Privacy Policy

1. Information We Collect

When you use our website or place an order, we may collect:

• Account information: Name, email address, and hashed password when you create an account
• Order information: Name, email, shipping address, items ordered, and payment reference ID
• Contact form submissions: Your name, email, and message
• Cart sessions: Items you add to your cart, tied to an anonymous session ID and optionally to your email if entered at checkout
• Payment confirmations: If you pay by Venmo, Cash App, Apple Cash, or bank transfer, the payer name, amount, and note from the payment confirmation we receive, so we can match your payment to your order
• Email sign-ups: Your email address if you sign up for a discount code or restock alerts

We do not collect or store raw payment card data. Card, Apple Pay, Google Pay, and Klarna payments are entered directly into Stripe’s secure checkout and never touch our servers; we keep only a payment reference ID for order records. Peer-to-peer payments (Venmo, Cash App, Apple Cash) are sent directly to us, and we keep the payment confirmation details described above.

2. How We Use Your Information

We use your information to:

• Process and fulfill your orders
• Send order confirmation and shipping update emails
• Send cart reminder emails if you leave items in your cart (you may opt out by not providing your email at checkout)
• Send marketing emails about restocks, new products, and subscriber sales, only if you sign up for them (see Section 4)
• Respond to contact form inquiries
• Maintain your account and order history
• Prevent fraud and comply with legal obligations

We do not sell or rent your personal information, and we do not share it with third parties for their own marketing purposes. The limited service providers we do share data with — including our advertising measurement providers — are listed in Section 6.

3. Data Storage

Your data is stored in a secure database on our server located in the United States. Passwords are hashed using bcrypt and are never stored in plain text. We implement reasonable technical and organizational measures to protect your personal information. Our site and database are hosted by Railway (railway.app). To print shipping labels and packing slips, order names and shipping addresses are also accessed on our own secured office computer. See Section 8 for full security details.

4. Email Communications

By placing an order, you agree to receive transactional emails related to your order (confirmation, shipping updates). These are required for order fulfillment and cannot be opted out of.

Cart reminder emails are sent only if you provide your email address during the checkout process before completing your order. These are one-time reminders, not marketing newsletters.

If you sign up through our email pop-up for a discount code or restock alerts, we will also send you marketing emails about restocks, new products, and subscriber-only sales. Every marketing email includes an unsubscribe link, and you can also unsubscribe by emailing privacy@luminaresearchlabs.com.

5. Cookies and Local Storage

We use your browser's local storage to maintain your shopping cart, session state, and age verification preference. These are first-party and stay on your device.

We also run Google Ads conversion tracking. If you arrive from one of our ads, Google sets advertising cookies in your browser (for example _gcl_au) so that a later order can be matched back to the ad you clicked, and so Google can recognize you across sites in its advertising network. We strip order tokens, account tokens and other sensitive query parameters out of the page addresses reported to Google, so a link that would grant access to an order or an account is never sent. You can switch off personalized Google advertising at myadcenter.google.com, or block these cookies with your browser settings or an ad blocker — neither affects your ability to browse, order, or check out here. If your browser sends a Global Privacy Control signal, we instruct Google not to use your data for advertising storage or personalization.

We also use the TikTok pixel to measure our TikTok ads. On our shopping pages, TikTok sets cookies in your browser (for example _ttp) and is told which pages you view, which products you look at or add to your cart, when you start checkout, and the total of a paid order, so that an order can be matched back to the TikTok ad that led to it and so TikTok can recognize you across sites and apps in its advertising network. The pixel is not loaded on our checkout, account, login, contact, or order-tracking pages, and it is never loaded on a page whose address still carries an order token, an email address, or another sensitive value. When you pay for an order placed from a browser where the TikTok pixel ran, our server also reports that purchase to TikTok directly, so it counts even if you pay later (for example by Venmo). That report carries the order’s items and value, TikTok’s identifiers from your browser (its cookie, and the ad-click id if you arrived from a TikTok ad, which we keep in a first-party cookie for up to 28 days), your IP address and browser information, and a one-way hashed (SHA-256) copy of your email address, which TikTok uses only to match the purchase to a TikTok account and cannot turn back into your address. You can limit ad personalization in your TikTok app's privacy settings, or block these cookies with your browser settings or an ad blocker — neither affects your ability to browse, order, or check out here. If your browser sends a Global Privacy Control signal, the TikTok pixel is not loaded at all and we do not report your purchases to TikTok.

