Privacy policy

DRAFT: pending Compliance review. Not final legal text. Do not rely on it.

This policy covers the lumilabz.co.uk website and our shop. App privacy: see each app (for children, the Children’s privacy notice).

Who we are

The controller for this website and for customer support is [PLACEHOLDER - needs Christopher: trading name/legal identity], [PLACEHOLDER - needs Christopher: geographic service address (registered-office or virtual-office service, never a home address, not a PO box)]. Contact: [PLACEHOLDER - needs Christopher: brand email, e.g. hello@lumilabz.co.uk, not yet set up]. [ICO registration number: PLACEHOLDER, pending ICO fee self-assessment.]

Browsing this website

We use no cookies, analytics, advertising or social media pixels. There are no accounts. Our only form is the purchase-consent box on product pages; ticking it sends nothing to us (the confirmation is passed to Lemon Squeezy with your order). Fonts and images are served from our own site, not third-party services.

The site is hosted and protected by Cloudflare (our processor). To deliver pages and block attacks, Cloudflare processes technical data such as your IP address, browser type and the pages requested. Cloudflare may set strictly necessary security cookies (for example to tell people from bots); these need no consent. Lawful basis: legitimate interests (running a secure website). Cloudflare is US-based; under its Customer Data Processing Addendum (version 6.4, clauses 6.2(b) and 6.4), transfers rely on the UK-US data bridge (UK Extension to the EU-US Data Privacy Framework) or the UK International Data Transfer Addendum.

Our server is hosted by Oracle Cloud (processor) and backups are kept by OVH (processor). Our server logs (IP address, page, time) are kept for 30 days. Cloudflare keeps limited security and traffic data under its own retention policy.

Buying from the shop

Lemon Squeezy is the seller (merchant of record); Lumi Labz supplies and licenses the content. When you buy, Lemon Squeezy collects your name, email, billing country/address, payment details and tax information. Lemon Squeezy is the seller and an independent controller for payment, tax and fraud; where it handles order data on our behalf it acts as our processor. Payments are processed by Stripe (Lemon Squeezy is owned by Stripe), which receives your payment data. See Lemon Squeezy privacy policy. We never see or store your full card details. Transfers to the US rely on the UK-US data bridge where the recipient is certified, otherwise on contractual safeguards.

Lemon Squeezy shares with us your name, email, country, what you bought and the order number. We use this to deliver your download, provide support, handle refunds and keep business and tax records. Lawful bases: contract, and legal obligation (records).

Our Buy buttons link out to Lemon Squeezy's own checkout page; we do not embed its checkout script, so no Lemon Squeezy cookies are set on this site. Lemon Squeezy's checkout page uses its own strictly necessary cookies to take payment.

We do not send marketing emails unless you separately opt in, and every marketing email will have an unsubscribe link. [No mailing list planned yet.]

Emailing us

If you email us, we use your email address and message to reply. Lawful basis: legitimate interests. Email is hosted by [PLACEHOLDER - email provider, processor].

How long we keep data

  • Order records: 6 years after the end of the tax year (HMRC record-keeping).
  • Support emails: up to 2 years after the conversation ends.
  • Our server logs: 30 days. Backups rotate every 30 days.
  • Cloudflare security and traffic data: under Cloudflare's own retention policy.

Your rights

Under UK GDPR you can ask to access, correct, delete or restrict your data, object to processing, and receive your data in a portable form. Email [PLACEHOLDER - needs Christopher: brand email, e.g. hello@lumilabz.co.uk, not yet set up]; we reply within one month. If you have a complaint about how we use your data, please complain to us first at [PLACEHOLDER - needs Christopher: brand email, e.g. hello@lumilabz.co.uk, not yet set up]; we will acknowledge it within 30 days and tell you the outcome. You can also complain to the Information Commissioner's Office: ico.org.uk/make-a-complaint, 0303 123 1113.

Children

The shop is for adults. We do not knowingly collect children's data through this website.

Changes

Version: DRAFT 14 October 2026.