Privacy Policy
Last updated: September 2026
FestivalLuts is a hobby project run by two people in the Netherlands under the project name Prioxy Studios. There is no registered company, so the controller under the GDPR is not a legal entity but the people who run the site, who decide together how personal data on it is used. Stijn Tilborghs is the named controller and the single point of contact for everything on this page; the second operator is a joint controller, and their name and the essence of our arrangement are available on written request. For any privacy, GDPR or data request, email [email protected].
Our lawful bases for processing under the EU/UK GDPR (General Data Protection Regulation) are: consent (advertising and analytics cookies, which stay switched off for visitors in the EEA, UK and Switzerland unless and until consent is given), contract (running your account and serving downloads), legitimate interests (security, abuse prevention and basic server logs), and legal obligation (handling reports about content, which the EU Digital Services Act requires).
1. Information We Collect
When you create an account via Google Sign-In, we collect:
- Your name and email address (from your Google account)
- Your profile picture URL. Pictures are shown straight from Google's servers, so a page that shows a creator's picture makes your browser ask Google for it, and Google sees your IP address.
Accounts and uploads are for people aged 16 or over, or younger with a parent's or guardian's permission. Browsing and downloading need no account. Signing in with Google is subject to Google's own age rules.
When you upload a LUT or preset, your display name and your Google profile picture are shown publicly as its creator. The upload form says so before you upload, and you can change your display name in Settings at any time.
When you send a report about content (see section 5), we collect the link you report, your explanation, and your name and email address.
When you use our platform, we automatically collect:
- IP address and browser type (via server logs)
- Pages visited and actions taken on the site
2. How We Use Your Information
- To provide and maintain the FestivalLuts platform
- To display your name alongside LUTs you upload
- To communicate important updates about the service
- To prevent abuse and enforce our Terms of Service
- To handle reports about content and tell the people involved what we decided
3. Third-Party Services
We use the following third-party services:
- Google OAuth — For user authentication. Subject to Google's Privacy Policy.
- Google AdSense — For displaying advertisements. AdSense uses cookies to serve ads based on your browsing history. See Google's Ad Policy.
- Google Analytics 4 — To understand how the site is used (pages viewed, aggregate traffic). For visitors in the EEA, the UK and Switzerland it does not load at all, and nothing is sent to it, unless you accept analytics in Google's consent message; if that message is not shown to you, there is nothing to accept and it stays off. Elsewhere it loads with cookies under Google's defaults. See Google's Privacy Policy.
- Cloudflare — Every request to festivalluts.com passes through Cloudflare's network, which delivers the site and protects it from attacks. See Cloudflare's Privacy Policy.
- YouTube — A few pages show a video. Nothing is loaded from YouTube until you click the video; it then plays from youtube-nocookie.com.
- Zoho Mail — Hosts our mailbox, [email protected], in Zoho's EU data centre. If you email us, your message and your email address are stored there. See Zoho's Privacy Policy.
Fonts are served from our own server. Your browser does not contact Google to load them.
Transfers outside the EU
Google (sign-in, advertising, analytics and profile pictures) and Cloudflare are companies based in the United States, so personal data they process can be transferred there. Both are certified under the EU–US Data Privacy Framework, for which the European Commission adopted an adequacy decision on 10 July 2023; where that framework does not apply, they rely on the European Commission's standard contractual clauses. Our mailbox stays in Zoho's EU data centre.
Third-party advertising vendors
Third-party vendors, including Google, use cookies to serve ads based on your previous visits to this site or other sites. Google's use of advertising cookies lets it and its partners serve ads to you based on that activity.
You can turn off personalised advertising at Google Ads Settings. To opt out of a wider set of third-party vendors, use aboutads.info/choices or, in Europe, youronlinechoices.eu. Opting out stops ads being personalised; it does not stop ads appearing.
4. Cookies
We use cookies for:
- Session management (keeping you logged in) — strictly necessary, always on
- Advertising (via Google AdSense) — set only with your consent
- Analytics (via Google Analytics) — set only with your consent
Advertising and analytics cookies are off by default for visitors in the EEA, UK and Switzerland. We signal that default to Google before any advertising tag loads, those cookies stay switched off unless a consent tool grants them, and Google Analytics is not loaded at all until it does. The consent tool is Google's own consent message, which comes with the advertising script on pages that carry ads when Google serves it; if it is not shown to you, there is nothing to accept, and advertising and analytics cookies simply stay off. If you are outside those regions, these cookies may be set without a prompt. You can change or withdraw consent, where a consent tool is available to you, here:
5. Reports About Content
Anyone can report content on FestivalLuts that they believe is illegal or breaks our terms, using the report form. The EU Digital Services Act requires us to handle such reports. It also requires the report to include your name and email address. We store the report and use it only to decide what to do. You get a private link where our decision appears. We do not give your name or email address to the person who uploaded the content.
When a report is about a file someone uploaded, we also record which account uploaded it. That lets us apply the repeat-infringement rule in our terms: an account with three upheld copyright reports within twelve months may be suspended. This record is kept, and deleted, with the report.
6. Data Retention
- Your account — for as long as it exists. You can delete it yourself at any time (see below).
- Sign-in session — up to 30 days, or until you sign out.
- Reports about content — three years after we decide on them, then deleted.
- Records of removed content — the page address and title of a removed LUT and the reason it was removed, so that the address can answer "gone" and the uploader can see why.
- Server logs — IP address, browser type and the page requested, kept for at most 15 days for security and abuse prevention (they are rotated daily and the oldest is deleted).
- Blocked IP addresses — an address blocked for abuse is kept for twelve months, then deleted.
7. Your Rights
You have the right to access, correct and delete your personal data, to receive a copy of it, to restrict or object to how we use it, and to withdraw any consent you gave. Two of these you can do yourself, straight away, in Settings:
- Download my data — one file with everything we store about your account: profile, uploads and saved LUTs.
- Delete my account — removes your name, email address, photo, bio, website and saved LUTs and signs you out everywhere. You choose whether your uploads are deleted too or stay online, credited to "A FestivalLuts creator".
For anything else, email us (below). We answer within one month. You can also complain to the Dutch data protection authority, the Autoriteit Persoonsgegevens.
8. Contact
For privacy-related questions, contact us at: [email protected]. We handle requests in English.
9. Changes
We may update this privacy policy from time to time. Changes will be posted on this page with an updated date.