Privacy Policy

Who we are

Lumina ERP, LLC ("Lumina", "we", "us") is an engineering practice in Houston, Texas. We are responsible for the personal information described in this policy.

This policy covers lumina-erp.com and its pages, our contact form and newsletter, meeting booking, the client intake portal, the sample desk demo and the records we keep of our conversations with prospects and clients.

It does not cover client data we handle while delivering an engagement. That work is governed by the agreement we sign with that client, which sets how the data is accessed, used, kept and returned.

What we collect

What you give us:

• Contact form: your name, company, email address and message. If you choose to add them, also your phone number, LinkedIn profile URL, the ERP you run and the kind of help you need. We also record whether you ticked the box to receive occasional updates.
• Newsletter: your email address.
• Meeting booking: your name, email address, the time you pick and any answers you give on the booking form.
• Client intake portal: the answers and files you upload, if we have invited you to one.
• Sample desk demo: the questions you type into it.
• Conversations: the emails, calls, text messages and meetings we have with you. We also keep the notes our team makes about them.
• LinkedIn pre-fill: if you choose "Pre-fill with LinkedIn" on the contact form, LinkedIn shares your name, email address, profile URL and profile picture with our site so the form can fill itself in.

What we collect automatically

• Consent record: with each form we store the exact consent wording you saw, identified by a fingerprint of that text, and the version of this policy in effect when you sent it.
• How you found us: the page you landed on, the site that referred you, campaign tags in the link you followed (for example utm_source or an ad click identifier) and the last button you clicked before a form. Our own cookies hold this and it is attached to a form or booking you send.
• Device and connection: your browser user agent and the country your connection comes from are attached to a form you send. Your IP address is used by our hosting provider for security and by us to rate-limit form posts. It is not stored with your submission.
• Bot check: Cloudflare Turnstile checks that a form was sent by a person and tells us only whether the check passed.
• Site analytics: pages viewed, clicks, scroll depth, form interactions and page performance, measured through Google Analytics, PostHog, Datadog and the Meta Pixel. If you visit from the EEA, the UK or Switzerland, this happens only after you accept. See Cookies and similar technologies below.

How we use it

• To reply to your inquiry, schedule and hold the meeting you booked and send you a copy of what you submitted.
• To keep a record of our conversations with prospects and clients in our CRM so the right engineer follows up and nothing is lost.
• To send our newsletter or occasional updates, only if you asked for them. Every one of those emails lets you unsubscribe.
• To honor a request not to be contacted. We keep a minimal record of that request, stored as a one-way hash where we can, so we do not contact you again.
• To prepare for and deliver an engagement you have asked us to scope.
• To understand which pages and campaigns bring people to us and to measure our advertising.
• To keep the site and forms secure, stop spam and abuse and fix problems.
• To meet legal, tax and accounting obligations and to protect our rights.

Legal bases (EEA and UK)

If the GDPR or the UK GDPR applies to you, we rely on these legal bases:

• Legitimate interests: replying to business inquiries, keeping records of business conversations, securing the site and understanding how it is used.
• Consent: newsletters and marketing email, and analytics and advertising cookies, which we ask for through a cookie banner. You can withdraw consent at any time from Cookie settings at the bottom of any page.
• Contract: steps you ask us to take before an engagement, and delivering one.
• Legal obligation: records we must keep by law.

Who we share it with

We do not sell personal information for money. We share it only with service providers that help us run the business, under their terms of service and data processing terms, and only for the purposes in this policy:

