Skip to main content

Privacy Policy

Version: v1.0

Last Updated: January 10, 2026

At a Glance: We only collect data necessary to provide our services to you. We do not sell your personal information, do not use third-party ad tracking, and our analytics system is entirely self-hosted. You can view, modify, or delete your data at any time. If you choose to pay with cryptocurrency, please note that blockchain transaction records are permanently public — see Section 10 for details.

LumaLark LLC (a limited liability company organized under the laws of the State of Wyoming, USA, hereinafter referred to as "LumaLark" or "we") is the data controller of your personal data.

We respect your privacy and are committed to protecting the personal information you share with us. This Privacy Policy explains how we collect, use, disclose, and protect your information when you visit our website www.lumalark.com and use our services.

Please read this policy carefully before using our services. For data processing activities that require your explicit consent (such as marketing communications and non-essential cookies), we will seek your permission through dedicated consent mechanisms. If you have any questions about any part of this policy, please feel free to contact us at any time (see Section 17).

1. Information We Collect

Information You Provide to Us

  • Account Information: Name and email address provided when creating an account. Login is processed through our self-hosted secure authentication system. Your password is stored in encrypted form, and none of our employees can view your plaintext password
  • Order Information: Shipping address, billing address, phone number, payment details (securely processed by our third-party payment service provider)
  • Communication Data: Messages you send to our customer service team and product reviews
  • Email Subscription: Email address provided when subscribing to our newsletter and your explicit consent record
  • Designer Application: Portfolio, social media profiles, and design submissions provided when applying to join the designer program

Community Forum Data

We operate a community forum at www.lumalark.com/community/forum (hereinafter referred to as the "Forum"). The Forum uses the same identity authentication system as the main site (OIDC single sign-on), so you do not need to create a separate forum account. When you use the Forum, we may collect:

  • Forum Profile: Username, avatar, bio (set by you at your discretion)
  • Forum Content: Posts, replies, and private messages you publish
  • Forum Interaction Data: Likes, bookmarks, topic follows
  • Forum Usage Data: Login records, IP addresses, reading history, notification preferences

The Forum is a self-hosted deployment, and all forum data is stored on our own servers, subject to all terms of this Privacy Policy. Posts and replies you publish on the Forum are public content and can be viewed by other forum users. Private messages are visible only to the sender and recipient.

Information Collected Automatically

  • Device and Browser Data: IP address, browser type and version, operating system, device type
  • Usage Data: Pages visited, time spent on pages, click behavior, referral sources (applicable to both the main site and the Forum)
  • Cookies and Similar Technologies: See Section 4 below for details

Blockchain Payment Data

When you choose to use blockchain payment methods, the following data will be generated during the payment process:

  • Blockchain wallet address
  • On-chain transaction records and transaction hash values

Important Notice: Blockchain transaction records are public information and once recorded on-chain will permanently exist and cannot be deleted, modified, or reversed. For detailed information about blockchain payments, please refer to Section 10.

2. How We Use Your Information

The following outlines our data processing purposes and corresponding legal bases:

  • Order Fulfillment: Processing payments, shipping products, sending order confirmations and shipping notifications (Why we can do this: This is necessary to complete your order)
  • Account Management: Maintaining your account, order history, and preference settings (Why we can do this: This is necessary to provide you with account services)
  • Communication: Responding to inquiries, sending service-related notifications, providing customer support (Why we can do this: This is necessary to provide you with customer service)
  • Marketing: Sending newsletters, promotional offers, and new product announcements (Why we can do this: Only done with your explicit consent, which you may withdraw at any time)
  • Service Improvement: Analyzing usage patterns to improve website functionality and experience (Why we can do this: Based on our legitimate business interest in improving our services (see explanation below))
  • Fraud Prevention: Detecting and preventing fraudulent transactions and unauthorized access (Why we can do this: Based on our legitimate need to protect the security of your and our transactions (see explanation below))
  • Legal Compliance: Complying with applicable laws, regulations, and legal processes (Why we can do this: The law requires us to do so)

GDPR Technical Reference: The legal bases listed above correspond to the following under GDPR Art. 6(1): performance of a contract (b), consent (a), legitimate interests (f), and legal obligation (c).

