VueBrick Privacy Policy

Last Updated and Effective Date: September 15, 2026

VueBrick ("VueBrick," "we," "our," or "us") is operated by La Lune Creative, LLC. This Privacy Policy explains how we collect, use, disclose, retain, and protect personal information when you access or use VueBrick, our website, application, related services, and communications (collectively, the "Service").

La Lune Creative, LLC is the data controller for personal information processed through the Service, except where a third party acts as an independent controller under its own privacy policy.

1. Information We Collect

Information You Provide

We may collect information you provide directly, including:

Account information, such as your name, email address, profile image, and account identifiers.
User content, such as notes, session data, inventory information, tasks, scanned-item data, uploaded images, CSV or XML files, marketplace-related data, feedback, support communications, and other content you submit.
Communications and preferences, including support requests, survey responses, notification preferences, and records of your interactions with us.

Billing, Referral, and Promotional Information

If paid subscriptions are offered, payments are processed by Stripe, our payment processor. You provide your payment-card details directly to Stripe on Stripe-hosted pages; we do not receive or store your full payment-card information. We receive and store from Stripe subscription and billing identifiers and status information, such as a customer identifier, subscription identifiers and status, plan and billing-interval information, renewal dates, and invoice outcomes (including amounts, payment success or failure, refunds, and disputes).

If you participate in our referral program or redeem promotional codes, we also collect and maintain:

Your referral code and referral link activity.
Referral relationships — which account referred which, without exposing personal details of one participant to the other beyond what the program requires.
Referral qualification and reward history, including free months earned, used, and remaining.
Promotional-code redemption history.
Administrative reward adjustments and related audit records tied to your account.

Information Collected Automatically

When you use the Service, we and our service providers may automatically collect:

Device and browser information, including browser type, operating system, device type, application version, language, and approximate location derived from IP address.
Usage information, including pages or screens viewed, feature use, scan and session activity, settings, referring URLs, timestamps, and interactions with the Service.
Diagnostic and security information, including IP address, logs, crash reports, error reports, performance data, suspected-abuse signals, and authentication events. To protect the Service against abuse and automated attacks, we generate limited request-security signals: a per-installation device identifier stored in your browser, per-session and per-action identifiers, application version, and coarse request-rate counts. Where we log network information for security, we truncate the IP address to a network prefix and store only a salted, irreversible hash of it — we do not store your full IP address in these security records. These signals let us tell normal use from automated abuse without identifying you personally.
Cookie and local-storage information described below.

Information From Third Parties

We may receive information from:

Google when you sign in using Google authentication.
Marketplace, catalog, image-recognition, analytics, advertising, hosting, domain, and infrastructure providers.
Publicly available sources and third-party databases used to provide catalog, pricing, identification, or marketplace-related features.

2. How We Use Information

We may use personal information to:

Provide, operate, maintain, and secure the Service.
Authenticate users and administer accounts.
Process scans, files, images, exports, and other requested functions.
Store preferences, session history, inventory, tasks, and account settings.
Administer billing, subscriptions, referrals, promotions, and reward credits, including qualification, applying earned free months, fraud and abuse prevention, support, analytics, and billing reconciliation.
Provide customer support and communicate about service, security, legal, or account matters.
Diagnose errors, monitor performance, prevent fraud or abuse, and protect users and systems.
Detect and prevent abuse using automated and semi-automated controls, including request rate-limiting, temporary slowing or queuing of requests, and concurrency limits. Decisions that would restrict, suspend, or terminate an account are subject to human review, and you may contact us to request review of any such decision.
Measure traffic, usage, campaign performance, and feature effectiveness.
Develop, test, and improve features, including AI-assisted features.
Enforce our Terms of Service and other policies.
Comply with law, legal process, and regulatory obligations.
Create aggregated or de-identified information that cannot reasonably be used to identify you.

We do not use AI or automated processing to make solely automated decisions that produce legal or similarly significant effects about you without a means for you to request human review. Automated abuse controls such as rate-limiting or temporary throttling may apply without individual review, but account-level restriction, suspension, or termination involves human review.

3. Legal Bases for Processing

Where the GDPR, UK GDPR, or similar law applies, we process personal information under one or more of these legal bases:

Contract: processing necessary to provide the Service you request.
Legitimate interests: operating, securing, supporting, analyzing, and improving the Service, provided those interests are not overridden by your rights.
Consent: where we ask for consent, including for certain analytics, advertising, or communications where required.
Legal obligation: complying with applicable law, legal process, or regulatory requirements.
Protection of rights and safety: protecting users, the public, or the Service where legally permitted.

You may withdraw consent at any time where consent is the legal basis, without affecting processing completed before withdrawal.

