Privacy Policy

This Privacy Policy explains how Lumith ("Lumith", "we", "us") and the independent beauty and body-art professionals who use it ("Artists") collect, use, and protect personal information. Lumith is a booking, intake, and consent tool. When you fill out a form, the Artist you are booking with is the party collecting your information, and Lumith stores and processes it securely on their behalf.

1. Information we collect

Depending on the form and service, we may collect:

• Contact details — your name, email address, and phone number.
• Booking & service details — your responses to the Artist's questions (for example, the design or service you want, placement, size, budget, and preferences).
• Health & consent information — allergies, medical conditions, day-of health answers, agreements, and your signature on consent and release forms (see Section 2 below).
• Photos & images — reference photos and photos of the area being serviced.
• Photo ID — where a form requires it (for example, age verification before a tattoo or piercing), a photo of your government-issued ID. ID photos are used only to verify your identity and age, are kept in private storage, and are visible only to the Artist you submitted them to.
• Other details you choose to provide, such as skin tone selection or an inspiration link.
• Artist account information — for Artists, we collect your login email, business details, and subscription status.
• Basic technical data — your browser stores a small amount of information on your device (for example, to pre-fill your name on return visits and to keep an Artist signed in).

2. Health & consent information

Some forms ask health questions — such as allergies, medical conditions, medications, or day-of health answers — because your Artist needs them to provide the service safely and to complete the consent records their trade requires. This information:

• is collected only when a form asks for it, and only for safety, consent, and record-keeping;
• is visible only to the Artist you submitted it to;
• is never sold, never used for advertising or marketing, and never shared except as described in Section 5;
• is encrypted in transit and protected by database-level access rules.

Signed consent forms are retained as a legal record of the agreement between you and your Artist.

3. How we use your information

• To deliver the requests and consent forms you submit to the Artist.
• To let the Artist review, manage, respond to, and (where offered) send aftercare instructions for your booking.
• To operate, secure, and improve the Lumith service.
• To process Artist subscriptions and payments.

We do not sell your personal information, and we do not use it for advertising.

4. How your information is stored and protected

Data is stored using Supabase (database and file storage) and transmitted over encrypted (HTTPS) connections. Access is restricted so that an Artist can only see the information submitted to their own account, enforced by database-level security rules. Photos, IDs, and signatures are kept in private storage and shared only through temporary, access-controlled links.

5. Who we share information with

We share information only with the service providers needed to run Lumith, and only as required to provide the service:

• Supabase — secure database, authentication, and file storage.
• Netlify — website and app hosting.
• Stripe — Artist subscription billing (Stripe handles payment card details; we do not store them).
• Brevo — sending emails such as consent copies and aftercare, where enabled.

We may also disclose information if required by law, or to protect the rights, safety, and property of clients, Artists, or Lumith.

6. How long we keep your information

Client records are kept while the Artist's account remains active, so the Artist can provide their services and meet their legal record-keeping obligations (many trades are required by law to keep signed consent records for a number of years). Artists can delete individual client records at any time; deleting a record permanently removes it along with its stored photos, signatures, and files. If an Artist's subscription ends, their stored records are retained so the Artist can regain access if they return — or the Artist may request full deletion of their account and all associated data (see Section 7).

7. Deleting your information or account

Clients: to request deletion of information you submitted, contact the Artist you booked with — they can delete your records directly from their dashboard — or email us at heather@lumith.net and we will help coordinate your request.

Artists: you may request deletion of your Lumith account at any time by emailing heather@lumith.net from your account email address. When your account is deleted, your profile, your client records, and all stored files (photos, signatures, and IDs) are permanently deleted. We may retain limited billing records where the law requires it (for example, invoices).

8. Your choices and rights

You may request to access, correct, or delete the information you submitted. Because the Artist controls their own client records, please contact the Artist you booked with, or reach us at the address below and we will help coordinate your request. Depending on where you live, you may have additional rights under laws such as the GDPR or CCPA.

9. Children and minors

Lumith is intended for use by adults. Some services (for example, tattoos or piercings) may be offered to minors only where the law allows and with verified parental or guardian consent. Artists are responsible for obtaining any consent required by law before providing services to a minor.

10. Changes to this policy

We may update this policy from time to time. When we do, we will change the "Last updated" date above, and significant changes will be made available here.

11. Contact us

Questions about this policy or your information? Contact us at heather@lumith.net.