• Cloudflare: hosts this site and our CRM, stores CRM records and portal uploads, runs Turnstile, sends some of our email through Cloudflare Email Sending, protects the site from attacks and counts page views and page speed with Cloudflare Web Analytics, which sets no cookies and does not track you across sites.
• Our own CRM: we built and operate the CRM that receives your form, booking and newsletter sign-up. It runs on Cloudflare, and only named Lumina staff can sign in to it.
• Google: Google Workspace for our email, including form receipts, our calendar and Google Meet calls; Google Tag Manager and Google Analytics for site measurement; and Google advertising measurement where our tags use it.
• Cal.com: runs our booking page and passes your booking to our CRM.
• PostHog: product analytics, hosted in the United States. It records the pages you view, the links and buttons you click and how far you scroll, so we can see which pages help visitors and which do not. It never receives what you type into our forms. It may record a session replay of your visit, with every form field and our form confirmation messages masked. Requests reach PostHog through our own domain, and we remove our cookies from them first. PostHog uses your IP address to estimate your general location.
• Datadog: measures site performance and errors. A sample of visits is recorded as a session replay, with the text you type into fields masked. We never record a session replay when your browser sends Global Privacy Control.
• Meta: the Meta Pixel measures visits and conversions from our advertising.
• LinkedIn: only if you choose to pre-fill the contact form with your LinkedIn profile.
• xAI: answers the questions typed into the sample desk demo. Please do not type personal or confidential information there.
• Twilio: carries phone calls and text messages between our team and you.
• Anthropic: an AI model that helps our team draft replies inside our CRM.
• Our source code lives with code hosting services. Your submissions do not.
• We may also disclose information when the law requires it, to protect our rights or safety or as part of a merger or sale of our business.

Cookies and similar technologies

We use a small set of cookies and browser storage. You can block or delete cookies in your browser at any time, and the site keeps working without them.

Visitors in the EEA, the UK and Switzerland: we use the country Cloudflare reports for your connection to decide whether to ask. If you are in one of those places, a banner asks you to accept or reject analytics and advertising cookies, and Google Tag Manager, Google Analytics, Google advertising tags, the Meta Pixel, PostHog and Datadog do not load until you choose Accept. If you choose Reject, or make no choice, they stay off. We tell Google your choice through Google Consent Mode, with every signal set to denied until you accept.

Everyone else: those tools load when you visit, and you can turn them off at any time.

Global Privacy Control: if your browser sends a Global Privacy Control signal, we treat it as a request to opt out of the sale or sharing of your information and of targeted advertising. We do not load the Meta Pixel, Google Tag Manager, Google Analytics, Google advertising tags or PostHog, and Datadog does not record a session replay. This applies wherever you are and whatever you choose in the banner.

Cookie settings: the Cookie settings link at the bottom of every page reopens the choice, so you can accept or reject at any time. When you reject, we also tell PostHog to stop and remove the Google, Meta, PostHog and Datadog cookies and storage we can reach from your browser.

• lumina_attr (ours): remembers how you first and most recently arrived at the site. Expires 90 days after your last visit. Read only by our site and CRM, never shared with ad platforms.
• lumina_sid (ours): identifies the current visit. Expires after 30 minutes without activity.
• lumina_consent (ours): remembers whether you accepted or rejected analytics and advertising cookies, so we do not ask again. Expires after 180 days.
• Cloudflare: security cookies such as __cf_bm and cf_clearance for bot protection, and a sign-in cookie for our own staff.
• Google Analytics and Google advertising (_ga, _ga_* and related cookies): site and campaign measurement.
• Meta Pixel (_fbp and _fbc): advertising measurement.
• PostHog (a ph_ cookie and matching browser storage): product analytics and session replay. It holds a random visitor ID and expires after 365 days.
• Datadog (_dd_s): performance monitoring and session replay.
• Cal.com: cookies set inside the booking calendar when you use it.
• Browser storage on your device only: a draft of your name, company and help type so the contact form survives a reload. Also a few flags such as whether you dismissed the sticky call-to-action and, until you close the tab, whether your region is asked for cookie consent. These stay in your browser and are not sent to us.

