Last reviewed: 1 September 2026
This policy explains what personal information Luma Bio collects, why, who it is shared with, and what you can ask us to do with it. It covers lumabio.us and any order placed through it.
Who is responsible for your data
Luma Bio is the controller of the personal information described here. For any question about this policy, or to exercise a right under it, contact lumabiowellness@gmail.com.
What we collect
Information you give us
- Account: name, email address, password (stored hashed, never in readable form)
- Orders: billing and delivery address, phone number, order contents, order notes
- Correspondence: anything you send us by email, including support and documentation requests
Information collected automatically
- Technical: IP address, browser and device type, pages requested, timestamps — recorded in server logs
- Functional cookies: set by our store software to keep your cart and session working
What we do not collect
We do not run analytics, advertising, remarketing, social media or behavioural tracking on this site. There are no third-party trackers, no advertising pixels and no cross-site profiling. We do not sell or rent personal information, and we do not share it for cross-context behavioural advertising.
We never see or store your full payment card details. Payment is handled by our payment provider, which processes card data directly.
Why we use it
- To process, fulfil and deliver your orders, and to contact you about them
- To operate your account and let you see your order history
- To answer support enquiries and supply batch documentation you request
- To verify eligibility and screen orders for compliance with our Research Use Policy
- To prevent, detect and investigate fraud and misuse
- To keep tax, accounting and regulatory records we are required to keep
- To secure and maintain the website
We rely on the performance of our contract with you for order processing, on our legitimate interests in operating a secure and lawful business for fraud prevention and compliance screening, and on legal obligation for record keeping. Where we ask for consent, you can withdraw it at any time.
Who we share it with
We share personal information only with parties who need it to deliver the service, and only as much as they need:
- Your bank and ours — payment is made by bank transfer or Zelle, so your bank and ours see the transfer and its reference. We do not use a card processor and we never see or store card details
- Shipping carriers — name, delivery address and phone number, to deliver your order
- Hosting and infrastructure — our web host and backup storage provider, which hold data at rest on our behalf
- Professional advisers and authorities — where we are legally required to disclose, or need to establish or defend a legal claim
One third party is involved simply in rendering the site: typefaces are loaded from Google Fonts, which means your browser makes a request to Google’s servers and Google receives your IP address as part of that request. No other third-party asset is loaded.
Cookies
We use only cookies that are necessary for the site to function — keeping items in your cart, keeping you logged in, and carrying you through checkout. There are no analytics or advertising cookies to opt out of. Blocking functional cookies in your browser will break the cart and checkout.
How long we keep it
- Order and transaction records: for as long as tax and accounting law requires, typically seven years
- Account data: while your account is open, and for a short period after closure to settle any outstanding matters
- Correspondence: normally 24 months from the last contact
- Server logs: a short rolling window, then overwritten
Backups are retained on a rolling schedule and are overwritten in turn, so deleted data can persist in a backup for a limited period before it is cycled out.
Your rights
Depending on where you live, you may have the right to ask us to:
- Confirm what personal information we hold about you, and give you a copy
- Correct information that is wrong or incomplete
- Delete information we no longer have a lawful reason to keep
- Restrict or object to certain processing
- Receive your data in a portable format
- Not be discriminated against for exercising any of these rights
Write to lumabiowellness@gmail.com. We will respond within the period the applicable law requires, and we may need to verify your identity first. Some data we must keep regardless — a completed transaction record cannot be erased on request where tax law requires us to retain it.
Security
The site is served over HTTPS, passwords are stored hashed, administrative access is restricted, and databases are backed up on an encrypted schedule to off-site storage. No system is perfectly secure, and we cannot guarantee absolute security, but if a breach affects your personal information we will notify you and any regulator as the law requires.
Children
This site is not directed to children, and we do not knowingly collect information from anyone under 21. Purchasers must be at least 21. If you believe a minor has given us personal information, contact us and we will delete it.
International transfers
We operate from the United States and your information is managed from the United States. The infrastructure we use to host this site and hold backups is provided by established vendors, some of whose facilities are outside the United States. The protections set out in this policy apply to your information wherever it is held.
Changes
We may update this policy. The current version is always the one published here, and the review date at the top shows when it last changed. Material changes will be brought to your attention.
Questions about privacy: lumabiowellness@gmail.com · Contact us