About Legitimate Business Needs (Legitimate Interests): For Improving Services and Fraud Prevention, we have assessed and confirmed that they do not unreasonably impact your privacy rights. You have the right to contact us at any time for more details, and you also have the right to request that we stop using your data on this basis.

3. How We Share Your Information

We do not sell your personal information to third parties.

We may share your information with the following parties:

  • Service Providers: Partners who help us operate our business. These partners only access your data when fulfilling their service responsibilities and are bound by Data Processing Agreements (DPAs). Our main data processors include:
  • Airwallex: Card and local payment processing (Data processing location: Australia/Global)
  • Amazon Web Services: Server hosting and transactional email delivery (Data processing location: United States)
  • Cloudflare: Content delivery and object storage (Data processing location: Global (nearest node))
  • Destination Logistics Carriers: Last-mile delivery of orders (Data processing location: Respective destination countries/regions)

Our blockchain payment feature uses a self-hosted technical solution (PayRam). Payment data is processed on our own servers and is not transmitted to third-party payment service providers.

Last-mile delivery for orders is handled by local logistics carriers in each destination country/region. We provide the necessary shipping information (recipient name, address, phone number) to the corresponding carrier based on your delivery address. The specific carrier may vary depending on the order destination.

A complete and continuously updated list of sub-processors is available upon request at [email protected] . We will update this list when we add or replace sub-processors.

  • Legal Requirements: When required by law, court order, or government authority, or when necessary to protect our rights, property, or safety
  • Business Changes: In the event of a merger, acquisition, or asset sale, your information may be transferred as part of the transaction. We will notify you before any such transaction is completed

4. Cookie Policy

What Are Cookies?

Cookies are small text files stored on your device when you visit our website. They help us provide a better experience by remembering your preferences and understanding how you use our website.

Cookies We Use

  • Essential Cookies: Purpose: Required for the website to function properly (shopping cart, authentication, security); Examples: Session ID, CSRF token, language preference, cookie consent status; Duration: Session to 1 year
  • Analytics Cookies: Purpose: Help us understand how visitors use the website; Examples: Page views, navigation paths, error tracking; Duration: 13 months

Note: We use a self-built analytics system, and all analytics data is stored on our own servers and is not transmitted to any third-party analytics service providers. We currently do not use marketing cookies or third-party advertising tracking cookies. If such cookies are introduced in the future, we will update this policy and obtain your consent.

Managing Cookies

When you first visit our website, you will see a Cookie Consent Banner, where you can choose to accept or reject non-essential cookies (analytics). Essential cookies do not require consent, as they are necessary for the website to function properly.

Cookie consent is valid for 12 months. After expiration, we will ask for your consent again. You can modify your preferences at any time through the Cookie Settings link in the website footer.

You can also further control cookies through your browser settings:

  • Block all cookies: May cause some website features to not function properly
  • Block third-party cookies: Blocks analytics cookies while maintaining basic functionality
  • Clear cookies: Removes existing cookies from your browser

Do Not Track Signals

We respect Do Not Track (DNT) signals sent by your browser. When a DNT signal is detected, we will not load non-essential analytics cookies.

5. Data Security

We take appropriate technical and organizational measures to protect your personal information, including:

  • Encryption in transit: All data transmitted between your browser and our servers is encrypted via TLS/SSL
  • Encryption at Rest: Personal data stored on our servers is encrypted at rest using industry-standard encryption techniques, ensuring that even if physical storage media were obtained, the data could not be read
  • Payment Security: We do not store credit card numbers. Payment processing is handled by PCI-DSS compliant third-party service providers
  • Authentication Security: User login credentials are processed through a self-hosted OIDC identity authentication system. Passwords are stored using cryptographic hashing, and no one (including our employees) can access plaintext passwords
  • Access Control: Employee access to personal data is restricted to those who require it for their job responsibilities
  • Regular Reviews: We regularly review our security measures and update them as needed

While no system can be absolutely secure, we continuously invest resources to ensure your data protection meets the highest industry standards.

