Lumora Luxe — Privacy Policy

DRAFT — PENDING COUNSEL REVIEW

THIS IS A DRAFT PREPARED FOR ATTORNEY REVIEW. IT IS NOT LEGAL ADVICE AND IS NOT EFFECTIVE UNTIL REVIEWED, REVISED, AND APPROVED BY QUALIFIED LEGAL COUNSEL LICENSED IN THE APPLICABLE JURISDICTION(S). ALL BRACKETED ITEMS (e.g., [EFFECTIVE DATE], [STATE]) ARE PLACEHOLDERS TO BE COMPLETED. DO NOT PUBLISH OR RELY ON THIS DOCUMENT IN ITS CURRENT FORM.

Effective Date: [EFFECTIVE DATE] Last Updated: [EFFECTIVE DATE] Governing State: [STATE]

1. Introduction

Lumora Luxe ("Lumora Luxe," "the Company," "we," "us," or "our") operates a by-invitation luxury marketplace (the "Platform") that connects approved members ("Members," "you") with independent, licensed, non-medical beauty and wellness professionals ("Professionals") for services delivered on a mobile (at a location you designate) or in-office basis.

We provide the technology platform that facilitates discovery, matching, scheduling, communications, and payment processing between Members and Professionals. We are also a payment facilitator, using Stripe to process transactions. The Professionals who deliver services are independent contractors and are not employees or agents of Lumora Luxe.

This Privacy Policy explains what personal information we collect, how and why we use it, with whom we share it, the choices and rights available to you, and how we protect your information. Please read it carefully.

Important — Non-Medical Platform. The current Platform is expressly non-medical. We do not offer, broker, or facilitate medical, clinical, or diagnostic services, and we do not knowingly collect protected health information ("PHI") or medical records through the current Platform. See Section 14 (Non-Medical Scope; No Health Information) for details. If we introduce medical or clinical service verticals in the future, those services will be governed by separate notices, consents, and, where applicable, a HIPAA Notice of Privacy Practices and authorization.

By accessing or using the Platform, you acknowledge that you have read and understood this Privacy Policy. If you do not agree, please do not use the Platform.

2. Scope of This Policy

This Policy applies to personal information we collect through:

• The Lumora Luxe website, member portal, and any related applications;
• Your communications with us and with the Platform's AI concierge ("Wren"); and
• Bookings, transactions, and interactions facilitated through the Platform.

This Policy does not govern:

• The independent privacy practices of Professionals, who are separate businesses responsible for their own handling of your information once a booking is fulfilled (see Section 6);
• Third-party websites, products, or services that may link to or from the Platform; or
• Information you share in contexts outside the Platform.

3. Information We Collect

We collect the following categories of personal information.

3.1 Information You Provide Directly

• Account & Identity Information: your name, and information associated with your invitation or membership status.
• Contact Information: email address and telephone number.
• Location & Address Information: your city and, for mobile services, the street address or location where a service is to be performed. We use address and location information to enable mobile service delivery and to geo-match you with nearby Professionals.
• Booking Information: the services requested, appointment date/time, selected or matched Professional, scheduling notes, and non-clinical service preferences (for example, style, scent, product, or comfort preferences).
• Preferences & Communications: messages, requests, and preferences you submit through the Platform, including inputs you provide to the Wren concierge (see Section 5), and feedback or reviews you choose to provide.
• Verification Information (Professionals): for Professionals, we collect professional license information, insurance information, and related credentialing details submitted for onboarding and verification. (This subsection applies to Professionals; Members are not asked to provide license or insurance information.)

3.2 Payment Information

Payments are processed by Stripe, Inc. ("Stripe") through Stripe-hosted checkout. Lumora Luxe does not collect or store your full payment card number, card security code, or equivalent sensitive cardholder data. That information is submitted directly to Stripe and handled within Stripe's PCI-DSS-compliant environment. Our payment integration is designed to qualify for the reduced PCI-DSS SAQ-A scope. We may receive from Stripe limited, non-sensitive transaction metadata such as confirmation of payment status, the last four digits and brand of a card, a payment or customer token, billing ZIP/postal code, and transaction amounts and timestamps. See Section 7.

3.3 Information We Collect Automatically

When you use the Platform, we and our service providers may automatically collect:

• Device & Technical Information: IP address, browser type, operating system, device identifiers, and general (approximate) location inferred from IP address.
• Usage Information: pages and screens viewed, features used, referring/exit pages, timestamps, and interaction and diagnostic data.
• Cookies & Similar Technologies: as described in Section 12.

We use Vercel Web Analytics and Vercel Speed Insights to understand aggregate usage and performance. These tools are designed to be privacy-conscious and to measure traffic and performance without building advertising profiles of individuals.

3.4 Information From Other Sources

We may receive information about you from the Member who invited you (in connection with the invitation), from Professionals (for example, to confirm or update a booking), and from our service providers (for example, Stripe payment confirmations).

We do not knowingly collect sensitive personal information beyond what is described above, and, as noted, we do not collect health or medical information through the current Platform.

4. How We Use Your Information

We use personal information for the following purposes:

• Provide the Platform: to create and manage your membership, authenticate you, and operate core features.
• Match & Book Services: to geo-match you with suitable Professionals, present availability, facilitate scheduling, and share booking details with the Professional you select or who is matched to you.
• Process Payments: to facilitate payment, deposits, authorizations, refunds, and related transaction functions through Stripe.
• Safety, Verification & Trust: to verify Professional licensing and insurance, help maintain the integrity of the Platform, prevent, detect, and investigate fraud, misuse, or prohibited conduct, and support Member and Professional safety.
• Communications: to send booking confirmations, reminders, service-related notices, security alerts, and administrative messages (via Resend and other channels), and, where permitted, to send you updates about the Platform. Transactional and service messages are part of the service and are not marketing.
• Concierge Experience: to operate the Wren AI concierge and respond to your requests (see Section 5).
• Improve & Develop: to understand how the Platform is used, troubleshoot, analyze performance, and improve and develop features and services.
• Legal & Compliance: to comply with applicable laws, respond to lawful requests and legal process, enforce our terms and agreements, and establish, exercise, or defend legal claims.

Where required by applicable law, we rely on one or more of the following legal bases to process your information: performance of a contract with you; your consent; our legitimate interests (such as securing and improving the Platform); and compliance with legal obligations.

5. The Wren AI Concierge

The Platform offers an AI-powered concierge named "Wren," which uses AI technology provided by Anthropic, PBC ("Anthropic") to help you navigate the Platform, describe your preferences, and facilitate requests.

• What is processed. When you interact with Wren, the messages and requests you submit — together with relevant context such as available services, scheduling options, and your non-clinical preferences — are processed to generate helpful responses and to assist with your requests.
• How inputs are handled. Your inputs to Wren are transmitted to Anthropic's API solely to generate a response for you. We instruct Members not to submit sensitive personal information (including any health, medical, or clinical information) to Wren; the concierge is designed for non-medical, service-facilitation purposes only.
• No model training on your inputs by default. We do not authorize the use of your Wren inputs to train third-party AI models, and we rely on Anthropic's commercial terms, under which inputs and outputs submitted through the API are not used to train Anthropic's models except as permitted by those terms.
• Human oversight & limitations. Wren provides convenience and information; it does not provide medical, legal, or professional advice, and it is not a substitute for the independent judgment of a licensed Professional. We may review concierge interactions to improve quality, safety, and reliability of the service.

See Section 6 for how Anthropic is engaged as a subprocessor.

6. How We Share Your Information

We share personal information only as described below. We do not sell your personal information, and we do not "share" it for cross-context behavioral advertising, as those terms are defined under California law.

6.1 With the Matched Professional (to Fulfill a Booking)

To fulfill a booking, we share with the selected or matched Professional the information reasonably necessary to deliver the service — typically your name, relevant contact details, the service location or address (for mobile services), appointment details, and the non-clinical preferences and notes you provide. Once shared, the Professional handles that information as an independent business responsible for its own privacy practices. We encourage you to share only what is relevant to your service.

6.2 With Service Providers (Subprocessors)

We engage trusted service providers ("subprocessors") to operate the Platform. They may process personal information on our behalf, under contract, only for the purposes we specify:

We may update our subprocessors from time to time and will maintain reasonable contractual safeguards with each.

6.3 Legal, Safety & Protection

We may disclose personal information when we believe in good faith it is necessary to: comply with applicable law, regulation, legal process, or governmental request; enforce our terms and agreements; detect, prevent, or address fraud, security, or technical issues; or protect the rights, property, or safety of Lumora Luxe, our Members, Professionals, or the public.

6.4 Business Transfers

If Lumora Luxe is involved in a merger, acquisition, financing, reorganization, or sale of assets, personal information may be transferred as part of that transaction, subject to the commitments in this Policy or a successor policy with materially equivalent protections.

6.5 With Your Direction or Consent

We may share information for other purposes at your direction or with your consent.

7. Payment Data

Payment card processing is handled by Stripe through Stripe-hosted checkout. We do not store your full card number, expiration, or security code. Your payment information is provided directly to Stripe and processed under Stripe's own terms and privacy policy. We receive only limited transaction metadata (e.g., payment status, card brand and last four digits, tokens, and amounts) needed to manage bookings, deposits, refunds, and records. Your use of Stripe-processed payments is also subject to Stripe's Privacy Policy. Our integration is designed to fall within PCI-DSS SAQ-A scope.

8. Data Retention

We retain personal information for as long as necessary to fulfill the purposes described in this Policy, including to provide the Platform, maintain your membership, comply with our legal, tax, and accounting obligations, resolve disputes, and enforce our agreements. Retention periods vary based on the type of information and the purpose for which it is processed. When information is no longer needed, we will delete, de-identify, or anonymize it in a manner consistent with applicable law and our internal retention schedules. Certain transaction records may be retained by Stripe and by us for the periods required by law.

9. Security

We implement administrative, technical, and organizational measures designed to protect personal information against unauthorized access, use, alteration, disclosure, or loss. These measures include, as appropriate: encryption in transit; access controls and authentication (via Supabase); use of reputable, security-focused infrastructure and subprocessors; and limiting access to personal information to those who need it to operate the Platform. No method of transmission or storage is completely secure, and we cannot guarantee absolute security. You are responsible for maintaining the confidentiality of your account credentials and for notifying us of any suspected unauthorized use.

10. Your Privacy Rights

Depending on where you live and subject to applicable law and verification, you may have certain rights regarding your personal information. To exercise any right, contact us as described in Section 16. We will not discriminate against you for exercising your rights.

10.1 California Residents (CCPA / CPRA)

If you are a California resident, the California Consumer Privacy Act, as amended by the California Privacy Rights Act ("CCPA/CPRA"), provides you with the following rights:

• Right to Know / Access: to request the categories and specific pieces of personal information we have collected, the categories of sources, the business or commercial purposes for collecting it, and the categories of third parties and service providers with whom we disclose it.
• Right to Delete: to request deletion of personal information we collected from you, subject to certain exceptions.
• Right to Correct: to request correction of inaccurate personal information.
• Right to Opt Out of Sale/Sharing: we do not sell or "share" (for cross-context behavioral advertising) personal information, so no opt-out is necessary; nonetheless, you may confirm this with us.
• Right to Limit Use of Sensitive Personal Information: we do not use or disclose sensitive personal information for purposes that would trigger this right.
• Right to Non-Discrimination: you will not receive discriminatory treatment for exercising your rights.

Categories collected (CCPA/CPRA). In the preceding twelve (12) months, we have collected the following statutory categories: identifiers (e.g., name, email, phone, IP address); customer records information (e.g., address, payment-related metadata); commercial information (e.g., bookings and preferences); internet or other electronic network activity (e.g., usage data); geolocation data (approximate and, for mobile service, the address you provide); and inferences drawn to provide and improve the service. We collect these for the business purposes described in Section 4 and disclose them to the subprocessors and recipients described in Section 6. We do not sell or share these categories.

Authorized agents. You may use an authorized agent to submit a request; we may require proof of authorization and verification of your identity.

How to exercise. Submit a request via the mechanism in Section 16. We will verify your request and respond within the timeframes required by law.

10.2 Other U.S. State Privacy Rights

Residents of other U.S. states with comprehensive privacy laws may have similar rights (e.g., to access, correct, delete, and obtain a portable copy of personal information, and to opt out of certain processing). We honor applicable rights consistent with the laws of your state. Contact us as described in Section 16.

10.3 GDPR-Style Rights (If Applicable)

To the extent the EU/UK General Data Protection Regulation or similar laws apply to our processing of your personal information, you may have the rights to: access; rectification; erasure; restriction of processing; data portability; objection to processing (including processing based on legitimate interests); and withdrawal of consent (without affecting the lawfulness of processing before withdrawal). Where applicable, you may also lodge a complaint with your local data protection authority. If these rights apply to you, contact us as described in Section 16, and we will respond consistent with applicable law. (Counsel to confirm applicability, controller/processor roles, and any representative/transfer-mechanism requirements.)

11. Children's Privacy

The Platform is intended solely for adults. You must be at least eighteen (18) years old to become a Member or use the Platform. We do not knowingly collect personal information from anyone under 18. If we learn that we have collected personal information from a person under 18, we will take reasonable steps to delete it. If you believe a minor has provided us information, contact us as described in Section 16.

12. Cookies, Analytics & Tracking Technologies

We and our service providers use cookies and similar technologies to operate and secure the Platform, remember your session and preferences, and understand usage and performance.

• Essential cookies enable core functionality such as authentication and security.
• Analytics & performance tools — including Vercel Web Analytics and Vercel Speed Insights — help us measure aggregate traffic and performance. These tools are designed to be privacy-conscious and are not used to build advertising profiles.

You can control cookies through your browser settings; disabling certain cookies may affect Platform functionality. Where required by law, we will present a cookie or consent banner and honor applicable consent choices and recognized opt-out preference signals (such as Global Privacy Control) to the extent required.

13. International Data Transfers

Lumora Luxe operates in the United States, and our subprocessors may process and store information in the United States and other countries. If you access the Platform from outside the United States, you understand that your information may be transferred to, stored, and processed in the United States and other jurisdictions where data-protection laws may differ from those of your location. Where required by applicable law, we implement appropriate safeguards for cross-border transfers (for example, standard contractual clauses). (Counsel to confirm transfer mechanisms based on operating footprint.)

14. Non-Medical Scope; No Health Information

The current Platform connects Members with independent, licensed non-medical beauty and wellness Professionals. Services offered through the current Platform are cosmetic, beauty, and wellness in nature and are not medical, clinical, or diagnostic services.

• We do not solicit or knowingly collect protected health information (PHI), medical history, diagnoses, or clinical records through the current Platform.
• Any preferences you provide are non-clinical (for example, style, product, scent, or comfort preferences). Please do not submit medical or health information through the Platform or to the Wren concierge.
• Lumora Luxe is not a covered entity or business associate under HIPAA with respect to the current non-medical Platform.
• Future medical verticals: medical or clinical service offerings are currently disabled. If we launch any medical vertical in the future, it will be governed by separate notices, terms, and consents, including, where applicable, a HIPAA Notice of Privacy Practices and appropriate authorizations. This Privacy Policy will be updated accordingly, and the applicable medical-specific notices will control for those services.

15. Changes to This Policy

We may update this Privacy Policy from time to time. When we make material changes, we will update the "Last Updated" date above and, where appropriate or required, provide additional notice (for example, by email via Resend or through the Platform). Your continued use of the Platform after an update becomes effective constitutes acceptance of the revised Policy, to the extent permitted by law.

16. How to Contact Us / Submit a Data Request

To ask questions about this Policy or to exercise your privacy rights, contact us:

• Lumora Luxe — Privacy
• Email: [privacy@ EMAIL ADDRESS]
• Data Requests: [DATA-REQUEST EMAIL OR WEB FORM URL]
• Mailing Address: [COMPANY LEGAL NAME], [MAILING ADDRESS], [CITY, STATE, ZIP]

For verified privacy-rights requests, we will take reasonable steps to confirm your identity (and, if applicable, your authorized agent's authority) before responding, and we will respond within the timeframes required by applicable law.

This document is a DRAFT prepared for attorney review. Bracketed items are placeholders. Counsel should confirm governing law, applicable state and international privacy obligations, subprocessor terms, retention schedules, and disclosure category mappings before publication.