Privacy Policy
This Privacy Policy explains how Lumaworks LLC ("Lumaworks", "we", "us", or "our") collects, uses, and protects information in connection with our software products: Messaging Automation, Attribution Audit, and Post-Purchase Engagement (together, the "Services").
1. Scope
This Policy applies to merchants who install or use the Services ("Merchant", "you") and to the information we process on a Merchant's behalf about that Merchant's end customers ("Store Customers"). It does not apply to third-party websites or platforms we integrate with, which have their own privacy policies.
2. Information We Collect
- Merchant account information — name, business name, email address, and billing details provided when you sign up for or manage a subscription.
- Connected store data — order records, order status, and Store Customer contact information (such as name, email, phone number, and LINE identifiers) retrieved from your connected Shopify store through the Shopify Admin API, to the extent required to operate the Services you enable.
- Usage logs and cookies — technical logs, device and browser information, and cookies or similar technologies used to operate, secure, and measure the performance of the Services and of thank-you page blocks shown on your storefront.
Attribution Audit data minimization. Attribution Audit reads only the order totals, status, sales channel, customer-journey attribution, UTM parameters, and consented first-touch attribution needed to create the Merchant's report. It does not request or store Store Customer names, postal addresses, email addresses, or phone numbers. Diagnostic work records omit order and customer identifiers, are cleared when processing finishes or fails, and the retained report contains aggregated channel and campaign totals rather than customer-level records.
3. How We Use Information
We use the information above to provide, operate, and support the Services; to send messages and offers on your behalf through channels you configure (such as LINE or email); to reconcile advertising conversion data reported by Meta and Google against your store's orders; to bill and manage your subscription; to monitor and improve the security, reliability, and performance of the Services; and to communicate with you about your account.
4. Our Role: Processor, Not Controller
With respect to Store Customer data obtained through your connected store, Lumaworks acts as a data processor (or "service provider" under applicable US state privacy law), and you, the Merchant, act as the data controller. You are responsible for providing appropriate notices to, and obtaining any consents required from, your Store Customers for the processing carried out through the Services. We process Store Customer data only as necessary to provide the Services to you and in accordance with your instructions as configured within the Services.
5. Sharing of Information and Sub-processors
We do not sell information collected through the Services. We share information only with sub-processors engaged to help us deliver the Services, under agreements that require them to protect the data and use it only for the purposes we specify, and as required by law.
| Sub-processor | Role |
|---|---|
| Shopify | Store integration — reads and writes order and customer data via the Shopify Admin API to power connected features. |
| Cloudflare | Hosting and edge delivery for the application, APIs, and background processing infrastructure. |
| Resend | Delivery of transactional and marketing email on behalf of Merchants. |
| LINE | Delivery of messages to Store Customers who have opted in through a Merchant's LINE channel. |
| Meta Ads / Google Ads | Advertising conversion measurement APIs used to reconcile reported ad conversions against store orders. |
6. International Data Transfers
Our infrastructure providers operate global networks, which means information may be processed or stored in countries other than the one in which you or your Store Customers are located, including the United States. Where required, we rely on our sub-processors' standard contractual safeguards for cross-border data transfers.
7. Data Retention
We retain Merchant account information for as long as your account is active and as needed to comply with legal, tax, and accounting obligations after closure. Store Customer data obtained through a connected store is retained only for as long as needed to provide the Services. When you uninstall the Services from your store, we delete or anonymize the associated Store Customer data within a commercially reasonable period, except where retention is required by law or to resolve disputes.
8. Security
We use administrative, technical, and physical safeguards designed to protect information against unauthorized access, disclosure, alteration, or destruction, including encryption in transit, access controls, and reliance on infrastructure providers with independently audited security practices. No method of transmission or storage is completely secure, and we cannot guarantee absolute security.
9. Your Rights (GDPR and CCPA/CPRA)
Depending on your location, you or your Store Customers may have rights under the EU/UK General Data Protection Regulation ("GDPR") or the California Consumer Privacy Act as amended by the California Privacy Rights Act ("CCPA/CPRA"), including the right to access, correct, delete, or export personal data, to restrict or object to certain processing, and to opt out of the sale or sharing of personal data (we do not sell personal data). Merchants seeking to exercise these rights on behalf of their Store Customers, and individuals seeking to exercise these rights directly, may contact us at info@lumaworksllc.com. We will respond in accordance with applicable law.
10. Shopify GDPR Webhooks
As required for apps distributed on the Shopify App Store, we support Shopify's mandatory compliance webhooks: customers/data_request, customers/redact, and shop/redact. When triggered, we locate the relevant Store Customer or shop data held in our systems and provide it to the Merchant or delete it, as applicable, within the timeframes required by Shopify.
11. Children's Privacy
The Services are intended for use by businesses and are not directed to children. We do not knowingly collect personal information directly from children under 13 (or the relevant age of digital consent in your jurisdiction). If you believe a child's information has been provided to us, contact us and we will take appropriate steps to delete it.
12. Changes to This Policy
We may update this Privacy Policy from time to time. Material changes will be reflected by an updated "Last updated" date and, where practical, communicated by email or in-product notice. Continued use of the Services after a change takes effect constitutes acceptance of the updated Policy.
13. Contact
Questions about this Privacy Policy or requests relating to your data can be sent to info@lumaworksllc.com or mailed to Lumaworks LLC, 30 N Gould St Ste N, Sheridan, WY 82801, United States.