Data Deletion Policy

This page explains how to request deletion of data held by LuuLn, what we delete, what we are required to keep, and how long it takes.

LuuLn is operated by Tyler Kai Aguilera, a sole proprietor located in Orange County, California.

To request deletion, email tyler@luuln.com with the subject line "Data Deletion Request."

1. HOW TO REQUEST DELETION

Option A — Email (all users)

Send an email to tyler@luuln.com with the subject line "Data Deletion Request" and include:

1. Your full name
2. The email address associated with your account or engagement
3. Your business name, if applicable
4. What you want deleted — all data, or specific categories
5. If applicable, the social media account(s) you connected

We will acknowledge your request within 5 business days and complete it within 30 days. If we need more time, we will tell you why and give a revised date.

Option B — Disconnect a social media account

You can revoke LuuLn's access to any connected social media account directly from that platform, at any time, without contacting us:

• Facebook: Settings & Privacy → Settings → Apps and Websites → select LuuLn → Remove
• Instagram: Settings → Website Permissions → Apps and Websites → select LuuLn → Remove
• LinkedIn: Settings & Privacy → Data Privacy → Permitted Services → select LuuLn → Remove
• X: Settings → Security and account access → Apps and sessions → Connected apps → select LuuLn → Revoke

Revoking access immediately stops us from publishing to or reading from that account. To also delete the data we already hold from that connection, submit a deletion request under Option A.

Option C — Delete your website login

Signed-in users can delete their login at any time from Account settings → Security → Delete account. This closes the login immediately and cancels any active subscription. Records listed in Section 5 are retained. To delete the rest of your data, also submit a request under Option A.

Option D — Automatic deletion on termination

When a client engagement ends, we delete client data on the schedule in Section 4 without requiring a request, except for records we must retain under Section 5.

2. IDENTITY VERIFICATION

Before deleting data, we verify that the request is genuine. We do this by confirming information already in our records — typically by replying to the email address on file, or asking you to confirm a detail such as your business name or engagement start date.

We do not require you to create an account or provide additional identification documents.

If someone submits a request on your behalf as an authorized agent, we will ask for written proof of that authorization.

3. WHAT WE DELETE

On a full deletion request, we remove:

• Account and contact information (name, email, phone, business address)
• Brand voice configuration and all associated settings
• Onboarding and intake materials you provided
• Photographs, voice recordings, and likeness data used for image or video generation
• Approval workflow messages and attachments
• Stored content drafts, approved content records, and generated media files
• Vector memory embeddings and any long-term memory derived from your materials
• Social media access tokens and connected account identifiers
• Support correspondence

Deletion covers our production database, object storage, backups (on the schedule in Section 4), and any copies held in our processing systems.

4. TIMELINE

Backups are encrypted and are not accessed except for disaster recovery. Data in backups is not used for any operational purpose after deletion of the active record.

5. WHAT WE CANNOT DELETE

Some information falls outside a deletion request:

Billing and tax records. Invoices, payment records, and transaction history are retained for seven (7) years as required by federal and California tax law. These records include your name, business name, amounts, and dates. They are not used for any other purpose.

Signed agreement records. The agreements you signed — including your typed name, title, business details, document versions, timestamp, and IP address — are retained for seven (7) years after the engagement ends as evidence of the contract.

Content already published. Content published to your own social media accounts belongs to you and lives on those platforms. Deleting our copy does not remove it from Facebook, Instagram, LinkedIn, or any other platform. To remove published posts, delete them from the platform directly or from your own publishing tool.

Data held by third parties. Where third-party providers hold data as part of delivering the service, we submit deletion requests to them, but their retention is governed by their own policies. See Section 7.

Legal holds. If data is subject to an active legal dispute, investigation, subpoena, or regulatory requirement, we retain it until the matter is resolved and then delete it.

Aggregated and de-identified data. Data that has been aggregated or de-identified so it can no longer be associated with you is not subject to deletion. We do not attempt to re-identify it.

6. PROTECTED HEALTH INFORMATION

We do not collect, request, or accept Protected Health Information or individually identifiable patient information. Our service produces general health education and business-marketing content, not patient-specific content, and our client agreements expressly prohibit submitting patient information through our channels.

Because we do not hold PHI, we do not process patient deletion requests. If you are a patient seeking removal of your information, contact the healthcare provider directly — they are the responsible party.

If patient-identifying information is submitted to us inadvertently, we delete it upon becoming aware, without requiring a request, and notify the client.

7. THIRD-PARTY PROVIDERS

We use third-party providers to deliver the service. On a deletion request, we submit corresponding deletion requests to providers that hold your data:

8. CONFIRMATION

When deletion is complete, we send written confirmation to the email address on file, stating what was deleted and identifying anything retained under Section 5 and why.

9. YOUR OTHER RIGHTS

Deletion is one of several rights you may have. You may also request access to, correction of, or a copy of your data. See our Privacy Policy for the full list and how to exercise them.

We will not discriminate against you for making a deletion request. However, deletion of data necessary to provide the service will end an active engagement.

10. CONTACT

LuuLn Tyler Kai Aguilera, sole proprietor Irvine, California

Email: tyler@luuln.com Subject line: "Data Deletion Request"