Privacy Policy

1. Introduction

Lula Mula ("the Platform", "we", "us", or "our") respects your privacy and is committed to protecting your personal information in compliance with the Protection of Personal Information Act 4 of 2013 ("POPIA") of the Republic of South Africa. This Privacy Policy explains how we collect, use, store, protect, and share your personal information when you use our Service.

By using the Platform, you consent to the data practices described in this Policy. If you do not agree, you must discontinue use of the Service.

2. Information We Collect

2.1 Information You Provide

When you register for an account and use our Service, we collect the following personal information:

  • Identity Information: Full legal name, South African ID number.
  • Contact Information: Email address, phone number, physical address.
  • Financial Information: Bank account holder name, bank name, account number, branch code, account type. Note: Credit/debit card details are never collected or stored by us — these are processed exclusively by PayFast.
  • Biometric Data: Facial images contained in selfie photographs you upload for artwork generation.
  • Account Data: Username, hashed password, membership status, referral relationships, wallet transactions.
  • Communication Data: Any information you provide when contacting support or corresponding with us.

2.2 Information Collected Automatically

  • Technical Data: IP address, browser type and version, operating system, device information, referring URL, pages visited, and time stamps.
  • Usage Data: Features accessed, generation attempts, referral link clicks, and interaction patterns.
  • Cookies: Session cookies for authentication, security (CSRF tokens), and basic functionality. We do not use tracking cookies for advertising or profiling. See Section 8 for details.

3. How We Use Your Information

We use your personal information for the following purposes:

Purpose Legal Basis (POPIA)
Account creation and membership management Performance of a contract
Processing payments and payouts Performance of a contract; legal obligation
Generating AI artwork from your selfie Performance of a contract; explicit consent
Managing the referral program and commissions Performance of a contract
Promo code validation and repayment tracking Performance of a contract
Sending service-related emails (welcome, payment confirmations, commission notifications) Performance of a contract; legitimate interest
Security monitoring, fraud prevention, and audit logging Legitimate interest; legal obligation
Complying with legal obligations and law enforcement requests Legal obligation

4. Data Storage & Encryption

4.1 Storage

Your personal information is stored on secure servers located in the Republic of South Africa. Our database uses MariaDB with access restricted to authorised personnel only.

4.2 Encryption at Rest

Sensitive personal information is encrypted at rest using AES-256-GCM (Advanced Encryption Standard, 256-bit key, Galois/Counter Mode). Specifically, the following fields are encrypted before storage:

  • South African ID number
  • Bank account holder name
  • Bank name, account number, branch code
  • Account type

The encryption key is stored separately from the database and is never exposed in source code, logs, or client-facing systems.

4.3 Selfie Photographs

Selfie photographs uploaded for artwork generation are stored on the server filesystem. These images are:

  • Used exclusively for the purpose of generating your Artwork via our AI pipeline.
  • Transmitted securely over HTTPS to third-party AI APIs (fal.ai and Google Gemini) for processing.
  • Retained only for as long as necessary to provide the Service (typically until you generate a replacement artwork or delete your account).

4.4 Transmission Security

All data transmitted between your browser and our servers is encrypted using TLS (HTTPS). We enforce HTTPS via HSTS (HTTP Strict Transport Security) headers.

5. Data Sharing & Third Parties

5.1 Payment Processing

Payment transactions are processed by PayFast (Pty) Ltd. When you make a payment, you are redirected to PayFast's secure environment. PayFast collects and processes your payment card details directly — we never receive, store, or have access to your credit/debit card information. PayFast's privacy policy is available at payfast.co.za/privacy-policy.

5.2 AI Processing

To generate your Artwork, your selfie photograph is transmitted to the following AI service providers:

  • fal.ai — for AI style transfer (TeleStyle v2) and background removal (Bria).
  • Google Gemini — for AI image fusion (when Gemini Pro mode is selected).

These providers process your image solely for the purpose of our AI pipeline and do not retain your images beyond the processing session. Their respective privacy policies govern their handling of data during processing.

5.3 No Sale of Data

We do not sell, rent, lease, or trade your personal information to third parties for marketing, advertising, or any other purpose.

5.4 Legal Disclosure

We may disclose your personal information if required to do so by law, court order, or governmental authority, or if we believe in good faith that such disclosure is necessary to protect our rights, your safety, or the safety of others, to investigate fraud, or to respond to a legal request.

