Privacy Policy

LumniPay is a payment orchestration technology platform operated by Lumnipay LLC, a limited liability company organised under the laws of Wyoming, USA (registration number 2026-001905944, EIN 98-1922038), with its registered address at 5830 E 2nd St, Ste 7000 #33557, Casper, Wyoming 82609, USA (referred to as "LumniPay", "we", "us" or "our").

For any privacy question or request, you can reach us at admin@lumnipay.com.

Depending on the context, we act in two different capacities:

• As a data controller (or "business" under the CCPA) for the personal data of visitors to our website and of the Merchants and their staff who use the platform.
• As a data processor (or "service provider" under the CCPA) for the personal data of Merchants' customers that we handle on a Merchant's behalf, for example during checkout. In that case, the Merchant is the controller, decides how that data is used, and its own privacy policy applies.

LumniPay is available exclusively through Tagada. Tagada is an independent company and processes personal data under its own privacy policy.

Website visitors

• Contact data you send us, such as your name, email address, company and the content of your message.
• Technical data collected in server logs, such as IP address, browser type, device information, pages requested and timestamps.
• Data stored in strictly necessary cookies. See our Cookie Policy.

Merchants

• Account data: names, business email addresses and roles of users, and hashed passwords.
• Business data: company details, store URLs, product categories and configuration settings, some of which is shared with us through Tagada during onboarding.
• Usage data: logins, actions taken in the dashboard, API activity and support conversations.

Merchants' customers

• Checkout data: name, email address, billing and shipping address, phone number, order contents and transaction amounts.
• Payment data: card details are entered into fields provided by or tokenised by our processing partners. We do not store full card numbers or security codes. We keep only tokens, the card brand, expiry and last four digits where needed for routing, retries, subscriptions, support and refunds.
• Risk data: IP address, device and browser signals and transaction history used for fraud prevention.

We use personal data for the following purposes, on the legal bases shown:

• Providing the platform: onboarding, account management, routing payments, running checkout, subscriptions and analytics (performance of a contract, and for customer data, the Merchant's instructions).
• Security and fraud prevention: authentication, risk scoring, blocking abusive traffic and keeping audit logs (legitimate interests and legal obligations).
• Legal compliance: accounting, tax and responding to lawful requests (legal obligations).
• Communication: replying to enquiries, sending service notices and important changes (legitimate interests and performance of a contract).
• Improving the website and platform: aggregated, de-identified analysis of usage (legitimate interests). Analytics cookies are only used with your consent.

We do not sell personal data and we do not share it for cross-context behavioural advertising.

We share personal data only with parties needed to operate the service:

• Tagada, through which Merchants apply for and access LumniPay, for onboarding, account management and integration.
• Licensed payment processing partners selected for a Merchant, to authorise, process and settle payments and to manage disputes.
• The Merchant you purchased from, who receives the order and customer details needed to fulfil your purchase.
• Infrastructure providers, such as cloud hosting, database, email and content delivery providers, under data processing agreements.
• Professional advisers, and public authorities or courts where we are legally required to disclose data.
• A successor entity in the event of a merger, acquisition or sale of assets, subject to this policy.

LumniPay is based in the United States, and our service providers may process data in the United States and other countries. When we transfer personal data of individuals in the European Economic Area, the United Kingdom or Switzerland, we rely on appropriate safeguards such as the European Commission's Standard Contractual Clauses, the UK International Data Transfer Addendum, or an applicable adequacy decision.

We keep personal data only as long as necessary for the purposes described above:

• Contact enquiries: for as long as needed to handle the request and any follow-up, then deleted.
• Merchant account data: for the life of the account, then for the period needed to handle legal claims.
• Transaction records: for the period required by accounting, tax and payment network rules, or as instructed by the Merchant.
• Server logs: for a limited security-relevant period, after which they are deleted or anonymised.

Depending on where you live, you may have the right to:

• Access the personal data we hold about you and receive a copy.
• Correct inaccurate data or have your data deleted.
• Restrict or object to certain processing, including processing based on legitimate interests.
• Receive your data in a portable format.
• Withdraw consent at any time where processing is based on consent.
• Know what categories of personal data we collect and disclose, and not be discriminated against for exercising your rights (CCPA).

To exercise these rights, email admin@lumnipay.com. We may need to verify your identity. If your data was collected during a purchase from a Merchant, we may forward your request to that Merchant, as the controller. You may also lodge a complaint with your local data protection authority.

We protect personal data with appropriate technical and organisational measures, including encryption in transit (TLS), encryption at rest, hashed passwords, role-based access controls, network isolation and audit logging. Card data is tokenised by our processing partners and never stored in full on our systems.

No system is perfectly secure. If a personal data breach occurs, we will notify affected Merchants, individuals and authorities as required by law.

Our website and platform are intended for businesses and adult purchasers. We do not knowingly collect personal data from children under 16. If you believe a child has provided us with personal data, contact us and we will delete it.

We may update this Privacy Policy from time to time. The date at the top of this page shows when it was last revised. Material changes will be announced on this page or by email to Merchants before they take effect.

Lumnipay LLC. Registered address: 5830 E 2nd St, Ste 7000 #33557, Casper, Wyoming 82609, USA. Wyoming registration number: 2026-001905944. EIN: 98-1922038.

Email: admin@lumnipay.com. Phone: +1 (307) 269-2992. Website: https://lumnipay.com.