Privacy Policy
Last updated: [FILL IN: date this policy takes effect]
Who we are
LumaPos is a point-of-sale system made by Channing & Company LLC, based in Atlanta, Georgia ("we" or "us"). LumaPos is in a pre-launch pilot. This policy explains what information LumaPos collects, why, who we share it with, and the choices you have.
Contact us about privacy at [FILL IN: privacy contact email], or by mail at [FILL IN: mailing address for Channing & Company LLC].
Information you give us on the pilot application
When you apply for the Luma Pilot at getlumapos.com/pilot, we collect:
- Your business name, your name, and your email address
- Your phone number, if you give one
- Your city and state
- Your business type, how many events you run per month, and your monthly card sales range
- The POS you use now and any notes, if you add them
- Your agreement that we may contact you by email or phone about the pilot
We use this to review your application and to contact you about the pilot. We also record that an application arrived, along with its business type and events per month, in our activity log. Please don't put card numbers, bank details, or passwords in the form.
Information we collect when your business uses LumaPos
If your business joins the pilot, LumaPos stores:
- Owner and manager accounts: name, email address, role, and the time of the last sign-in. Passwords are stored only as one-way hashes, so we can't read them.
- Staff who use the register: first and last name, role, and a 4 to 6 digit PIN. PINs are stored only as one-way hashes.
- Sales records: items and prices, discounts, taxes, tips, totals, payment method, refunds, voids, shifts, cash drawer counts, and which staff member took each action.
- An activity log of sign-ins (including failed attempts), sales, refunds, voids, shifts, cash paid in or out, and changes to items and staff. This log is append-only: the app can add entries but can't edit or delete them, so there's a reliable record of what happened.
LumaPos doesn't ask for your customers' names, emails, or phone numbers at checkout. Your business is responsible for the information it enters about its own staff, and we handle that information on your behalf to run the service.
Card payments
Card payments are processed by Finix Payments, Inc. ("Finix"). Card details go to Finix, and LumaPos never stores full card numbers, security codes (CVV), or bank account numbers. We keep Finix's reference numbers and the status and amount of each payment so we can match sales, refunds, and payouts. When Finix sends us payment updates, we remove card and bank fields before saving them. During the pilot, card payments run in Finix's test environment until live processing is turned on for your business.
Finix handles card data under its own privacy policy: [FILL IN: link to Finix privacy policy].
Information collected automatically
LumaPos uses cookies only to keep you signed in: one for the owner or manager sign-in and one for the staff member signed in at the register. Both expire after 12 hours. Our sign-in system also sets short-lived security cookies that protect the sign-in form. We don't use advertising or analytics cookies, and we don't run third-party tracking scripts.
Like any website, our hosting provider receives technical details such as your IP address and browser type when your device loads a page.
Who we share information with
We share information only with the service providers that run LumaPos, and only what they need to do their job:
- Netlify, Inc. hosts the website and app.
- Neon hosts our database in the United States.
- Finix Payments, Inc. processes card payments.
We don't sell personal information, and we don't share it for advertising. We may disclose information if the law requires it, to protect people or our service from fraud or harm, or as part of a sale or merger of our business, in which case this policy would continue to apply.
How long we keep information
We keep pilot applications for [FILL IN: how long you keep applications that don't join the pilot]. We keep account and sales records while your business uses LumaPos and for [FILL IN: how long after an account closes] afterward, or longer if the law requires it. Entries in the activity log are kept permanently because they can't be changed or deleted.
How we protect information
Passwords and PINs are stored as one-way hashes. Pages are served over HTTPS. The back office and our admin pages require a signed-in account. Our logs strip out passwords, secrets, and anything that looks like a card or bank number. No system is perfectly secure, and we'll tell affected users if we learn of a breach that affects their information.
Your choices
You can ask to see, correct, or delete the personal information we hold about you, or ask us to stop contacting you, by emailing [FILL IN: privacy contact email]. We'll reply within [FILL IN: number of days]. We can't delete activity log entries or records the law requires us to keep, and we'll tell you if that applies to your request.
Children
LumaPos is a tool for businesses. It isn't meant for children, and we don't knowingly collect information from anyone under 13.
Changes to this policy
If we change this policy, we'll update the date at the top of this page. If a change affects how we use information we already have, we'll tell pilot businesses by email first.