Privacy Policy
Who is responsible
Sidian Labs is the controller of the personal data described here, for the LumioUI website at lumioui.com, the CLI and the registry API. Contact us about privacy at [email protected]. This policy applies to everyone, wherever you live, and is written to meet the EU and UK General Data Protection Regulation (GDPR), India’s Digital Personal Data Protection Act 2023, and US state privacy laws such as the California Consumer Privacy Act.
What we collect
| Data | When | Why |
|---|---|---|
| Email address, name | You create an account (or sign in with Google) | To run your account, send receipts and security notices |
| Password (stored only as a salted PBKDF2 hash) | You sign up with a password | To let you sign in; we cannot read your password |
| Google account ID | Only if you use “Continue with Google” | To link your Google sign-in to your account |
| Plan and early-access requests (plan asked for, optional note) | You request or buy a plan | To give you the access you paid for or asked for |
| Sign-in sessions: a hashed session token, browser description, start and expiry times | You sign in | To keep you signed in and let you see and end sessions |
| License keys (stored only as a hash), their label, created, last-used and revoked times | You create a key and use the CLI | To let the CLI install Pro items and to spot leaked keys |
| IP address and email address in short-lived security counters | Sign-in, sign-up and password checks | To slow down password-guessing and abuse (rate limiting) |
| Purchase details from our payment partner: name, email, country, order and amount | You buy a plan | To grant the plan and keep business records |
| Messages you send us | You email us | To answer you |
Like every website, our hosting provider processes technical request data (such as IP address, browser and the page requested) to deliver pages and protect against attacks. We do not use this data to profile you.
What we do not collect: no analytics or usage tracking, no advertising or marketing pixels, no fingerprinting, no card numbers, and no data bought from third parties. Your theme and display preferences stay in your own browser (see Cookies & Storage).
Why we may use it (legal bases)
- Contract — running your account, delivering Free and Pro items, license keys and support.
- Legitimate interests — keeping the Service secure (rate limiting, abuse prevention, detecting leaked keys) and improving it based on support messages. We weigh these against your rights and keep them minimal.
- Legal obligation — keeping purchase and tax records for as long as the law requires.
- Consent — any optional emails beyond service and security messages. We currently send none; if we start, we will ask first and you can withdraw consent at any time.
Under India’s DPDP Act, we process your data for the purposes above with your consent given when you create an account or buy a plan, and for legitimate uses the Act permits.
Who processes data for us
| Provider | What for | Data involved |
|---|---|---|
| Cloudflare, Inc. | Website hosting, database, file storage, security | All account data above; request data |
| Our payment partner (merchant of record, e.g. Paddle or Lemon Squeezy) | Checkout, tax, invoices, refunds | Payment and billing details you give at checkout. It acts as an independent controller under its own privacy notice. |
| Google LLC | “Continue with Google” sign-in, only if you use it | The Google profile details you approve (name, email, account ID) |
| Our email provider | Sending service and security email from [email protected] | Your email address and the message |
We do not sell or rent personal data, and we do not share it for cross-context behavioural advertising. We disclose data to others only where the law requires it, to protect our rights or users’ safety, or as part of a reorganisation or sale of LumioUI (in which case this policy continues to apply).
International transfers
Our providers operate globally, so your data may be processed outside your country, including in the United States and India. Where data from the EU, UK or Switzerland is transferred to a country without an adequacy decision, we rely on the European Commission’s Standard Contractual Clauses (and the UK addendum) or the provider’s certification under the EU–US Data Privacy Framework, together with the security measures described below.
How long we keep it
- Account data — while your account exists. When you delete your account we delete your profile, sessions, license keys and requests straight away.
- Sessions — up to 30 days, or until you sign out.
- Security counters (IP address, email) — deleted within a day.
- Purchase records — as long as tax and accounting law requires (usually 6–10 years), held mainly by our payment partner.
- Backups and logs — kept by our hosting provider for a short period and then overwritten.
Your rights
Depending on where you live, you have the right to:
- access the personal data we hold about you and get a copy in a portable format;
- correct it — you can change your name on the account page, or email us;
- delete it — delete your account from the account page at any time;
- restrict or object to processing based on legitimate interests;
- withdraw consent where we rely on it;
- nominate someone to exercise your rights if you die or become unable to (India);
- not be discriminated against for using these rights (California).
Email [email protected] from your account’s email address and we will reply within 30 days. You also have the right to complain to your data-protection authority — in the EU, the authority where you live or work; in the UK, the Information Commissioner’s Office; in India, the Data Protection Board of India — though we would like the chance to put things right first.
How we protect it
- Passwords are stored as salted PBKDF2 hashes; session tokens and license keys are stored only as SHA-256 hashes.
- Session cookies are HttpOnly, Secure and SameSite, the site is HTTPS-only (HSTS), and other sites cannot frame our pages.
- Sign-in attempts are rate-limited, and changing your password signs out every other session.
- Pro source is served only to signed-in paid accounts and never cached for others.
No system is perfectly secure. If a breach affects your data, we will tell you and the relevant authorities as the law requires.
Children
LumioUI is a tool for developers and is not directed at children. You must be at least 16 to create an account (or older where local law requires). If you believe a child has given us data, contact us and we will delete it.
Changes
We will post any update here with a new effective date, and email account holders about material changes before they apply.
Questions about this page? Write to [email protected].