Privacy policy
Last updated 21 October 2026
This policy explains what personal data Airlight handles, why, and your rights. LUZAURA, LDA, Rua de Volta da Manhã, Prado Villas, 8125-406 Quarteira, Portugal, NIPC 518676161 ("we") is responsible for the data of people who use Airlight's own website and accounts. For recordings and webinar registrations, the business running the studio or webinar is responsible, and we process that data on their behalf.
1. Two roles
Our own customers. When you sign up, we are the controller of your account details and billing information.
Your guests and audience. When a business uses Airlight to record a guest or run a webinar, that business is the controller and we are its processor. Their own privacy notice, linked from their registration page, applies. Our data processing terms for businesses are available on request at support@airlight.studio.
2. What we handle
- Account details: name, email, password (stored only as a secure hash), workspace name and brand.
- Recordings: audio, video and screen shares of people who join a studio, with the transcripts and files made from them.
- Webinar data: registrations (name, email and the answers to any questions asked), attendance, chat, questions, poll answers and offer clicks.
- Consent records: when someone accepted a recording notice or agreed to marketing, and the wording they saw.
- Billing: handled by our payment provider; we do not store full card numbers.
- Messages sent through our contact page.
3. Why we use it
To provide the service you signed up for (contract), to keep it secure and prevent abuse (legitimate interest), to send the emails you or the business running a webinar asked us to send, and to meet our legal and tax obligations. We do not sell personal data, and we do not use your recordings to advertise to anyone.
4. Who helps us
We use a small number of providers to run Airlight:
- Real-time audio and video connection: LiveKit, with its project data held in the European Union (Frankfurt).
- File storage for recordings and uploads: Cloudflare R2, stored in Western Europe.
- Website hosting: Vercel. Database: Supabase, in the European Union (Frankfurt).
- Transcription: done on our own servers; recordings are not sent to an outside transcription service.
- Email delivery: Brevo, in France. Our own mailboxes: Google Workspace.
- Payments: Stripe, once card payments are switched on.
Where a provider is outside the European Economic Area, we rely on the EU Standard Contractual Clauses or the EU-US Data Privacy Framework.
5. How long we keep it
Account data is kept while your account is open. Businesses using Airlight choose how long their recordings are kept, and can delete or export them at any time. Raw upload pieces are cleaned up after a recording is assembled. When an account is closed, we delete its data within 90 days, except invoices and billing records, which Portuguese tax law requires us to keep for ten years.
6. Your rights
You can ask to see, correct, export or delete your personal data, or object to how it is used. If you registered for a webinar or appeared in a recording, ask the business that ran it first; we will help them. Every webinar email has a link to stop further reminders. You can also complain to the Portuguese data protection authority, the CNPD.
8. Contact
Privacy questions: support@airlight.studio, or use the contact page.