How long we keep it

• Inquiries, bookings and conversation records: for as long as we have an active or potential business relationship with you, then deleted or anonymized. We delete them sooner if you ask, unless we must keep them for legal, tax or accounting reasons.
• Newsletter sign-ups: until you unsubscribe. After that we keep only what we need to stop sending to you.
• Do-not-contact records: for as long as we need them to honor your request.
• Client portal answers and files: for the engagement they belong to, then deleted or returned as the engagement agreement says.
• Attribution cookies: 90 days for lumina_attr and 30 minutes of inactivity for lumina_sid.
• Cookie choice: 180 days for lumina_consent.
• Analytics data: according to the retention settings of each analytics provider.
• Server logs: kept by Cloudflare for a short period. Our form logs record the outcome of a submission, never its field values.

Your rights

Wherever you live, you can ask us to:

• Tell you what personal information we hold about you and give you a copy.
• Correct information that is wrong.
• Delete your information.
• Stop sending you marketing email, or not contact you at all.
• Stop using your information for targeted advertising.

Texas residents

Under the Texas Data Privacy and Security Act you have the right to confirm whether we process your personal data, access it, correct it, delete it and get a portable copy. You can also opt out of targeted advertising, the sale of personal data and profiling that produces legal or similarly significant effects. We do not sell personal data for money and we do not make those kinds of automated decisions. We treat a Global Privacy Control signal from your browser as a request to opt out of targeted advertising and sale.

We respond within 45 days. If we decline your request, you can appeal by replying to our answer with the word "appeal", and we will tell you the result of the appeal in writing. If you are not satisfied, you can contact the Texas Attorney General.

California residents

Under the California Consumer Privacy Act, as amended by the CPRA, you have the right to know what personal information we collect, use and disclose, to access and get a copy of it, to correct it, to delete it and to opt out of its sale or sharing. We do not sell personal information for money. Our use of the Meta Pixel and Google advertising measurement may count as "sharing" for cross-context behavioral advertising. To opt out, turn on Global Privacy Control in your browser, which we honor automatically, choose Reject in Cookie settings at the bottom of any page or email us.

In the last 12 months we collected the categories described in What we collect: identifiers and contact details, professional information, internet activity and the content of your messages. We do not collect sensitive personal information for the purpose of inferring characteristics about you. We will not treat you differently for exercising your rights. We respond within 45 days and may need to confirm your identity first. You can use an authorized agent.

EEA and UK residents

You have the rights of access, correction, deletion, restriction, portability and objection, including the absolute right to object to direct marketing. Visitors from the EEA, the UK and Switzerland are asked before any analytics or advertising cookies load. Where we rely on consent, you can withdraw it at any time, including from Cookie settings at the bottom of any page. We respond within one month. You can also complain to your local data protection authority.

How to exercise your rights

Email privacy@lumina-erp.com or hello@lumina-erp.com and tell us what you are asking for. To protect you, we may ask you to confirm your identity from the email address we have on file before we act. There is no charge.

Children

Our site and services are for businesses and are not directed to anyone under 18. We do not knowingly collect personal information from children. If you believe a child has sent us information, contact us and we will delete it.

Security

Data is encrypted in transit with TLS and at rest by our hosting providers. Access to our CRM is limited to named Lumina staff, and client credentials are kept in an encrypted vault. Forms are protected by bot checks and rate limits. No system is perfectly secure, and we cannot promise that information will never be accessed without authorization. If a breach affects your personal information, we will notify you as the law requires.

International transfers

We are based in the United States, and our service providers may process information in the United States and other countries. If you contact us from outside the United States, your information will be transferred there. Where the law requires a transfer mechanism, we rely on the ones our providers offer, such as the European Commission Standard Contractual Clauses.

Changes to this policy

When we change this policy we update the date at the top of this page. Each form records which version of the policy was in effect when you sent it. If a change materially affects how we use information we already hold, we will tell affected people before it takes effect.

Contact

• Lumina ERP, LLC
• Privacy requests: privacy@lumina-erp.com
• General: hello@lumina-erp.com
• Mail: 8080 Westpark Drive, Ste 80341, Houston, TX 77063