6. Data Retention

We retain your personal information only for as long as necessary to fulfill the purposes for which it was collected:

  • Account data: Retained for the duration of your membership and for a period of 5 years after account termination to comply with tax, financial, and legal obligations under South African law.
  • Selfie photographs: Retained only while your account is active and you have a current artwork generation. Deleted when replaced or upon account deletion.
  • Generated artworks: Retained for the duration of your membership. Upon account termination, we may retain archival copies for quality assurance and legal compliance.
  • Financial records: Retained for 5 years in compliance with South African tax law (Tax Administration Act 28 of 2011).
  • Audit and security logs: Retained for a minimum of 12 months for security monitoring and incident investigation.

7. Your Rights Under POPIA

As a data subject under POPIA, you have the following rights:

  • Right of Access: You may request a copy of the personal information we hold about you.
  • Right to Rectification: You may request correction of inaccurate or incomplete personal information.
  • Right to Erasure: You may request deletion of your personal information, subject to legal retention obligations.
  • Right to Object: You may object to the processing of your personal information in certain circumstances.
  • Right to Withdraw Consent: Where processing is based on consent, you may withdraw that consent at any time.
  • Right to Complain: You may lodge a complaint with the Information Regulator of South Africa (justice.gov.za/inforeg) if you believe we have violated POPIA.

To exercise any of these rights, contact us at info@lulamula.co.za. We will respond within 30 days as required by POPIA. We may request proof of identity before processing your request.

8. Cookies

Lula Mula uses only essential cookies necessary for the operation of the Service:

  • Session Cookies: To maintain your logged-in state and enable secure navigation. These are temporary and expire when you close your browser.
  • CSRF Tokens: To prevent cross-site request forgery attacks. These are cryptographic tokens embedded in forms and validated on submission.
  • Cookie Consent: A cookie recording your preference regarding our cookie notice (if applicable).

We do not use cookies for tracking, advertising, analytics profiling, or any non-essential purpose. No third-party cookies are placed by our Platform.

9. Children's Privacy

The Service is not intended for individuals under the age of 18. We do not knowingly collect personal information from children. If we become aware that a person under 18 has provided us with personal information, we will take immediate steps to delete such information and terminate the associated account.

10. International Data Transfers

Your personal information is primarily stored and processed in the Republic of South Africa. However, your selfie photograph is transmitted to AI service providers (fal.ai and Google) whose servers may be located in the United States or European Union. By using the Service, you consent to this transfer for the limited purpose of artwork generation. We ensure appropriate safeguards are in place through contractual agreements with these providers.

11. Security Measures

We implement and maintain appropriate technical and organisational security measures to protect your personal information, including:

  • AES-256-GCM encryption for sensitive data at rest
  • TLS/HTTPS for data in transit with HSTS enforcement
  • CSRF protection on all state-changing requests
  • Secure session management with HttpOnly, Secure, and SameSite cookie flags
  • Rate limiting to prevent brute-force and enumeration attacks
  • Audit logging of all administrative actions and security events
  • Access controls restricting data access to authorised personnel only
  • Regular security reviews of our codebase and infrastructure

While we strive to protect your information, no method of electronic storage or transmission is 100% secure. We cannot guarantee absolute security.

12. Data Breach Notification

In the event of a data breach involving your personal information, we will notify you and the Information Regulator as required by POPIA within a reasonable timeframe after becoming aware of the breach. Notifications will include the nature of the breach, the data affected, the measures we have taken, and recommended steps for you to take.

13. Changes to This Privacy Policy

We may update this Privacy Policy from time to time to reflect changes in our practices, legal requirements, or operational needs. We will notify members of material changes via email or prominent notice on the Platform. The date of the last revision is stated at the bottom of this page. Continued use after changes take effect constitutes acceptance of the revised Policy.

14. Information Officer / DPO

Our designated Information Officer for POPIA purposes is:

Lula Mula — Data Protection
Email: info@lulamula.co.za
Website: https://www.lulamula.co.za
Location: South Africa

For all privacy-related inquiries, data access requests, or complaints, please contact us at the above address.

15. Consent & Acceptance

By registering for a Lula Mula account, you expressly consent to:

  • The collection and processing of your personal information as described in this Policy.
  • The encryption and secure storage of your sensitive data (ID number, banking details).
  • The transmission of your selfie photograph to third-party AI processors for artwork generation.
  • The use of your email address for service-related communications.

You may withdraw consent at any time by contacting us, but this may affect our ability to provide the Service to you. Where processing is required for the performance of our contract with you, withdrawal of consent does not automatically terminate the processing — we may continue to process your data as necessary to fulfill our contractual obligations.

Last updated: 28 June 2026
This policy is compliant with the Protection of Personal Information Act 4 of 2013 (POPIA) of the Republic of South Africa.

Back to Home

This site uses cookies to improve your experience. By continuing, you agree to our use of cookies.

Privacy Policy