Privacy Policy

Lumera GlobalTech Limited, a company incorporated under the laws of Hong Kong Special Administrative Region ("Lumera", "we", "us", or "our"), operates the Lumera platform, including our website at lumeraglobal.co, mobile application, and letter subscription services (collectively, the "Services"). This Privacy Policy explains how we collect, use, disclose, retain, and protect your personal information. By accessing or using our Services, you acknowledge that you have read, understood, and agree to be bound by this Privacy Policy. If you do not agree, you must immediately discontinue use of the Services. This Policy applies to all users worldwide, including users in the European Economic Area, United Kingdom, California, and other jurisdictions with specific privacy legislation.

Lumera GlobalTech Limited is the data controller responsible for your personal information. For privacy-related inquiries, contact us at: support@lumeraglobal.net. Registered address: Unit C31, 5/F, Mai Gar Industrial Building, 146 Wai Yip Street, Kwun Tong, Kowloon, Hong Kong. For users in the European Economic Area, we process your data on the basis of (a) contractual necessity, (b) legitimate interests, and (c) your consent where required.

• Account and Identity Data: Full name, email address, phone number, account password (stored exclusively as a bcrypt hash — we never store plaintext passwords), country of residence, and preferred language.
• Recipient Data (Sensitive): Information about a recipient you designate for the Service, including their full name, recipient reference number, delivery-related details, and content preferences. This data is subject to heightened protection.
• Subscription and Billing Data: Where you use a platform or website that offers a purchase, subscription tier, billing cycle, payment history, and transaction identifiers. We do not store full payment card numbers, CVV codes, or bank account details. For iOS in-app purchases, Apple processes payment and Lumera receives only the transaction and subscription information needed to validate your purchase and provide the applicable service. The current Android version does not offer Android in-app purchases or Google Play Billing. Antom processes website payments under its own privacy and security standards.
• Device and Technical Data: Device type and model, operating system and version, unique device identifiers, Internet Protocol (IP) address, browser type and version, mobile network information, time zone, and application version.
• Usage Data: Pages and features accessed, timestamps of interactions, session duration, click-stream data, error logs, and crash reports. This data is collected to improve service reliability and user experience.
• Communications Data: Records of your correspondence with our support team, including emails, WhatsApp messages, and in-app messages.
• Notification Data: Where a platform supports and you enable service notifications, device push-notification token, platform, and notification preferences. The current Android version does not register Android push-notification tokens or provide Android native push notifications.
• Data We Do NOT Collect: We do not collect biometric data, precise geolocation data, financial account numbers, government-issued identification numbers (such as passport or national ID), or data from third-party social networks. We do not use advertising cookies or cross-site tracking technologies.

• In compliance with applicable mobile app store requirements, the following is a summary of data collected by our application:
• Contact Info: Name and email address — used for account management and service delivery.
• User Content: Designated recipient information and content preferences — used solely to provide the Service and complete requested delivery.
• Identifiers: User ID and device ID — used for authentication and service operation.
• Usage Data: App interaction data — used for analytics and service improvement.
• Diagnostics: Crash data and performance data — used to improve app stability.
• Purchase History: Where an app platform offers in-app purchases, subscription transaction identifiers and subscription status — used to validate an in-app purchase and provide the applicable service. The current Android version does not offer Android in-app purchases.
• No data collected by Lumera is used for third-party advertising or sold to data brokers. No data is linked to you for the purpose of tracking you across third-party apps or websites.

• Service Delivery: To provide, operate, and maintain the Service, including processing your subscription where available, preparing and dispatching requested letters to designated recipients, and managing your account.
• Payment Processing: For in-app subscriptions purchased on iOS, Apple App Store processes payment, billing, cancellation, and refund requests under Apple’s applicable terms. The current Android version does not offer Android in-app purchases or Google Play Billing. Antom processes website payments and billing. Lumera uses the minimum transaction and subscription information needed to validate service eligibility and maintain your account’s entitlement.
• Communications and notifications: To send transactional communications (account confirmations, subscription notices, delivery updates) and, when a supported platform and the user have enabled them, push notifications. The current Android version does not provide Android native push notifications. You may manage available non-essential notification preferences through the application or contact us at support@lumeraglobal.net.
• Service Improvement: To analyze usage patterns, diagnose technical issues, and improve the functionality, performance, and security of our Services.
• Legal Compliance: To comply with applicable laws, regulations, court orders, and lawful requests from governmental authorities.
• Fraud Prevention and Security: To detect, investigate, and prevent fraudulent transactions, unauthorized access, and other illegal activities.
• We do not use your personal information for automated decision-making that produces legal or similarly significant effects without human review.

