Last updated:
Lumidara is operated by AD Ventures LLC, an Arizona limited liability company. In this policy, "we", "us", and "our" refer to AD Ventures LLC, which is responsible for the information described below.
We are committed to protecting the privacy of our users and their clients. This Privacy Policy explains how we collect, use, and safeguard information when you use our Service.
Account information: When you create an account, we collect your email address, business name, phone number, and timezone.
Client data: Business owners enter client information including names, email addresses, phone numbers, and birthdays. This data is owned by the business and stored on their behalf.
Usage data: We collect usage analytics to improve the Service, including pages visited, features used, and session duration.
Session recordings: On our marketing website and the business owner dashboard, we use a third party tool to record how the page is used. This captures mouse movement, clicks, scrolling, typing in non-sensitive fields, and the structure of the page as it changes. Password fields are excluded automatically. We do not record client portal pages, so your clients are not recorded when they book, view rewards, or pay.
Technical data: When you or your clients interact with the Service, we collect IP addresses and basic request metadata used to secure authentication endpoints, enforce rate limits, and detect abuse.
Payment information: Subscription payments are processed by Stripe. Card payments that clients make to a business are processed by that business's own Stripe or Square account. We do not store credit card numbers or banking details on our servers.
Cancellation feedback: When a business cancels its subscription, we optionally collect a reason and free-text feedback to help us improve the Service.
We use collected information to:
Provide and maintain the Service, process subscription payments, send transactional messages (account verification, password resets, portal sign-in verification codes, booking confirmations, appointment reminders, cancellation notices, client welcome emails, and trial-ending notices), send automated campaign emails and appointment reminder texts on behalf of business owners, provide customer support, secure authentication endpoints against abuse, and improve the Service through usage analytics and session recordings.
We do not sell personal information to third parties. We share data only with service providers necessary to operate the platform:
Supabase: database hosting and authentication
Stripe: payment processing
Square: card payment processing, for businesses that connect a Square account
Resend: transactional and campaign emails
Twilio: SMS delivery, including portal authentication codes and appointment reminders
Upstash: rate limiting for authentication endpoints
Vercel: application hosting
Cloudflare: bot protection on sign-in and sign-up forms
Inspectlet: session recordings on the marketing site and owner dashboard
Mobile phone numbers and text message consent collected for appointment reminders are never sold, rented, or shared with third parties or affiliates for their marketing or promotional purposes. The providers above receive this information only to deliver messages for us.
We implement industry-standard security measures including encrypted connections (SSL/TLS), Row Level Security ensuring businesses can only access their own data, secure password hashing, and regular security reviews.
Authentication SMS: When a client signs in to a business's portal, we send a one-time verification code to the phone number they enter. These messages are transactional, sent only at the client's own request, and are never used for marketing.
Appointment reminder SMS: If a business turns on text reminders, we send a reminder before each appointment to clients who have agreed to receive them, usually one message per booking. Reminders are sent from a single Lumidara phone number on behalf of the business named in the message. We record when and how each client agreed, and we never text a client who has not agreed. Message and data rates may apply.
Opting out: Reply STOP to any reminder to stop receiving them, or HELP for help. Because every business on Lumidara sends from the same number, replying STOP stops reminder texts from all of them. We email you a confirmation with instructions for turning texts back on, which you can do at any time by replying START to the same number. You can also turn reminder texts off from your portal account. If you replied STOP, reply START to turn them back on.
No marketing texts: We do not send promotional or marketing text messages. We do not sell or share mobile phone numbers or text message consent with third parties or affiliates for their marketing purposes.
Business data is kept for as long as the account exists. Cancelling a paid plan moves the account to the free Starter plan and deletes nothing.
A business owner can delete their account at any time from their account settings. Deletion is immediate and permanent, and covers the business and its data, including client records, appointments, rewards, and payment history. A few records are kept after deletion: the delivery log of emails and text messages we sent, which is deleted after 13 months, and billing records held by our payment processor for tax and accounting purposes.
You have the right to access, update, or delete your personal information at any time. Business owners can manage their account, clients, and subscription through the dashboard. Clients can manage their email and SMS notification preferences through their portal account, or by using the unsubscribe link included in every marketing email. Business owners can export their client list from the Clients page and delete their account from their account settings. For any other request or privacy concern, please contact us.
We use essential cookies for authentication and session management. This includes a session cookie for business owners signed in to the dashboard, a portal session cookie for clients who have signed in (valid for 30 days), and a short-lived verification cookie used during the portal sign-in flow. We do not use advertising cookies and we do not sell cookie data.
Our session recording tool also sets its own cookies to recognize a returning visitor across pages. To turn session recording off in your browser, visit Inspectlet's opt out page. The setting is stored as a cookie, so clearing cookies requires opting out again.
We may update this Privacy Policy from time to time. We will notify you of material changes via email. Continued use of the Service after changes constitutes acceptance of the updated policy.
The Service is operated by AD Ventures LLC, an Arizona limited liability company, which is the controller for the information described in this policy. Privacy questions or concerns? Contact us.