Version of October 19, 2026
This policy explains which personal data we process when you use the Lumesmith Lab store, why, for how long, and how to exercise your rights.
1. Data controller
The Lumesmith Lab store is run by Qoolyn, a French SASU with a share capital of 1,000 euros, 28 Avenue André Reinson, 33300 Bordeaux, France, 929 451 904 R.C.S. Bordeaux ("we"). We decide how your data is used.
For any question about your data: hello@lumesmithlab.com.
2. What data we process and why
When you buy
- Data: first and last name, email address, country, VAT number if you buy as a business, products ordered, amounts, date, and the record of your waiver of the right of withdrawal.
- Why: to process the order, deliver your files, issue the invoice, apply the VAT of the right country, and handle a withdrawal or the guarantee of conformity.
- Legal basis: performance of the sales contract, and our accounting and tax obligations for the invoice and VAT.
Your card number never reaches us: payment is processed by Stripe.
Your customer account
- Data: email address, password if you choose one, products you own, versions downloaded and download dates.
- Why: to sign you in, keep your products and their updates available, tell you when a new version comes out, and work out the price of a bundle if you already own one of its packs.
- Legal basis: performance of the contract.
The free look
- Data: email address.
- Why: to send you the link to the look and keep it in your account.
- Legal basis: performance of your request.
New-release emails, if you accept them
- Data: email address, date and source of your consent.
- Why: to tell you when a new pack comes out.
- Legal basis: your consent, given by ticking the box provided. You can withdraw it at any time with the unsubscribe link in each email, or by writing to us.
Plugins
- Data: license key, an identifier for each activated computer, activation and check dates.
- Why: to limit a license to 2 computers at a time, let you free one, and check the license online.
- Legal basis: performance of the license contract.
When you write to us
- Data: your email address and the content of your messages.
- Why: to reply to you.
- Legal basis: performance of the contract when your message is about an order, otherwise our legitimate interest in replying to people who write to us.
Running and securing the site
- Data: IP address, browser type, pages requested, date and time, in the host's technical logs.
- Why: to run the site, protect it against abuse and fraud, and fix errors.
- Legal basis: our legitimate interest in keeping the site secure.
We do not sell or rent your data.
3. How long we keep it
- Orders and invoices: 10 years from the end of the financial year, as French accounting law requires (article L123-22 of the French Commercial Code).
- Customer account: as long as it exists. It gives you access to your products and their updates with no time limit, so we do not delete it for inactivity, but you can ask us to delete it at any time. Your invoices are then kept for the legal period.
- New-release emails: until you unsubscribe.
- Plugin licenses: as long as the license exists.
- Messages with us: 3 years after your last message.
- Technical logs: 12 months at most.
- Audience measurement: 12 months at most.
4. Who receives your data
Only the people at Qoolyn who run the store have access to it. We also use service providers that process it on our behalf, following our instructions and under contract:
- Stripe: payment, VAT calculation, fraud prevention. Stripe Payments Europe, Ireland. For fraud prevention and its own legal obligations, Stripe also acts as a controller, under its own privacy policy.
- Vercel: hosting of the site, the store's data and the files to download. Vercel Inc., United States.
- PostHog: audience measurement. PostHog Inc., data hosted in the European Union.
- Mailjet: sending order, sign-in, update and new-release emails. Mailjet SAS, France.
We also pass data to the tax authorities or to a court when the law requires it.
5. Transfers outside the European Union
Some of these providers are based in the United States or process data there. These transfers are covered by the EU-U.S. Data Privacy Framework where the provider has joined it, and otherwise by the European Commission's standard contractual clauses.
6. Cookies and audience measurement
The site uses cookies it needs to work, which do not require your consent:
- the session cookie, which keeps you signed in to your account;
- Stripe's cookies at checkout, which secure the payment and prevent fraud.
We use PostHog to see which pages are viewed and improve the site. PostHog only sets a cookie if you accept it in the banner, and you can change your mind at any time from the "Cookies" link at the bottom of the page.
7. The emails we send
- Service emails: order confirmation, invoice, sign-in links, release of an update to a product you own. They are part of the service and you receive them as long as you have an account.
- New-release emails: only if you accepted them, with an unsubscribe link in each one.
8. Your rights
At any time, you can:
- access your data and get a copy of it;
- have it corrected;
- have it erased, except what the law requires us to keep, such as invoices;
- restrict its processing, or object to it when it is based on our legitimate interest;
- receive the data you gave us in a machine-readable format;
- withdraw your consent, without affecting what was done before;
- give instructions on what happens to your data after your death.
To do so, write to hello@lumesmithlab.com, preferably from the address of your account. We reply within one month. If we have reasonable doubt about your identity, we may ask you to confirm it.
If you think your rights are not respected, you can complain to the CNIL, the French data protection authority (www.cnil.fr), or to the data protection authority of the country where you live.
9. Security
The site is served over HTTPS, passwords are stored in a hashed form we cannot read, download links sent by email expire after 7 days, and the store's administration is limited to the people who run it.
10. Changes
We may update this policy, for example if we change providers. The date at the top of the page shows the version in force; if we make an important change, we let you know by email.