Privacy Policy

1. Scope and Who We Are

This Privacy Policy explains how Configurate, operating the Lumi service ("Lumi," "we," "our," or "us"), handles personal information when you visit our website, use our public catalog tools, install or use our Shopify app, participate in our partner program, contact us, or otherwise use our related services (collectively, the "Service").

This policy applies to merchants, merchant staff, website visitors, partner-program users, support contacts, and people whose information a merchant directs us to process. It does not govern Shopify or another third party's independent privacy practices.

For personal information we collect for our own account administration, security, analytics, support, and business operations, Configurate generally acts as the controller or business. When we process personal information from a merchant's Shopify store only to provide the Service under the merchant's instructions, the merchant is generally the controller or business and Configurate acts as its processor or service provider. The exact role depends on the data and applicable law.

2. Information We Collect

Depending on how you use the Service, we may collect:

2.1 Account and Contact Information

Names, email addresses, phone numbers, business addresses, Shopify store domains, store names, roles, authentication identifiers, support messages, and other information you provide to us. Shopify may provide store-owner name, email address, phone number, and physical address when the app is installed or used.

2.2 Shopify Store and Catalog Information

Product and variant identifiers, product titles and descriptions, vendors, product types, tags, collections, product media and files, image URLs and alt text, search titles and meta descriptions, publication state, store configuration, app permissions, plan information, and content you submit or approve for publication. The app's current Shopify listing describes the categories of Shopify data the app is authorized to access.

Lumi is designed around catalog content. It does not request Shopify customer or order records as part of its current core catalog workflow. If the Service changes to require additional Shopify data, we will update our disclosures and permissions as required.

2.3 Generated Content and Workflow Data

Prompts, brand guidance, generated drafts, edits, approvals, publishing actions, scan results, content history, reports, settings, usage counts, job status, and related metadata needed to provide catalog review and publishing workflows.

2.4 Public Tool and Lead Information

Storefront URLs submitted to public audit, catalog diagnostic, risk report, or calculator tools; publicly available content retrieved from those URLs; report results; calculator inputs; email addresses; and information you choose to submit to receive or save a report.

2.5 Partner and Referral Information

Partner account identifiers, referral codes, referral clicks, attributed store domains, commission and payout records, and communications related to the partner program. A referral cookie may remember the referring partner for up to 60 days.

2.6 Device, Usage, and Security Information

IP address, browser and device type, operating system, approximate location derived from an IP address, pages and features used, timestamps, referring URLs, session or cookie identifiers, error and diagnostic data, security events, and fraud-prevention signals. We may use privacy-filtered product analytics and masked session replay in authenticated app areas. Inputs and page text are configured to be masked in those replays, but you should not submit sensitive personal information that the Service does not require.

3. Sources of Information

We collect information:

• Directly from you, your organization, and other authorized users
• From Shopify when you install, authorize, or use the app
• From publicly accessible storefront pages and resources you ask us to analyze
• Automatically from browsers, devices, cookies, logs, and security tools
• From referral partners and service providers supporting the Service

4. How and Why We Use Information

We use information to:

• Authenticate users and provide, maintain, support, and improve the Service
• Scan catalog fields, create requested drafts, support human review, publish approved changes to Shopify, and maintain workflow history
• Generate public reports from submitted storefront URLs and deliver requested results
• Administer plans, credits, subscriptions, referrals, commissions, and support
• Send service messages and respond to inquiries
• Measure product use, troubleshoot errors, monitor performance, and develop features
• Detect, investigate, and prevent misuse, fraud, security incidents, and illegal activity
• Comply with law, enforce our agreements, and establish or defend legal claims

Where European or UK data-protection law applies, our legal bases may include performing a contract or taking steps at your request, our legitimate interests in operating and securing the Service and improving business-to-business products, compliance with legal obligations, and consent where consent is required. You may withdraw consent at any time, but withdrawal does not affect processing that occurred before withdrawal.

5. Shopify Data and Merchant Instructions

We access Shopify data through permissions approved by the merchant and use it to provide the app's disclosed functions. Merchants control which authorized staff can use the app and are responsible for their instructions, notices, and lawful basis for data they direct us to process.

We process Shopify personal information only for disclosed purposes, subject to applicable law and our agreements. We respond to Shopify's mandatory privacy webhooks for customer data requests, customer redaction, and shop redaction. Because Lumi's current core workflow does not request customer or order records, a customer-specific request may yield no matching customer data.

Uninstalling the app revokes its Shopify access and initiates deletion of shop-scoped app data through our uninstall process. We may retain limited records where reasonably needed for billing, fraud prevention, security, legal compliance, dispute resolution, backup integrity, and proof that a deletion request was completed. Privacy-minimized deletion and security records may not contain the plain store domain or merchant content.

6. Artificial Intelligence Processing

When you request generation or analysis, relevant catalog content, images, brand guidance, prompts, and technical instructions may be sent through an AI gateway to third-party model providers. The provider used may vary based on availability, configuration, and the requested feature.

