relay, Alexa and Google Home | Off | Lumina Go receiver on the projector |
| Weather by location | LuminaAura weather | Off | LuminaAura settings |
| Statistics | LuminaHome and Lumina Go usage statistics | Off | LuminaHome settings; Lumina Go › Settings › Privacy |
| Security check | Local risky-domain warnings | On | Lumina Manager |
Withdrawing consent stops the related processing from that moment. It does not affect processing before you withdrew it. Other controls: App Store automatic updates (App Store › Settings); remote assistance helpers (Settings › Accessibility); factory reset (Settings › Device preferences › Reset) deletes everything on the projector.
11. Your rights
Under the GDPR you have the right to access your data, to rectification, to erasure, to restriction of processing, to data portability, and to object to processing based on legitimate interests. You can withdraw consent at any time. Under the EU Data Act you also have the right to access the data generated by your use of the product and to have it shared with a third party of your choice. See EU Data Act Information.
To exercise these rights, use Settings › Privacy on the projector, or write to privacy@luminago.app and include the installation ID shown in Settings › Privacy or the serial number shown in Settings › About. We reply within one month. Using your rights is free and has no effect on your warranty or on security updates. If we delete the data held for your device, the projector continues to receive security updates, because the next update check creates a new technical record.
You can also complain to a data protection authority, in particular in the EU country where you live or work. For example, in Germany this is the authority of your federal state or the BfDI, in France it is the CNIL, and in the UK it is the ICO.
12. Children
The projector is a household device that children may use. Our online services are not directed at children, and we do not knowingly collect personal data from children under 16 (under 13 in the United States). Lumina Go features designed for children are not offered in the EEA, the UK, Switzerland or the United States. If you believe a child has given us personal data, contact us and we will delete it.
13. Security
We protect data with encryption in transit, access control on our servers, pseudonymisation and signed requests. Our Product Security Policy describes how we secure the devices, how long we provide security updates and how to report a vulnerability.
14. Additional information for US residents
We do not sell personal information and do not share it for cross-context behavioural advertising, as defined in the California Consumer Privacy Act and similar state laws. We do not use sensitive personal information to infer characteristics about you. Residents of California, Colorado, Connecticut, Virginia, Utah, Texas, Oregon and other states with privacy laws have the rights to know, access, correct, delete and port their personal information, and to opt out of sales and targeted advertising, which we do not perform. You can exercise these rights through Settings › Privacy or the contact in Section 1, and an authorised agent may act for you. We will not discriminate against you for exercising them. The categories of personal information we collect, the sources and the purposes are those described in Section 4; the categories of recipients are in Section 6; retention periods are in Section 9.
15. Changes to this policy
We publish every change on this page, with the version number and date. The projector checks for a new version when it starts and about once a week. For material changes, the projector and the apps show a summary of what changed before the new version applies and, where a purpose's description changed, ask for your consent to that purpose again. Earlier versions remain available under /versions/.