6. Third-Party Services

We use the following third-party services that may process your personal information:

• Resend (resend.com): Our email delivery provider. Your email address and name are transmitted to Resend solely for the purpose of sending transactional and order-related emails. Subject to Resend's privacy policy.
• Stripe (stripe.com): Our payment processor for card, Apple Pay, Google Pay, and Klarna payments. Stripe receives your email address, billing details, and payment details directly; we never see or store your card number. If you choose Klarna, Klarna receives the information it needs to offer and manage installment payments. Subject to Stripe’s and Klarna’s privacy policies.
• Railway (railway.app): Our hosting provider. Our website and database run on Railway’s servers in the United States.
• Shippo (goshippo.com): Our shipping label provider. Your name, shipping address, and email are transmitted to Shippo to generate shipping labels and tracking. Subject to Shippo's privacy policy.
• Google Ads (google.com): Our advertising and conversion-measurement provider. Google receives your IP address, browser and device information, the pages you view on this site (with sensitive query parameters removed), and details of a completed order such as its total value, so we can tell which ads lead to orders. Google does not receive your name, email address, or shipping address from us. Subject to Google's privacy policy.
• TikTok (tiktok.com): Our advertising and conversion-measurement provider for TikTok ads. TikTok receives your IP address, browser and device information, the shopping pages you view (with sensitive query parameters removed), the products you view or add to your cart, the items and value of a paid order, and a one-way hashed copy of your email address used only for matching. TikTok does not receive your name, your readable email address, phone number, or shipping address from us. Subject to TikTok's privacy policy.
• Google Fonts: Fonts are loaded from Google's CDN. Subject to Google's privacy policy.
• Fontshare (fontshare.com): Additional typefaces are loaded from Fontshare's CDN. No personal data beyond standard request headers (IP address) is transmitted. Subject to Fontshare's privacy policy.

Apart from the Google Ads tag and the TikTok pixel described above, we do not use advertising networks or third-party tracking pixels. Our own site analytics are first-party: they run on our servers, identify visits with random opaque ids rather than your personal information, and are never sold or handed to anyone else.

7. Data Retention

Order records are retained for a minimum of seven (7) years for legal and tax compliance purposes. Account information is retained as long as your account is active. We keep automatic daily backups of our database for disaster recovery; each backup is deleted after 30 days. You may request deletion of your account by contacting us; however, we may retain order records as required by applicable law.

8. Data Security

Your data is stored in a secure database on our server. Passwords are hashed using bcrypt and are never stored in plain text. We implement reasonable technical and organizational measures to protect your personal information against unauthorized access, loss, or misuse.

In the event of a data breach that is likely to result in a risk to your rights and freedoms, we will notify affected users within 72 hours of becoming aware of the breach, to the extent practicable.

No method of transmission over the internet or electronic storage is 100% secure. We cannot guarantee absolute security.

9. Your Rights (General)

Regardless of your location, you may contact us to:

• Access the personal data we hold about you
• Correct inaccurate data
• Request deletion of your data (subject to legal retention requirements)
• Object to certain processing

To exercise these rights, email us at privacy@luminaresearchlabs.com or write to us at:
Lumina Research Labs LLC, Logan, Utah 84321, United States

10. California Privacy Rights (CCPA)

If you are a California resident, you have the following rights under the California Consumer Privacy Act (CCPA):

• Right to Know: You may request that we disclose the categories and specific pieces of personal information we have collected about you, the categories of sources, the business or commercial purpose for collecting it, and the categories of third parties with whom we share it.
• Right to Delete: You may request that we delete personal information we have collected from you, subject to certain exceptions (e.g., information needed to complete a transaction, comply with a legal obligation, or detect security incidents).
• Right to Opt-Out of Sale or Sharing: We do not sell, rent, or trade your personal information for money or other valuable consideration. However, our use of the Google Ads conversion tag and the TikTok pixel described in Section 6 may qualify as “sharing” personal information for cross-context behavioral advertising. To opt out, switch on your browser's Global Privacy Control signal (we honor it automatically), block advertising cookies in your browser, turn off personalized advertising at myadcenter.google.com and in your TikTok app's ad settings, or email privacy@luminaresearchlabs.com and we will honor the request.
• Right to Non-Discrimination: We will not discriminate against you for exercising any of your CCPA rights. We will not deny you goods or services, charge you different prices, or provide a different level of quality because you exercised your privacy rights.
• Right to Correct: You may request that we correct inaccurate personal information we hold about you.

Categories of personal information we collect: Identifiers (name, email, IP address); commercial information (order history, products purchased); internet or other electronic network activity (cart sessions, login events); and geolocation data (shipping address).

How to submit a CCPA request: Email privacy@luminaresearchlabs.com with the subject line "CCPA Request" and describe your request. We will respond within 45 days. We may need to verify your identity before processing your request.

11. Children's Privacy (COPPA)

Our website is not directed to individuals under 21 years of age. We do not knowingly collect, use, or disclose personal information from anyone under the age of 21. All visitors are required to confirm they are 21 or older before accessing the site. If you believe we have inadvertently collected information from a minor under 13, please contact us immediately at privacy@luminaresearchlabs.com and we will delete it promptly.

12. Changes to This Policy

We may update this Privacy Policy from time to time. The date of the most recent revision appears at the top of this page. We will notify registered users of material changes by email. Continued use of the website after changes constitutes acceptance of the updated policy.

13. Contact Us

If you have any questions about this Privacy Policy or how we handle your data, please contact us at:
Email: privacy@luminaresearchlabs.com
Mail: Lumina Research Labs LLC, Logan, Utah 84321, United States