4. Uploaded Files, Images, and Public URLs

You retain ownership rights in content you upload. You grant us the limited rights necessary to store, process, transmit, and display that content to provide the Service.

Certain listing photographs may be stored at publicly accessible or unlisted URLs for export and marketplace workflows. Anyone with the URL may be able to access the file. Do not upload personal photographs, government identification, payment-card data, medical records, biometric data, Social Security numbers, passwords, confidential third-party materials, or other sensitive information unrelated to VueBrick's intended functions.

Listing photographs are stored to support export, not as long-term hosting. They are automatically deleted after a retention window that runs from the time of upload (7 days for free and expired-trial accounts, 90 days for Pro subscribers and active trials). Photographs uploaded before this retention policy took effect are kept through a one-time transition period, announced in the app, and then deleted. Deleting your account removes your listing photographs immediately; deleting a session removes that session's photographs.

You are responsible for ensuring that uploaded content complies with law and does not violate third-party rights.

5. Cookies, Analytics, Advertising, and Similar Technologies

VueBrick and related websites may use cookies, local storage, session storage, IndexedDB, pixels, SDKs, and similar technologies for authentication, security, preferences, diagnostics, analytics, and advertising.

Google Services

Google services we may use include:

Google Sign-In / OAuth for account authentication.
Google Analytics to understand website and application traffic, usage patterns, and performance.
Google Search Console to monitor search visibility, indexing, site health, and search-performance information.
Google Ads to measure advertising performance, conversions, and, where enabled and legally permitted, remarketing or audience activity.

Google may receive device, browser, cookie, IP address, usage, advertising, and conversion information depending on the service and your settings. Google may act as our processor or as an independent controller for certain data. You can manage cookies through your browser and, where available, through our consent controls. Blocking cookies may affect Service functionality.

Marketing Email Measurement

Marketing emails we send may contain tracking pixels and encoded links that tell us whether a message was opened and which links were clicked. We use this only to measure how our marketing communications perform. You can limit it by disabling remote images in your email client, and you can stop these messages entirely using the unsubscribe link in any marketing email.

Do Not Track and Global Privacy Control

Because there is no uniform industry standard for browser "Do Not Track" signals, the Service may not respond to them. Where legally required and technically supported, we honor recognized opt-out preference signals such as Global Privacy Control for sale, sharing, or targeted advertising.

6. Third-Party Services and Subprocessors

We use service providers and third parties to operate the Service. They may process information on our behalf or under their own policies. Providers may change over time and may include:

Google — authentication, analytics, Search Console, advertising, and related services.
Supabase — authentication, database services, file storage, and application infrastructure.
Vercel — hosting, content delivery, deployment, security, and application delivery.
Stripe — payment processing and subscription billing. Stripe collects your payment-card information directly on Stripe-hosted pages and acts as an independent controller or processor for that data under its own privacy policy; we receive only subscription and billing identifiers and status.
Amazon Web Services (AWS) — cloud hosting, API Gateway, serverless compute (Lambda), and related infrastructure for catalog, pricing, and request-protection processing. AWS may process request metadata and truncated, hashed network identifiers on our behalf as a processor.
Sentry — error monitoring, diagnostics, crash reporting, and performance monitoring.
Squarespace — domain registration, domain management, and DNS-related services.
Resend — transactional email delivery, including invitations, access notices, and service messages.
Flodesk — marketing and newsletter email. We create a Flodesk contact for you only where you have opted in, either by checking the optional marketing box when you create an account or by subscribing through the form on our website; signing up, starting a trial, or paying does not by itself add you. We disclose to Flodesk your email address, your name, and your membership in audience segments that reflect your relationship with us (for example, newsletter subscriber, trial, current subscriber, founding member, or former customer) so that the messages you receive are relevant. Flodesk is not used for transactional or service messages. Every marketing message includes an unsubscribe link; once an address is unsubscribed we do not re-subscribe it, and no billing, trial, or other account event will do so.
Brickognize — image-based LEGO item recognition and machine-learning processing. Scan images are sent to Brickognize directly from your device, so Brickognize also receives your IP address as an independent recipient for that request.
BrickLink, Brickset, and eBay — catalog, marketplace, product, image, and pricing-related information.
Anthropic and OpenAI — AI-assisted development, support, debugging, content processing, or product features, where used.

We may also use professional advisers, security vendors, communications providers, and other vendors reasonably necessary to operate the Service.

7. Artificial Intelligence and Machine Learning

VueBrick may use AI and machine-learning systems for item recognition, content processing, support, development, debugging, security, and product improvement.

