Privacy

Orders and gifts

We store buyer email, product, currency, amount, payment/session references and status, consent wording and time, payment date, access expiry and first-download time. For gifts, we also store recipient email, sender name and message. We use these to perform the purchase contract, deliver private downloads and handle support, refunds and withdrawal. Recipient data is used only to fulfil the gift, not for marketing. Emails are not shown on gift pages. We do not store full card numbers.

Accounting records are retained for seven years to meet Dutch tax-record obligations. Order and delivery consent records are kept with the accounting record to document the transaction and consumer choices. Gift messages and recipient details are retained no longer than 90 days after purchase, unless needed for an active complaint or legal claim. The 30-day download period is separate from record retention.

Reviews

We store your rating, review text, first name, optional display permission and submission date. Our legitimate interest is improving our books through voluntarily submitted feedback. Reviews remain private; the separate, unticked permission records consent for any future display with your first name. You can withdraw display permission or object to review processing by contacting us. We retain reviews for up to two years, unless you request deletion sooner.

Withdrawal and contact

We store the verified order reference, name, email, optional reason, receipt date and eligibility result to handle withdrawal and refunds, based on the contract and legal obligations. Withdrawal/refund records are retained with the associated order for seven years. Correspondence is kept for up to two years after resolution unless legal obligations or an active claim require longer. Do not include sensitive or unnecessary personal information.

Service providers

Lovable Cloud provides hosting, the database and private file storage. Stripe provides payment processing, fraud protection and payment receipts. Their roles depend on the processing activity; Stripe also processes data for its own regulatory obligations. Service providers may process data outside the EEA under applicable transfer safeguards. See Lovable’s privacy policy and Stripe’s privacy policy.

Browser storage and fonts

There are no customer accounts or marketing emails. The site stores only your chosen EUR/USD currency in your browser for price display; you can clear it through your browser settings. We do not use tracking cookies. Stripe’s payment form may use its own necessary technologies for payment security. Google Fonts supplies the fonts and receives connection information, including your IP address, when your browser requests them. Social links open the corresponding service only when clicked.

Cookie-free visitor statistics

Lovable’s analytics uses no cookies, stores nothing on your device, does not keep IP addresses and does not identify visitors. Lovable collects this data for us. Lovable’s privacy policy explains how it handles it.

Clicks are recorded for every visitor. Page visits, time on page, page speed and errors are also recorded for every visitor, without cookies and without identifying anyone. The information includes pages visited, referral sources, country, browser, operating system and device type. We use it for our legitimate interest in understanding use and improving reliability. Detailed data is kept for 90 days and daily summaries for one year.

Your rights

You may request access, correction, deletion or restriction, data portability where applicable, and object to processing based on legitimate interest. You may withdraw consent without affecting earlier lawful processing. Some records cannot be deleted while legally required. Contact hello@lumabayera.com; we may need proportionate information to verify your identity. You may complain to the Dutch Autoriteit Persoonsgegevens at autoriteitpersoonsgegevens.nl, or your local supervisory authority. Anonymous analytics cannot identify your visit.