6. Data Breach Notification

In the event of a security incident involving your personal data, we will:

  • Within 72 hours of discovery (in accordance with GDPR Art. 33, UK GDPR, and other applicable legal requirements)
  • Promptly notify potentially affected users via email — explaining what happened, what data may be involved, what remedial measures we have taken, and what protective steps you can take
  • Document all data breach incidents and our response measures

7. Your Rights

Fundamental Rights for All Users

As part of our commitment to privacy protection, we voluntarily extend the following rights to all users, even if the laws in your region do not yet require us to do so:

  • Right of Access: Request a copy of the personal data we hold about you
  • Right to Rectification: Request correction of inaccurate or incomplete data
  • Right to Erasure: Request deletion of your personal data (subject to legal obligations and technical limitations — in particular, data on the blockchain cannot be deleted; see Section 10 for details)
  • Right to Unsubscribe: Opt out of marketing emails at any time via the Unsubscribe link in the email or by contacting us
  • Right to Withdraw Consent: For data processing based on consent (such as marketing communications and non-essential cookies), you have the right to withdraw your consent at any time. Withdrawal of consent does not affect the lawfulness of processing carried out based on consent prior to the withdrawal
  • Right to Data Portability: Request your data in a structured, commonly used, machine-readable format
  • Right to Restriction of Processing: Request that we restrict how we use your data
  • Right to Object: Object to data processing based on legitimate interests (including processing for service improvement and fraud prevention)

How to Exercise Your Rights:

  • Self-Service: You can directly edit your personal information, manage notification preferences, export order data, or delete your account in your account settings
  • Contact Us: For requests not covered by the self-service features above, please send an email to [email protected]

To protect your account security, we will verify the requester's identity through your registered email address or recent order information. We will respond to your request within one calendar month. If a complex request requires more time, we will notify you within that period, and the extended processing time will not exceed an additional two months.

Rights of European Economic Area Residents (GDPR)

If you are located in the European Economic Area (EEA), in addition to the rights listed above, you are entitled to the following protections:

We process your data based on the following legal bases (see the purpose-basis mapping table in Section 2 for details):

  • Consent (Art. 6(1)(a)): For marketing communications and non-essential cookies
  • Performance of a Contract (Art. 6(1)(b)): For processing your orders and managing your account
  • Legitimate Interests (Art. 6(1)(f)): For fraud prevention and service improvement
  • Legal Obligation (Art. 6(1)(c)): For tax and regulatory compliance

If you believe that our processing of your personal data infringes upon your rights, you have the right to lodge a complaint with the data protection supervisory authority in your country. A list of supervisory authorities in EU member states is available on the European Data Protection Board (EDPB) website.

EU Data Protection Representative: Based on our current business scale, our processing of personal data of EU data subjects is occasional in nature, and we are exempt from appointing an EU data protection representative pursuant to Article 27(2)(a) of the GDPR. Our website currently does not offer localized content in official EU languages, nor do we conduct targeted marketing toward the EU market. EU data subjects may exercise their data protection rights by contacting [email protected] , and we will ensure the same response speed and level of service. We continuously monitor our EU business scale, and when the threshold requiring the appointment of a representative is reached, we will promptly complete the appointment and publish their name and contact details in this section.

Rights of UK Residents (UK GDPR)

If you are located in the United Kingdom, your personal data is protected by the UK General Data Protection Regulation (UK GDPR) and the Data Protection Act 2018. You enjoy the same data protection rights as residents of the European Economic Area.

For data transfers between the UK and third countries, we use the UK International Data Transfer Agreement or UK Addendum as safeguards.

If you believe we have improperly handled your data, you have the right to file a complaint with the UK Information Commissioner's Office (ICO).

California Residents' Rights (CCPA/CPRA)

Under the California Consumer Privacy Act and its amendment, the California Privacy Rights Act, California residents have the following rights:

  • Right to Know: To know what categories of personal information we collect, the sources of collection, the business purposes for collection, and the categories of third parties with whom it is shared
  • Right to Delete: To request deletion of your personal information
  • Right to Correct: To request correction of inaccurate personal information
  • Right to Opt-Out: To opt out of the sale or sharing of personal information (we do not sell or share personal data)
  • Right to Limit Use of Sensitive Information: To limit the use and disclosure of sensitive personal information
  • Right to Non-Discrimination: To not be treated in a discriminatory manner for exercising privacy rights

Sensitive Personal Information: In our business operations, sensitive personal information that may be involved includes payment account information (processed by third-party payment service providers; we do not store it directly) and precise geolocation data (only involved when you provide a shipping address). We use sensitive personal information only to the extent necessary to provide our services.