When reasonably necessary, AI providers may process user content, uploaded files, scanned-item data, support communications, usage information, or technical information. We seek to use business or API offerings that contractually restrict use of submitted data for training general-purpose public models when such controls are available.

AI output may be inaccurate, incomplete, outdated, or misleading. Users should independently verify output before relying on it. We do not represent that AI output is professional, legal, financial, tax, investment, or appraisal advice.

8. How We Disclose Information

We may disclose information:

To service providers and subprocessors that help us operate the Service.
At your direction or when needed to complete an integration, export, or transaction you request.
To comply with law, subpoenas, court orders, warrants, or other valid legal process.
To investigate fraud, abuse, security incidents, or violations of our agreements.
To protect the rights, property, safety, or security of VueBrick, users, or others.
In connection with a merger, acquisition, financing, reorganization, bankruptcy, sale of assets, or similar business transaction.
With your consent.
In aggregated or de-identified form.

We do not sell personal information for money.

We do not sell or share your email address or marketing preferences for anyone else's advertising. Marketing email is sent only to addresses that have opted in, and what we disclose to our email provider is disclosed to it as a service provider acting on our behalf, never for its own marketing purposes.

Use of advertising, analytics, or conversion technologies may constitute "sharing," "targeted advertising," or a "sale" under certain U.S. state privacy laws even when no money is exchanged. Where applicable, you may opt out by using available cookie controls, a recognized preference signal, or by contacting us.

We do not knowingly sell or share personal information of individuals under 18.

10. Affiliate Links and Third-Party Content

The Service may include affiliate links, recommendations, or third-party content. We may receive compensation when users make qualifying purchases or referrals. Third parties may collect information under their own privacy policies when you interact with their services.

Third-party catalog, pricing, image, and marketplace information may be inaccurate, incomplete, delayed, or unavailable. We do not control third-party privacy or security practices.

11. Local Device Storage

The Service may store settings, session state, temporary scan data, preferences, interface settings, authentication state, and other information on your device. Local information may remain after account deletion until you clear browser data or uninstall the application.

12. Administrative Access

Authorized personnel may access user information when reasonably necessary for support, troubleshooting, security, abuse prevention, legal compliance, platform operations, or account administration. Access is limited according to role and operational need.

13. Data Retention

We retain personal information only as long as reasonably necessary for the purposes described in this Policy, including providing the Service, maintaining security, complying with law, resolving disputes, and enforcing agreements.

Account data and user content are generally retained while your account remains active or until you delete the applicable data. When deleted, information is removed from active systems within a commercially reasonable period. Residual copies may remain in backups until those backups are overwritten or deleted. Security, fraud-prevention, transactional, and legal records may be retained longer where reasonably necessary or required by law.

Listing photographs uploaded for export and marketplace workflows are retained only for a limited window after upload — 7 days for free and expired-trial accounts, or 90 days for Pro subscribers and active trials — after which they are automatically deleted from active systems. Photographs uploaded before this retention policy took effect are kept through a one-time transition period and then deleted. Deleting your account removes your listing photographs immediately, and deleting a session removes that session's photographs, subject to residual backup copies as described above.

Request-security and abuse-prevention records (such as truncated hashed network identifiers, device and session identifiers, and request-rate telemetry) are retained only as long as needed for security and abuse-prevention purposes and are then deleted or aggregated. When you delete your account, these records are either deleted or disassociated from your account identifier; a limited set may be retained in de-identified or aggregated form for security and analytics.

Referral, reward, promotional-redemption, and billing/transactional records are treated as transactional records: when you delete your account they are deleted or disassociated from you, except that a limited set may be retained where reasonably necessary for fraud and abuse prevention, dispute and chargeback handling, accounting and tax, or other legal purposes, and records held by Stripe are retained under Stripe's own policies.

Marketing email records are retained while you remain subscribed. If you unsubscribe, or if you delete your account, we remove the audience segments tied to your account and unsubscribe the contact created from your opt-in. That removal is performed through our email provider at the time you delete your account; if the provider cannot complete it then, we may be unable to retry it once your account data is gone. If you ever receive a marketing message after deleting your account, use its unsubscribe link or contact us and we will suppress the address. Our email provider does not offer deletion of a contact record, so it retains your email address as a suppression record for the purpose of making sure you are not emailed again; that record is not used to market to you. A subscription you started independently through our website form is not account data and continues until you unsubscribe.

Retention periods may vary by data type, provider, legal obligation, and operational need. We do not promise a deletion timeline that is technically controlled by an independent third-party provider.

14. Account Deletion and Data Portability

Users may delete their accounts through account settings where available. Deletion may permanently remove account information, uploaded content, session history, preferences, tasks, activity records, and associated data, subject to legal, security, backup, and fraud-prevention exceptions.

