Privacy Policy

• Account holders: people who create a LumexLink account and publish a page.
• Visitors: people who view or interact with a published LumexLink page.
• Lead submitters: visitors who enter information into a lead form on someone’s LumexLink page.
• People who contact us: anyone who uses our contact form or emails us.

From account holders

• Account details: email address, handle, and password. Passwords are stored only as salted hashes; we cannot read them.
• Page content: the text, links, images, and settings you add to your page. Content you publish is public.
• Integration settings: webhook URLs or forwarding email addresses you set up for lead routing.
• Consent records: when you accepted our Terms of Service and this Privacy Policy, and whether you chose to receive product updates.

From visitors, automatically

• Page views and link clicks, with timestamps and which link was clicked.
• The referring website or app.
• Device type, browser, and operating system.
• Country and, where available, region. Our network provider derives this from the visitor’s IP address at the time of the visit. We do not store IP addresses in our analytics.

From lead submitters

• Whatever the page owner’s lead form asks for, typically a name and email address.

From people who contact us

• Your name, email address, LumexLink handle if you provide it, the topic you select, and your message.

• To provide, operate, secure, and improve the Service.
• To show account holders analytics about their own page: views, clicks, click-through rate, devices, referrers, and visitor countries and regions.
• To deliver lead form submissions to the page owner by email or webhook.
• To send service messages, such as sign-in, security, and policy notices.
• To respond to support, privacy, and abuse reports.
• To detect and prevent fraud, spam, and violations of our Terms of Service.
• To send occasional updates about LumexLink and other Lumex products, only if you opted in. Every update includes an unsubscribe link.

When a visitor submits a lead form, that information belongs to the page owner. The page owner decides what to collect and how to use it, and is responsible for having a lawful basis and their own privacy notice. Lumex processes lead data only to store it in the page owner’s account and deliver it to them. Questions about how a page owner uses your information should go to that page owner.

• Essential cookies keep account holders signed in and protect the Service. The Service cannot work without them.
• One analytics cookie: published pages set a first-party cookie named ll_vid. It holds a random identifier, not your name or contact details, and expires after 12 months. We use it only so a returning visitor is not counted twice.
• We do not use third-party analytics, advertising cookies, or tracking pixels.
• Fonts and scripts on LumexLink are served from our own domains, so loading a page does not send your information to font or script providers.

We share information with providers that run the Service on our behalf, under contracts that limit how they use it:

• HighLevel, Inc. provides the platform LumexLink is built and hosted on, including account sign-in, data storage, email delivery, and the customer relationship system where contact form messages are kept.
• Cloudflare, Inc. routes and secures traffic to lumexlink.app and lumex.link, and determines visitors’ approximate location.

We may also disclose information when required by law, or to protect the rights and safety of our users and the public. If Lumex is involved in a merger or acquisition, information may transfer to the successor under this policy.

Information may be stored and processed in Canada, the United States, or other countries where our providers operate. Those countries may have different privacy laws, and information held there may be accessible to local authorities.

• Account data and page content: until you delete your account. Deletion is immediate.
• Visitor analytics: 24 months, then deleted. Deleted sooner if the page owner deletes their account.
• Lead submissions: in the page owner’s account until they delete them or their account.
• Contact form messages: up to 24 months after your request is resolved.
• Backups: deleted information may remain in encrypted backups for up to 35 days before it is purged.

Depending on where you live, you may have the right to access, correct, delete, or export your personal information, to withdraw consent, and to object to certain processing.

• Delete your account: from your account settings, after confirming your handle. Deletion is immediate and permanent. Your page goes offline, your handle becomes available to others, and your content, lead submissions, and analytics are deleted. We cannot restore a deleted account.
• Edit your information: most account and page data can be changed directly in your account.
• Stop product updates: use the unsubscribe link in any update, or contact us.
• Other requests: use our contact form and select “Privacy or data request”, or email lumexlink@golumex.com. We respond within 30 days and may need to verify your identity.

You may also complain to the Office of the Privacy Commissioner of Canada or to your local data protection authority.

We protect information with encryption in transit on every domain, salted password hashing, access controls, and automated protection against spam and bots. No system is completely secure. If a breach creates a real risk of significant harm, we will notify affected people and regulators as the law requires.

LumexLink is not intended for anyone under 16, and we do not knowingly collect information from them. If you believe a child has created an account, contact us and we will delete it.

We will post changes on this page and update the effective date. For material changes, we will email account holders at least 14 days before they take effect.

Privacy Officer
Lumex Solutions Ltd.
PO Box 346 Southey, SK S0G 4P0
Canada
lumexlink@golumex.com