Agent Requests: You may authorize an agent to submit privacy rights requests on your behalf. The agent must provide a written authorization signed by you (electronic signatures are accepted), and we may verify with you directly to confirm the authenticity of the authorization.

"Do Not Track" and "Do Not Sell My Personal Information": We do not sell your personal information. We respect browser "Do Not Track" signals (see Section 4 for details). You can manage your data sharing preferences through the Cookie Settings in the website footer, or contact us by emailing [email protected] .

Rights of Canadian Residents (PIPEDA)

If you are located in Canada, your personal information is protected under the Personal Information Protection and Electronic Documents Act (PIPEDA). You have the right to:

  • Access the personal information we hold about you
  • Challenge the accuracy and completeness of the information
  • Withdraw consent for specific data processing activities (subject to legal and contractual limitations)

To exercise your rights or file a complaint, please contact [email protected]. You also have the right to file a complaint with the Office of the Privacy Commissioner of Canada (OPC).

8. Automated Decision-Making

We currently do not engage in solely automated decision-making (including profiling) that produces legal effects or similarly significant impacts on you. If such processing is introduced in the future, we will update this policy and seek your consent where necessary, while ensuring your right to obtain human intervention and review.

9. Data Retention

We have established corresponding retention periods for different categories of data:

  • Account Data: For the duration of the account; deleted or anonymized within 30 days after account cancellation (Basis: Contract Performance)
  • Order and Transaction Data: Retained for 7 years after order completion (Basis: Tax and Financial Regulatory Requirements)
  • Customer Service Communication Records: Retained for 3 years after the last communication (Basis: Dispute Resolution)
  • Marketing Subscription Data: Until you unsubscribe; deleted within 30 days after unsubscription (Basis: Consent Withdrawal)
  • Analytics Data: Retained for 26 months after collection, then automatically anonymized (Basis: Legitimate Interest)
  • Designer Application Data: For unsuccessful applications, retained for 12 months from the date of notification and then deleted; for successful applications, managed as part of the data during the designer partnership (Basis: Legitimate Interest)
  • Forum Data: For the duration of the account; after account cancellation, posts are retained but anonymized (username replaced with Deactivated User), and private messages are deleted within 30 days (Basis: Contract Performance)
  • Blockchain Transaction Records: Permanent (on-chain data is immutable; see Section 10) (Basis: Technical Irreversibility)

If you cancel your account, we will within 30 days delete or anonymize your deletable personal data, unless a longer statutory retention period is specified in the table above.

10. Supplementary Terms for Blockchain Payments

10.1 Scope of Application

This section applies when you choose to use blockchain (cryptocurrency) payment methods to complete a purchase. If you use traditional payment methods (such as credit cards), this section does not apply to you.

10.2 Notice of Data Irreversibility

Blockchain is a decentralized distributed ledger technology. When you complete a payment via blockchain, the following data will be permanently recorded on the public blockchain:

  • Your wallet address
  • Transaction amount
  • Transaction hash
  • Transaction timestamp

Please note: Once generated, these on-chain data become permanent records — no one, including LumaLark, can delete, modify, or reverse them. These records are public, and anyone can view them through a blockchain explorer.

This means that we are unable to fulfill deletion or correction requests for transaction data already recorded on the blockchain. However, what we can do is: remove the association between your wallet address and your personal identity information in our systems — so that even though the on-chain records still exist, they cannot be traced back to you.

10.3 Explicit Consent Mechanism

Before you use a blockchain payment method for the first time, we will present you with a dedicated risk disclosure page that clearly explains the irreversible nature of the data described above. You must actively check the box to confirm that you understand and accept the above risks before proceeding with the blockchain payment.

