Privacy Policy

1. Who We Are

Lumisheets is operated by its co-founders, based in Bangkok, Thailand and Tokyo, Japan. For all data-protection questions and requests, the controller of your personal information is Lumisheets, contactable at hello@lumisheets.net.

We do not currently have a designated Data Protection Officer; please direct all privacy enquiries to the address above.

2. Information We Collect

We collect the minimum information needed to operate your subscription and the website. Specifically:

Information you provide directly

• Account information: Your name, email address, and (where you provide it) your professional affiliation, country, and city. Collected when you subscribe or contact us.
• Communications: The contents of any messages you send us by email or through any contact form.

Information collected automatically

• Usage and device information: When you visit our website, our hosting provider Squarespace automatically records standard server log information — including IP address, browser type, pages visited, referring URL, and timestamps. This is used for security, fraud prevention, and basic analytics.
• Cookies: Our website uses cookies and similar technologies for essential functionality and aggregate analytics. See Section 9 below.

Information collected through third parties

• Payment information: Payments are processed by our payment processor. When you subscribe, you provide your payment details directly to our payment processor. Lumisheets does not see, store, or have access to your full card number, bank account number, or other payment credentials. Our payment processor shares with us only the information needed to manage your subscription (name, email, billing country, last four digits of card, and transaction status).
• Account and access email: To grant and manage your access to the online library, we record the email address associated with your subscription in our account-management systems, which are operated using Google services. This requires only your email; we do not access any other information from your Google account.

3. How We Use Your Information

We use personal information for the following purposes, and only these purposes:

• To provide the Service: Setting up and managing your access to the online library, maintaining your subscription, responding to support requests, and delivering monthly Content updates.
• To process payments: Via our payment processor; to issue receipts and invoices; to handle refunds.
• To communicate with you: Service emails (subscription confirmations, payment receipts, content-update notifications, security alerts) and occasional product updates from the co-founders.
• To improve the Service: Reviewing aggregate, non-identifying usage patterns to understand what is and is not useful.
• To comply with law and protect rights: Responding to lawful requests, enforcing our Terms of Service, and preventing fraud.

Legal bases (for users in the EU, UK, and similar jurisdictions)

• Performance of a contract — for providing the service you have paid for.
• Legitimate interests — for security, fraud prevention, basic analytics, and product-improvement communications.
• Legal obligation — for tax records and responding to lawful requests.
• Consent — where required for non-essential cookies or any future marketing emails to non-customers; you may withdraw consent at any time.

4. Who We Share Your Information With

We do not sell your personal information. We do not share it with third parties for their own marketing purposes. We share information only with the limited set of service providers needed to operate the service:

• Payment processor: Receives the information needed to process your payment, including name, email, billing country, and transaction details. Lumisheets does not see, store, or have access to your full card number or bank account number.
• Google (access management and infrastructure): Located in the United States and globally; supports our account and access-management systems. Google's privacy policy
• Squarespace (website hosting): Located in the United States and Ireland; hosts our website and processes server-log information. Squarespace's privacy policy
• Email provider: For sending you service-related and product-update emails. The provider receives only your name and email address.

We may also disclose information when required by law, to enforce our Terms of Service, to protect our rights or those of others, or in connection with a sale, merger, or transfer of the business (in which case the acquirer would be bound by this Privacy Policy or a substantially equivalent one).

5. International Data Transfers

Lumisheets is operated from Thailand and Japan. Our service providers (Google, Squarespace) are based primarily in the United States. As a result, your personal information will be transferred to and processed in countries outside the European Economic Area, the United Kingdom, and other jurisdictions whose data-protection laws may differ from your own.

Where personal information is transferred internationally, we rely on the safeguards offered by each service provider — including Standard Contractual Clauses (where applicable), adequacy decisions, or equivalent legal mechanisms. You can review each provider's transfer mechanisms via the links in Section 4 above.

6. How Long We Keep Your Information

We retain your personal information only for as long as needed for the purposes described in this Policy:

• Active subscribers: For the duration of your subscription.
• Cancelled subscribers: Up to twenty-four (24) months after cancellation, for accounting, tax, support continuity, and to honour reactivation requests. You may request earlier deletion at any time — see Section 7.
• Transactional records: Payment and tax records are retained for the period required by applicable accounting and tax law (typically seven years).
• Server logs and analytics: Squarespace retains server logs per its own retention schedule (typically not longer than 13 months in identifiable form).

7. Your Rights

Subject to applicable law, you have the following rights regarding your personal information. To exercise any of them, email us at hello@lumisheets.net. We will respond within thirty (30) days.

• Access: Request a copy of the personal information we hold about you.
• Correction: Ask us to correct inaccurate or incomplete information.
• Deletion: Ask us to delete your personal information, subject to limitations where we are required to keep it for legal or accounting reasons.
• Portability: Receive a machine-readable copy of the information you provided to us.
• Objection and restriction: Object to or request restriction of certain processing, including processing based on legitimate interests.
• Withdraw consent: Where processing is based on consent, withdraw it at any time without affecting prior lawful processing.
• Complain: Lodge a complaint with your local data-protection authority if you believe we have mishandled your information.

Additional rights for California residents (CCPA / CPRA)

If you are a California resident, you have additional rights under the California Consumer Privacy Act and the California Privacy Rights Act, including the right to know the categories of personal information we collect and share, the right to delete, the right to correct, and the right to opt out of any sale or sharing of personal information.

We do not sell your personal information, and we do not share it for cross-context behavioural advertising. California residents may exercise their rights by emailing us at hello@lumisheets.net. We will not discriminate against you for exercising any privacy right.

8. Security

We take reasonable technical and organisational measures to protect your personal information. Payment information is handled directly by our payment processor and never touches our systems. Account information is stored on Squarespace and Google's infrastructure, both of which provide industry-standard encryption in transit and at rest.

No method of transmission over the internet or electronic storage is 100% secure. While we strive to use commercially reasonable means to protect your information, we cannot guarantee absolute security. In the event of a personal-data breach affecting you, we will notify you and the relevant authorities as required by applicable law.

9. Cookies and Similar Technologies

Our website uses cookies and similar technologies provided by Squarespace. These include:

• Strictly necessary cookies: Required for the website to function (e.g., session management, security). These cannot be disabled.
• Analytics cookies: Squarespace's built-in analytics measure aggregate traffic patterns. These do not identify you individually.

We do not use cookies for third-party advertising, retargeting, or social-media tracking. Where required by law, our website displays a cookie banner allowing you to manage non-essential cookie preferences.

You can disable cookies entirely through your browser settings; some site features may not function correctly if you do.

10. Children's Privacy

Lumisheets is a business-to-business service for working educational consultants. It is not directed at, or intended for use by, children under the age of 18. We do not knowingly collect personal information from children. If you believe we have inadvertently collected information from a child, please contact us at hello@lumisheets.net and we will delete it promptly.

Although our consultant customers work with high-school-age students, Lumisheets itself does not collect, process, or store any information about those students. Information about students remains entirely within the consultant's own systems.

11. Changes to This Policy

We may update this Privacy Policy from time to time. The "Last updated" date at the top of the document indicates when it was most recently revised. For material changes, we will notify active subscribers by email at least thirty (30) days before the changes take effect. Continued use of the service after the effective date constitutes acceptance of the revised Policy.

12. Contact Us