• We do not sell, rent, or trade your personal information to any third party for commercial purposes.
• Service Providers: We engage trusted third-party service providers who process data on our behalf under strict contractual data processing agreements. These include Apple App Store (iOS in-app purchase processing and subscription records), Antom (website payment processing), cloud infrastructure providers (data hosting and storage), and email delivery services. The current Android version does not use Google Play for Android in-app purchase processing. These providers are prohibited from using your data for any purpose other than providing services to us.
• Delivery Recipients: We disclose only the recipient and delivery information necessary to complete a requested delivery to the relevant receiving party. That receiving party may handle information it receives under its own policies, which are outside our control.
• Legal Obligations: We may disclose your information when required to do so by applicable law, regulation, legal process, or enforceable governmental request, including in response to court orders, subpoenas, or law enforcement requests. Where legally permissible, we will notify you of such disclosure.
• Business Transfers: In the event of a merger, acquisition, reorganization, bankruptcy, or sale of all or substantially all of our assets, your information may be transferred to the acquiring entity. We will provide notice before your information is transferred and becomes subject to a different privacy policy.
• Protection of Rights: We may disclose information where we believe in good faith that disclosure is necessary to protect the rights, property, or safety of Lumera, our users, or the public.

Designated recipient information — including name, recipient reference number, delivery-related details, and content preferences — is treated as sensitive personal data and is subject to heightened protection within our systems. This data is: (a) accessible only to personnel who require it for service delivery; (b) never used for marketing, analytics, profiling, or any secondary purpose; (c) disclosed only to the extent strictly necessary to complete a requested delivery; and (d) deleted in accordance with our data retention schedule upon account closure.

• Account Data: Retained for the duration of your active account. When you confirm account deletion in the Lumera app, we delete or irreversibly anonymize your personal account data and associated member data without undue delay, except where retention is required by applicable law.
• Letter Records: When you delete your account, your member-linked letters, drafts, recipient information, notification settings, and device push-notification tokens are deleted or irreversibly anonymized without undue delay. Delivery, security, or transaction records that must be retained are access-restricted and no longer used to provide the deleted account with services.
• Financial Records: Transaction records may be retained for up to 7 years to comply with applicable tax and accounting laws.
• Legal Hold: Notwithstanding the above, we may retain data for longer periods where required by law, regulation, or in connection with legal proceedings.
• Anonymized Data: We may retain anonymized, aggregated data that cannot reasonably be used to identify you for an indefinite period for statistical and analytical purposes.

• Subject to applicable law, you have the following rights regarding your personal data:
• Right of Access: You may request a copy of the personal data we hold about you.
• Right of Rectification: You may request correction of inaccurate or incomplete data.
• Right of Erasure: If you are signed in, you can delete your account directly in the Lumera app by opening Account, choosing Delete Account, entering your current password, and confirming the deletion. The deletion cannot be undone. If you cannot sign in, you may use the public process at lumeraglobal.co/data-deletion or email support@lumeraglobal.net from your registered email address with the subject line 'Account and Data Deletion Request'. We may require identity verification for an email request. Account deletion does not cancel an active subscription purchased through a platform or website that offers one; you must manage or cancel it through the original purchase channel. The current Android version does not offer Android in-app subscriptions.
• Right to Restrict Processing: You may request that we limit processing of your data in certain circumstances.
• Right to Data Portability: You may request your data in a structured, commonly used, machine-readable format.
• Right to Object: You may object to processing based on legitimate interests.
• Right to Withdraw Consent: Where processing is based on consent, you may withdraw consent at any time without affecting the lawfulness of prior processing.
• To exercise any of these rights, contact us at support@lumeraglobal.net. We will respond within 30 days. We may require identity verification before processing your request.