If you opted in to marketing email, deleting your account also removes your audience segments and unsubscribes the contact created from that opt-in, subject to the limits described in Section 13. Our email provider keeps the address as a suppression record, and a separate website-form subscription continues until you unsubscribe.

Where available, the "Download my data" feature provides a machine-readable export. You may also submit a privacy request using the contact information below.

We may verify your identity before completing a request. Authorized agents may submit requests where permitted by law, but we may require proof of authorization and identity verification.

15. International Data Transfers

VueBrick is operated from the United States. Information may be processed or stored in the United States and other countries that may not provide the same level of data protection as your jurisdiction.

Where required, we rely on legally recognized safeguards, which may include adequacy decisions, the EU–U.S. Data Privacy Framework, the UK Extension to that framework, the Swiss–U.S. Data Privacy Framework, Standard Contractual Clauses, the UK International Data Transfer Addendum or Agreement, or other lawful transfer mechanisms. A provider's participation in a framework applies only if that provider is validly certified and the transfer is covered by that certification.

The former EU–U.S. Privacy Shield is no longer a valid transfer mechanism and is not relied upon.

16. Your Privacy Rights

Depending on your location, you may have the right to:

Access or know the personal information we process.
Correct inaccurate information.
Delete information.
Obtain a portable copy of information.
Restrict or object to processing.
Withdraw consent.
Opt out of sale, sharing, targeted advertising, or certain profiling.
Limit certain uses of sensitive personal information.
Appeal a denied request.
Lodge a complaint with a data-protection authority.
Receive equal service and pricing without unlawful discrimination for exercising privacy rights.

Rights are subject to legal exceptions. We will respond within the time required by applicable law.

17. California Privacy Disclosures

This section supplements the rest of this Policy for California residents under the California Consumer Privacy Act, as amended by the California Privacy Rights Act, and the California Online Privacy Protection Act.

During the preceding 12 months, we may have collected the following categories: identifiers; customer-record information; commercial information; internet or electronic network activity; approximate geolocation; audio, electronic, visual, or similar information; inferences; and account credentials or other sensitive personal information when voluntarily provided.

We collect these categories from users, devices, service providers, authentication providers, and third-party data sources. We use and disclose them for the business and commercial purposes described in this Policy.

We do not use or disclose sensitive personal information for purposes that require a separate right to limit under California law, except as necessary to provide and secure the Service. We do not offer financial incentives in exchange for personal information.

California residents may exercise applicable rights to know, access, correct, delete, opt out, limit, and receive non-discriminatory treatment. California's "Shine the Light" law may also allow residents to request information about certain disclosures for direct marketing. We do not disclose personal information to third parties for their own direct marketing purposes in the manner covered by that law.

18. Other U.S. State Privacy Rights

Residents of states with comprehensive privacy laws may have rights similar to those listed above, including rights concerning access, correction, deletion, portability, targeted advertising, sale, profiling, sensitive data, and appeals. We will honor applicable rights based on your jurisdiction and our legal obligations.

19. European Economic Area, United Kingdom, and Switzerland

Individuals in the EEA, UK, and Switzerland may exercise the rights described above and may contact their local supervisory authority. Where processing is based on legitimate interests, you may request information about the relevant balancing considerations. Where processing is based on contract, failing to provide required information may prevent us from providing the Service.

We do not appoint an EU or UK representative unless legally required. If our obligations change, we will update this Policy.

20. Children's Privacy

The Service is not intended for anyone under 18, and we do not knowingly collect personal information from children. If we learn that we collected personal information from a child, we may delete it and terminate the associated account.

21. Security and Incident Notification

We use reasonable administrative, technical, and organizational safeguards designed to protect information, such as access controls, authentication, encryption in transit where supported, provider security controls, logging, monitoring, and backup practices.

No system is completely secure. You are responsible for maintaining the security of your account, devices, and credentials. If a data breach occurs, we will provide notifications where and when required by applicable law.

22. Changes to This Policy

We may update this Policy periodically. We will post the updated version and revise the "Last Updated" date. Where required, we will provide additional notice or obtain consent before material changes take effect.

23. Accessibility

You may request this Policy in an alternative accessible format by contacting us.

24. Contact Us

Questions, privacy requests, appeals, or complaints may be directed to:

La Lune Creative, LLC
Email: hello@lalunecreative.com

25. LEGO Trademark Notice

LEGO® is a trademark of the LEGO Group of companies. The LEGO Group does not sponsor, authorize, endorse, or otherwise approve VueBrick. VueBrick is an independent software application and is not affiliated with, endorsed by, sponsored by, or associated with the LEGO Group.