During periods when traditional payment methods are temporarily unavailable due to maintenance or other reasons, if blockchain payment is the only available payment method, the above disclosure and confirmation steps still apply. If you do not wish to generate irreversible blockchain transaction records, you may choose to wait until traditional payment methods are restored before completing your purchase. We will post a notice on the website checkout page once traditional payment methods are restored.

10.4 Data Minimization

We store only the minimum blockchain-related data necessary to fulfill orders in our off-chain systems. When you exercise your right to deletion, we will:

  • Remove the association between wallet addresses and your personally identifiable information in off-chain systems
  • Retain only transaction hashes as part of order records (subject to the order data retention periods specified in Section 9)
  • Be unable to perform any deletion or modification operations on on-chain data

10.5 Data Protection Impact Assessment

We have conducted a Data Protection Impact Assessment (DPIA) for data processing activities related to blockchain payments. In accordance with GDPR Art. 35, we have assessed the potential risks of such processing activities to the rights and freedoms of data subjects and have adopted the risk mitigation measures described in this section (explicit consent mechanisms, data minimization, and provision of non-blockchain alternatives). The DPIA documentation is available upon request by regulatory authorities.

11. Children's Privacy

Our services are not directed at minors. Specifically:

  • In the European Economic Area and the United Kingdom, we do not target individuals under the age of 16
  • In the United States, pursuant to the Children's Online Privacy Protection Act (COPPA), we do not target children under the age of 13
  • In other regions, we comply with the minimum age requirements stipulated by local laws

We do not knowingly collect personal information from minors. If we discover that we have collected data from a minor who does not meet the age requirements stated above, we will delete it immediately. If you believe we may hold data of a minor, please contact [email protected].

12. Cross-Border Data Transfers

Your information may be transferred to and processed in countries other than your country of residence. Your data is primarily stored on servers in the United States.

Data Transfer Destinations and Safeguards

  • United States: Payment processing, order management, business operations (Safeguards: EU Standard Contractual Clauses (SCCs); UK International Data Transfer Agreement (UK IDTA))
  • Global (Cloudflare Nodes): Content delivery and object storage acceleration (Safeguards: Cloudflare Customer DPA and the SCCs contained therein)
  • Blockchain Networks: Blockchain payment transaction records (limited to users who choose blockchain payments) (Safeguards: See Section 10 — On-chain data is public information distributed across global nodes)

Before conducting cross-border data transfers, we perform a Transfer Impact Assessment, evaluating the level of data protection in the receiving country and implementing supplementary safeguards where necessary to ensure your data receives a level of protection equivalent to that in the EU/UK.

13. Third-Party Links

Our website may contain links to third-party websites (including but not limited to social media platforms and community forums). We are not responsible for the privacy practices of these websites. We recommend that you review the privacy policy of any third-party website you visit.

14. Policy Updates

We may update this Privacy Policy from time to time. When we do, we will:

  • Update the version number and Last Updated date at the top of the page
  • For significant changes, notify you via email or a prominent notice on the website
  • Where reasonable, allow you time to review the new policy before the changes take effect

15. Governing Law and Dispute Resolution

This Privacy Policy is governed by the laws of the State of Wyoming, United States. Any disputes related to this Policy shall first be resolved through amicable negotiation. If negotiation fails, both parties agree to submit the dispute to a court of competent jurisdiction in Wyoming.

The above jurisdictional provisions do not affect the rights of consumers in the EU, UK, Canada, or other jurisdictions under applicable mandatory local laws, including the right to bring proceedings before local courts and the right to file complaints with local data protection authorities. EU consumers may also submit complaints through the EU Online Dispute Resolution Platform (EU ODR Platform).

16. Language and Translation

The original language of this Privacy Policy is English. We provide versions in other languages through automated translation systems for the convenience of our global users. In the event of any inconsistency or ambiguity between language versions, the English version shall prevail.

In the event of legal proceedings, if the court of jurisdiction requires a version in another language, we will provide a reviewed translation.

17. Contact Us

If you have any questions about this Privacy Policy or our data handling practices, please contact us:

  • Privacy Inquiry Email: [email protected]
  • General Inquiry Email: [email protected]
  • EU Data Protection Representative: Based on current business scale, designation is exempt under GDPR Article 27(2)(a). EU residents may contact us via the privacy inquiry email