We implement and maintain commercially reasonable technical, administrative, and organizational security measures designed to protect your personal information from unauthorized access, disclosure, alteration, and destruction. These measures include: SSL/TLS encryption for all data in transit; AES-256 encryption for sensitive data at rest; bcrypt hashing for all passwords; role-based access controls limiting data access to authorized personnel; regular security assessments and penetration testing; and incident response procedures. HOWEVER, NO METHOD OF TRANSMISSION OVER THE INTERNET OR METHOD OF ELECTRONIC STORAGE IS 100% SECURE. WE CANNOT GUARANTEE ABSOLUTE SECURITY. IN THE EVENT OF A DATA BREACH THAT IS LIKELY TO RESULT IN A HIGH RISK TO YOUR RIGHTS AND FREEDOMS, WE WILL NOTIFY YOU AND RELEVANT AUTHORITIES AS REQUIRED BY APPLICABLE LAW.

We use strictly necessary session cookies solely to maintain your authenticated login state. We do not use advertising cookies, behavioral tracking cookies, or third-party analytics cookies. We do not participate in cross-site tracking or interest-based advertising. We do not use fingerprinting technologies. You may disable cookies in your browser settings; however, disabling session cookies will prevent you from logging into the Services. Our cookie usage is limited to what is technically necessary for the Services to function.

Our Services are strictly intended for individuals who are 18 years of age or older. We do not knowingly collect, solicit, or retain personal information from individuals under the age of 18. If we become aware that we have inadvertently collected personal information from a person under 18, we will take immediate steps to delete such information from our systems. If you are a parent or guardian and believe that your child has provided us with personal information, please contact us immediately at support@lumeraglobal.net.

Lumera GlobalTech Limited is incorporated in Hong Kong. Your personal information may be transferred to, stored in, and processed in Singapore, Hong Kong, or other jurisdictions where our service providers maintain operations. These jurisdictions may have data protection laws that differ from those in your country of residence. Where we transfer data internationally, we implement appropriate safeguards, including contractual protections, to ensure your data receives a level of protection consistent with this Privacy Policy. By using our Services, you consent to such transfers.

TO THE MAXIMUM EXTENT PERMITTED BY APPLICABLE LAW, LUMERA'S TOTAL LIABILITY ARISING OUT OF OR IN CONNECTION WITH THIS PRIVACY POLICY OR THE PROCESSING OF YOUR PERSONAL DATA SHALL NOT EXCEED THE GREATER OF (A) THE TOTAL SUBSCRIPTION FEES YOU PAID TO LUMERA IN THE THREE (3) MONTHS IMMEDIATELY PRECEDING THE EVENT GIVING RISE TO THE CLAIM, OR (B) USD $100. THIS LIMITATION APPLIES REGARDLESS OF THE FORM OF ACTION, WHETHER IN CONTRACT, TORT, STRICT LIABILITY, OR OTHERWISE, AND EVEN IF LUMERA HAS BEEN ADVISED OF THE POSSIBILITY OF SUCH DAMAGES. SOME JURISDICTIONS DO NOT ALLOW THE EXCLUSION OR LIMITATION OF CERTAIN DAMAGES; IN SUCH JURISDICTIONS, OUR LIABILITY SHALL BE LIMITED TO THE MAXIMUM EXTENT PERMITTED BY LAW.

We reserve the right to update this Privacy Policy at any time. For material changes, we will provide at least 30 days advance notice by posting the updated Policy on this page with a revised effective date and, where we have your email address, by sending an email notification. For non-material changes, we will update the effective date without separate notice. Your continued use of the Services after the effective date of any changes constitutes your acceptance of the updated Policy. If you do not agree to the updated Policy, you must stop using the Services and may request deletion of your account.

• For privacy-related inquiries, data subject requests, or concerns about this Privacy Policy, contact Lumera's data protection contact at:
• Email (Privacy / DPO contact): support@lumeraglobal.net
• Address: Unit C31, 5/F, Mai Gar Industrial Building, 146 Wai Yip Street, Kwun Tong, Kowloon, Hong Kong
• Subject line for data requests: 'Privacy Request — [Your Registered Email]'
• We aim to respond to all privacy inquiries within 30 days. For urgent matters, include 'URGENT' in your subject line.