Privacy Policy

From our forms: the project intake form collects your name, email, business name, website URL, and project details; the support form collects your name, email, site URL, issue category, and message.

Automatically: basic technical data needed to serve and secure the site (such as IP address, browser/device type, and request logs) may be processed by our hosting provider. The marketing site is configured to minimize non-essential cookies.

We do not intentionally collect sensitive categories of data, and the site is not directed to children.

To respond to your inquiry and communicate about a potential or active project; to provide, manage, and improve our services and support queue; to route project leads and support tickets into our internal operations system; and to maintain security and meet legal obligations.

We do not sell your personal information and we do not share it for cross-context behavioral advertising. We disclose it only to service providers who process it on our behalf under contract — our website host (Vercel), our database (Supabase, within the LumaNavi operations project), and our business email (Google Workspace) — and where required by law.

We keep personal information only as long as needed for the purposes above and as required by law, then delete or anonymize it. Inquiries that do not become projects are kept for a limited period; client project records are kept for the engagement plus a reasonable period for legal, accounting, and warranty purposes.

Depending on where you live, you may have the right to access, correct, delete, or port your information, to opt out of sale or sharing (note: we do not sell or share for advertising), and to object to or restrict certain processing. California (CCPA/CPRA) and EU/UK (GDPR) residents have these rights and the right to non-discrimination or to lodge a complaint with a supervisory authority.

To exercise any right, contact projects@lumanavistudio.com. We will verify and respond within the time required by law.

We use reasonable safeguards, including server-only handling of submitted data, so privileged keys are never exposed to the browser. No method of transmission or storage is perfectly secure. Our providers may process data in the United States and other countries, with appropriate safeguards where required.

We may update this policy prospectively; the “last updated” date will change and material changes will be communicated as required.