LEGAL

Privacy Policy

Last updated: September 25, 2026

This Privacy Policy explains how LumiMoments (“we”, “us”, or “our”) collects, uses, shares, and protects personal information when you use giftlumimoments.com and our services (the “Service”). By using the Service, you agree to the practices described here. If you do not agree, please do not use the Service.

1. Who we are

LumiMoments operates the Service and is the controller of the personal information described in this policy. You can reach us about privacy at privacy@giftlumimoments.com.

2. Information we collect

Information you provide

• Account information — your email address and a password (stored only as a secure hash), and an optional name. Account and authentication are handled by our infrastructure provider, Supabase.
• Gift content — the material you add to a gift: photos and images, written messages and titles, dates (such as a relationship start date), place names, a chosen song, and similar content. This may include personal information about you and about the people your gift is for.
• Purchase information — the plan you buy, amount, currency, and order status. Payments are processed by our payment processor (Whish Pay); we do not receive or store your full card or bank details.
• Communications — messages you send us, for example a support request.

Information collected automatically

• Usage and device data — basic information such as your browser type, general device information, pages viewed, and approximate access times, used to operate and secure the Service.
• Gift opens — when a gift is first opened, so we can show the sender that it was received.
• Email interactions — if we send you an email, we may record whether it was opened and whether links in it were clicked, using a small tracking pixel and redirect links, so we can understand delivery and improve our messages. You can opt out of non-essential emails (see Section 8).
• Cookies — see Section 6.

When you type a city for a star map or map feature, we convert that place name into coordinates using a geocoding service. We do not collect your device's precise GPS location.

3. How we use information

• To create, host, and deliver your gifts, and to provide the Service and its features;
• To process payments and keep records of purchases;
• To create and secure your account, and to authenticate you;
• To send you service and transactional emails (for example, a receipt, your gift link, or an expiry reminder), and, if you have not opted out, occasional product messages;
• To provide support and respond to your requests;
• To monitor, maintain, secure, and improve the Service, and to prevent fraud and abuse; and
• To comply with legal obligations and enforce our Terms of Service.

4. Legal bases (for EEA/UK users)

Where applicable data-protection law requires a legal basis, we rely on:

• Performance of a contract — to provide the Service you sign up and pay for;
• Legitimate interests — to secure and improve the Service, understand email engagement, and prevent abuse, balanced against your rights;
• Consent — where we ask for it, for example for optional marketing emails (you can withdraw it at any time); and
• Legal obligation — to comply with the law.

5. How we share information

We do not sell your personal information. We share it only as needed to run the Service:

• Service providers (sub-processors) who process data on our behalf, under contract, including:
  • Supabase — database, file storage, and authentication;
  • Vercel — application hosting;
  • Resend — sending our emails;
  • Whish Pay — payment processing;
  • Google / YouTube — powering in-app music search;
  • OpenStreetMap / Nominatim — converting place names to coordinates.
• Recipients you choose — anyone you share a gift's link or QR code with can view that gift's content (see Section 9).
• Legal and safety — where we believe it is required by law, or necessary to protect the rights, property, or safety of LumiMoments, our users, or the public.
• Business transfers — if we are involved in a merger, acquisition, or sale of assets, information may be transferred as part of that transaction.

6. Cookies and tracking

We use a small number of cookies and similar technologies that are necessary to run the Service — for example, to keep you signed in and to maintain your session securely. We do not use third-party advertising cookies and we do not track you across other websites. As described in Section 2, we also use a pixel and redirect links to measure opens and clicks in emails we send. You can control cookies through your browser settings, though disabling essential cookies may prevent parts of the Service from working.

7. Public gifts and recipients

A published gift is viewable by anyone who has its link or QR code. Links are not publicly listed and are hard to guess, but a gift is not private or end-to-end encrypted, and a recipient may forward the link. Please do not include information in a gift that you would not want a recipient, or anyone they share it with, to see.

8. Your choices and rights

Depending on where you live, you may have rights over your personal information, including the right to access it, correct it, delete it, receive a copy (portability), object to or restrict certain processing, and withdraw consent. Specifically:

• Access and update — you can view and edit much of your information, and your gifts, from your account.
• Delete — you can delete gifts, and you can request deletion of your account and associated data by emailing us.
• Marketing emails — you can unsubscribe from non-essential emails using the link in any such email; we will still send necessary service messages (like receipts).
• EEA/UK and California residents — you have the rights described above and may have additional rights (for example, the right to lodge a complaint with a supervisory authority, or the CCPA rights to know, delete, and not be discriminated against for exercising them). We do not sell personal information.

To exercise any right, contact privacy@giftlumimoments.com. We may need to verify your identity before acting on a request.

9. Data retention

We keep your account information for as long as your account is active. Gift content is retained for the duration of the plan you purchased (timed plans expire; "Forever" gifts remain while we offer the Service), and until you delete it. When you delete content or your account, we remove it from active systems, though limited copies may remain in backups for a short period before being overwritten, and we may retain information where necessary to comply with legal obligations, resolve disputes, or enforce our agreements.

10. Security

We use reasonable technical and organizational measures to protect your information — including encryption in transit, access controls, and row-level security on our database. No method of transmission or storage is completely secure, however, and we cannot guarantee absolute security. Protect your account by using a strong, unique password.

11. International transfers

We and our service providers may process and store information in countries other than the one you live in. Where we transfer personal information across borders, we take steps to ensure it is protected consistently with this policy and applicable law.

12. Children

The Service is intended for adults (18+) and is not directed to children. We do not knowingly collect personal information from children. If you believe a child has provided us with personal information, contact us and we will take appropriate steps to delete it.

13. Third-party links

The Service may contain links to third-party sites or services that we do not control. This policy does not apply to them; please review their privacy policies.

14. Changes to this policy

We may update this Privacy Policy from time to time. When we make material changes, we will update the "Last updated" date above and, where appropriate, notify you. Your continued use of the Service after changes take effect means you accept the updated policy.

15. Contact us

For any privacy question or request, email privacy@giftlumimoments.com.

This document describes our current data practices for transparency. It is not legal advice.