Do not submit personal information, confidential information, or regulated data that is not needed for the catalog task. Merchants must review generated drafts before publication. Lumi does not use automated decision-making that produces legal or similarly significant effects about individuals.

We may use aggregated or deidentified service information to analyze performance and improve the Service. We do not attempt to reidentify information maintained in deidentified form.

7. How We Disclose Information

We may disclose information to:

• Shopify, at your direction, including when we read store data or publish approved catalog changes
• Hosting, database, storage, content-delivery, AI, analytics, error-monitoring, email, identity, security, and customer-support providers that process information for us
• Professional advisers, auditors, insurers, and financing partners as appropriate
• Government authorities or other parties when reasonably necessary to comply with law, protect rights or safety, investigate misuse, or enforce agreements
• A buyer, successor, or other participant in a merger, financing, reorganization, sale of assets, bankruptcy, or similar transaction, subject to appropriate safeguards
• Other parties with your direction or consent

We do not sell personal information as "sale" is defined by applicable state privacy law. We do not share personal information for cross-context behavioral advertising as "sharing" is defined by California law. We do not use sensitive personal information to infer characteristics about individuals. If these practices change, we will provide legally required notices and choices before the change applies.

8. Cookies and Similar Technologies

We and our service providers may use:

• Necessary technologies for authentication, security, load balancing, preferences, and core Service functions
• Analytics technologies to understand traffic, feature use, errors, and performance
• Referral technologies to attribute a merchant visit to a partner for up to 60 days

Browser controls can block or delete cookies, but blocking necessary technologies may stop parts of the Service from working. Depending on your location, you may have additional consent or opt-out rights for nonessential technologies. Contact us using Section 16 to exercise an applicable right. Browser-based opt-out signals are treated as requests where legally required and technically applicable.

9. Retention

We retain personal information only for as long as reasonably necessary for the purposes described in this policy. Retention depends on the type of information, the duration of the merchant relationship, feature and account needs, deletion or uninstall events, contractual commitments, security and fraud-prevention needs, backup cycles, and legal, tax, accounting, and dispute-resolution obligations.

We delete or deidentify information when it is no longer needed, subject to the exceptions above. Information in backups may remain until the relevant backup is overwritten or expires and is protected from ordinary use in the meantime.

10. Security

We use reasonable administrative, technical, and organizational safeguards designed to protect personal information, including access controls, transport encryption, secret management, logging controls, and procedures for destructive Shopify webhooks. No method of transmission or storage is completely secure, so we cannot guarantee absolute security. If a security incident occurs, we will provide notifications to affected parties and regulators when and as required by applicable law.

11. International Transfers

Configurate and many of its service providers operate in the United States and other countries. Information may therefore be processed in countries whose laws differ from those where you live. Where applicable law requires a transfer mechanism, we rely on an available lawful mechanism and contractual or organizational safeguards appropriate to the transfer. Contact us if you need information about safeguards relevant to your data.

12. Your Privacy Rights

Depending on your location and our role, you may have rights to access, know about, correct, delete, or obtain a copy of personal information; restrict or object to processing; withdraw consent; opt out of certain sales, sharing, targeted advertising, or profiling; limit certain uses of sensitive personal information; appeal a denied request; and receive equal service without unlawful discrimination.

Send a request to privacy@configurate.com. Please identify your relationship with Lumi and the email address or Shopify store associated with the request. We may need to verify your identity and authority. An authorized agent may submit a request where allowed by law, but we may request proof of authorization and direct identity verification.

If we process information only on behalf of a Shopify merchant, we may direct the request to that merchant or assist the merchant as required. We may deny or limit a request where an exception applies and will explain available appeal rights when required.

People in the European Economic Area or United Kingdom may also lodge a complaint with their local data-protection authority. We encourage you to contact us first so we can try to address the concern.

13. United States State Disclosures

For purposes of state privacy laws that apply to us, the categories of personal information described in Section 2 may include identifiers and contact information; commercial and subscription information; internet or electronic activity; approximate geolocation; professional or employment-related information; user-provided content; and inferences from service activity. During the preceding 12 months, we may have collected and disclosed these categories for the business purposes described in this policy. We collect these categories from the sources in Section 3, use them for the purposes in Section 4, disclose them to the recipient categories in Section 7, and retain them using the criteria in Section 9.

Our statement that we do not sell or share personal information is in Section 7. State-law rights and the request method are in Section 12. We will not discriminate against you for exercising an applicable privacy right.

14. Children

The Service is intended for business users and is not directed to children under 16. We do not knowingly collect personal information from children under 16. Contact us if you believe a child has provided personal information to the Service.

15. Changes to This Policy

We may update this Privacy Policy to reflect changes in the Service, our practices, or law. We will post the updated policy and revise the date above. If a change materially affects how we use information already collected, we will provide additional notice or obtain consent when required by law.

16. Contact Us

Questions, privacy requests, and data-protection inquiries may be sent to: