Privacy Policy · Lumera Labs

1. Personal information we collect

Order data: name, shipping address, billing address, email, phone (optional), order details.
Payment data: handled by third-party processors (Stripe for cards, BTCPay for crypto, Interac for e-Transfer). Lumera never stores full card or wallet credentials.
Communications: emails you send to lumeralabs@proton.me or via the contact form.
Technical data: IP address, browser/device fingerprint, pages visited, referrer, anonymized analytics.

2. How we use it

To process and ship your order.
To send transactional emails (confirmation, tracking, COA, invoices).
To prevent fraud and enforce these terms (including the Research Use Declaration).
To respond to support inquiries.
To improve site usability via aggregated, anonymized analytics.

We do not sell, rent, or trade personal data with third parties for marketing.

3. Legal basis

Processing is based on (a) performance of contract (your order), (b) legal obligation (tax, customs, RUO compliance records), and (c) legitimate interest (fraud prevention, site security, anonymized analytics).

4. Service providers we share with

We share the minimum necessary data with the following third parties, all of whom are bound by their own privacy commitments:

Canada Post — shipping address + tracking, for cold-chain fulfillment.
BTCPay Server (Voltage) — order amount + invoice ID, for cryptocurrency settlement.
Paytek / polarpay.net + polarpay.org — your name, email, and order amount, to provision the unique Interac e-Transfer reference and recipient address.
Resend — your email address + order/contact contents, for transactional email delivery.
Google Analytics 4 (G-ZMJDTGKYZ2) — anonymized page views, device class, referrer. IP-anonymization on. No personal identifiers shared. Opt out via your browser's Do-Not-Track or by blocking googletagmanager.com.
Cloudflare Turnstile — privacy-preserving CAPTCHA on contact + newsletter forms. No tracking cookies set; only an interaction proof token is exchanged.
Lumera order-management dashboard (admin.dumpsterexpress.org) — your order ID, line items, shipping address, and payment status. Used to manage inventory, fulfillment, and the order-status receipt shown on the thank-you page.
Government authorities — only when legally required (tax filings, customs declarations, lawful subpoena).

4b. Browser storage we use

To make the storefront work, we use the following browser-local storage. Nothing here leaves your device unless you explicitly submit it (e.g., place an order):

localStorage — cart contents, wishlist, recently-viewed products, age/research-use acknowledgement, applied promo codes, last-used postal code (for shipping ETA), magic-link session reference, A/B-test bucket assignment.
sessionStorage — last savings/discount value (shown on the order-confirmed page), the currently-pending Interac e-Transfer reference, exit-intent and welcome-back dismissal flags.
Cookies — anonymous identifier (lumera_anon) used to persist your wishlist before you sign in, and your magic-link session cookie (lumera_session, HttpOnly + Secure + SameSite=Strict) once authenticated.

5. Data retention

Order records are kept for seven (7) years to comply with Canadian tax and corporate record-keeping rules. Marketing email addresses are retained until you unsubscribe. Anonymized analytics are retained for 26 months.

6. Your rights (PIPEDA & GDPR)

You may at any time request: access to your personal data, correction of inaccurate data, deletion (subject to retention obligations), data portability, and withdrawal of consent. Email lumeralabs@proton.me with the subject line "Privacy Request". We respond within 30 days.

7. Children

This site is not intended for, and should not be used by, anyone under 19. We do not knowingly collect data from minors.

8. Cookies

See the Cookie Policy. Cookies are used for cart state, preferences, and anonymous analytics.

9. Security

Data in transit is protected by TLS 1.3. Card and wallet data is processed by PCI-compliant third parties; we never see it. Internal databases are access-controlled and encrypted at rest.

10. Contact & complaints

Privacy Officer: lumeralabs@proton.me. If you are unsatisfied with our response, you may complain to the Office of the Privacy Commissioner of Canada.

Privacy Policy.