Privacy policy
1. Who we are
Lumi Lab Creatives (“Lumi Lab”, “we”) builds commerce operations software. We are based in Jakarta, Indonesia. For anything in this policy, write to hello@lumilabcreative.com.
This policy covers lumilabcreative.com and the Lumi Lab applications our customers sign in to.
2. Two different roles, and why it matters
Almost every privacy question about our service turns on which of these two situations you are in:
- Our own data (we are the controller). When you visit this website, email us, or hold a Lumi Lab login, we decide what to do with that information and this policy governs it.
- Our customer’s data (we are the processor). When a brand connects their Shopee, TikTok Shop, Shopify, Meta, Instagram or WhatsApp account, we access that data on their instruction and for their purposes only. They decide what is collected and for how long. We act under our agreement with them, and if you are their customer, their privacy policy is the one that governs that data.
3. What we collect
3.1 From our website
This site has no analytics, no advertising pixels and no tracking cookies. It sets no cookies at all. Our server keeps ordinary request logs (IP address, timestamp, page, user agent) for security and debugging, for no more than 30 days.
3.2 When you contact us
The contact form on this site does not transmit anything to us. It assembles a message in your own mail application, which you then send yourself. We therefore receive only what is in your email: your name, email address, company, and whatever you chose to write. We keep business correspondence for as long as the relationship and our legal obligations require.
3.3 Customer accounts
For users of our applications: name, work email, a hashed password or an identity-provider subject identifier, the role assigned to them, and an audit record of significant actions taken in the system.
3.4 Connected platform data
When a customer authorises a connection, we request the narrowest scope that supports the feature they are using. Depending on which features are enabled, this can include:
| Platform | What we may access | What it is used for |
|---|---|---|
| Shopee | Listings, models, stock, orders, returns, settlements, advertising performance | Stock synchronisation, order and settlement reporting, ad reporting |
| TikTok Shop | Products, SKUs, stock, orders, returns, finance statements, affiliate performance | Stock synchronisation, order and settlement reporting, affiliate attribution |
| Shopify | Products, variants, inventory levels, orders, customers, fulfilments | Stock synchronisation, order fulfilment, storefront operations |
| Meta | Ad account, campaign, ad set and ad performance | Advertising performance reporting |
| Media, stories and their insights for the connected business account | Content performance reporting | |
| Business-account conversations with customers who message the brand | Customer service history and follow-up |
Some of this is personal data belonging to our customer’s own buyers — a name, a shipping address, a phone number, a message. We process it to deliver the feature our customer asked for, and for nothing else.
4. What we never do
- We do not sell, rent or licence personal data to anybody.
- We do not use platform data for advertising, profiling or audience building.
- We do not use one customer’s data to inform, benchmark or train anything for another customer.
- We do not scrape. Every platform integration uses that platform’s published API under our own developer account.
- We do not request a permission or scope that no shipped feature uses.
5. Lawful basis
Where the GDPR or a comparable law applies, we rely on: contract (to provide the service a customer has signed up for), legitimate interests (keeping the service secure and debuggable, and ordinary business correspondence), and consent where a platform requires an explicit authorisation — which the customer grants in that platform’s own consent screen and can withdraw there at any time.
6. Sharing and sub-processors
We keep this list deliberately short. Data may be handled by:
- Our hosting provider, for the servers and database that run the service.
- The platforms themselves, when we write back to them — for example setting a stock level on a listing.
- Authorities, where we are legally compelled, and we will tell the affected customer unless the law forbids it.
We do not use third-party analytics, advertising or data-enrichment services. A current list of sub-processors is available on request.
7. Where data is stored
Our production systems run on servers in Singapore. Data from Indonesian customers may therefore be processed outside Indonesia, and data from EEA or UK individuals outside those regions. Where required we use the relevant standard contractual clauses.
8. Retention
| Data | Kept for |
|---|---|
| Web server request logs | 30 days |
| Connected platform data | While the connection is active, then deleted within 30 days of disconnection or account closure |
| Access tokens and refresh tokens | Deleted immediately on disconnection |
| Account and audit records | Up to 12 months after the account closes, for dispute and security purposes |
| Invoices and accounting records | As required by Indonesian tax law |
Backups are retained for up to 35 days, so deleted data can persist in a backup for that period before ageing out.
9. Security
Access to production data is limited to the people who need it, and is logged. Credentials and platform tokens are stored encrypted and never written to application logs. Traffic is TLS-encrypted end to end. Every role in our applications is deny-by-default: a user sees a screen because a permission was granted, not because nothing stopped them.
We are a small company and we will not pretend to a certification we do not hold. If you need a security review before connecting an account, ask and we will answer honestly and in detail.
10. Your rights
Subject to the applicable law, you can ask us to give you a copy of your data, correct it, delete it, restrict or object to our processing of it, or port it elsewhere. Write to hello@lumilabcreative.com and we will respond within 30 days.
If you are a buyer of one of our customers’ brands and you want your data removed, the fastest route is to ask that brand directly — they control it and can action it immediately. Write to us and we will forward the request and tell you we have done so.
See data deletion for the specific steps and what we need from you.
11. Children
Our service is a business tool and is not directed at children. We do not knowingly collect data from anyone under 18. If you believe we have, tell us and we will delete it.
12. Platform requirements
Our use of data obtained through Meta’s and Instagram’s APIs follows the Meta Platform Terms and Developer Policies. Our use of Shopee, TikTok Shop and Shopify data follows each platform’s developer and partner agreements. Where any of those is stricter than this policy, the stricter rule applies.
13. Changes
If we change this policy we update the date at the top. For a change that materially affects how we handle customer data, we email the customer before it takes effect.
14. Contact
Lumi Lab Creatives
Jakarta, Indonesia
hello@lumilabcreative.com