Legal

Privacy Policy

Last updated: July 23, 2026

This policy explains what information Lumahflow and CaféFlo collect from roasters and cafés, how we use it, and who we share it with.

1. 1. Who we are
2. 2. Information we collect
3. 3. How we use information
4. 4. How we share information
5. 5. Payment data
6. 6. Cookies and analytics
7. 7. Data retention
8. 8. Security
9. 9. Your rights
10. 10. Data between roasters and cafés
11. 11. Children’s privacy
12. 12. International users
13. 13. Changes to this policy
14. 14. Contact

01 Who we are

Lumahflow (“we,” “us”) provides the Lumahflow and CaféFlo platform for coffee roasters and cafés. This policy applies to personal information we handle when you use the Service. For how the Service works and the terms of use, see our Terms of Service.

02 Information we collect

• Account information — name, business name, email, password (stored only as a secure hash), and role (roaster or café).
• Business data you enter — inventory, roast records, pricing, catalog, client list, orders, and invoices.
• Contact and profile details — phone, address, and business details you choose to add.
• Payment information — handled by our payment processor, Stripe. We receive limited billing metadata (for example, subscription status and the last four digits of a card); we do not store full card numbers.
• Usage and device data — basic analytics such as pages viewed and actions taken, and technical data such as IP address and browser type.

03 How we use information

• to provide, operate, and secure the Service;
• to process subscriptions and payments through Stripe;
• to send transactional messages — invoices, order notifications, account and security emails;
• to provide support and respond to your requests;
• to understand usage and improve the product;
• to comply with law and enforce our terms.

We do not sell your personal information.

04 How we share information

We share information only as needed to run the Service:

• Service providers (sub-processors) — including Stripe (payments), our email delivery provider (transactional email), HeyCatch (website analytics on our public pages), and our hosting and database providers, who process data on our behalf under contract.
• Between connected roasters and cafés — when a café is linked to a roaster, relevant data such as orders, catalog, and invoices is shared between them so they can do business. See section 10.
• Legal and safety — when required by law, to protect our rights, or to prevent fraud or abuse.
• Business transfers — if Lumahflow is involved in a merger, acquisition, or asset sale, data may transfer as part of that transaction.

05 Payment data

Payments and subscriptions are processed by Stripe. When you enter payment details, they go directly to Stripe and are handled under Stripe’s own privacy policy and PCI-compliant systems. We do not receive or store full card numbers.

06 Cookies and analytics

We use cookies that are necessary to run the Service — for example, to keep you signed in. We also use privacy-conscious product analytics to understand how the Service is used and to improve it. You can control cookies through your browser settings; disabling necessary cookies may prevent parts of the Service from working.

07 Data retention

We keep your information for as long as your account is active and as needed to provide the Service. After account closure we retain data only as long as necessary for legitimate business and legal purposes (for example, financial records), after which it is deleted or anonymized.

08 Security

We use reasonable technical and organizational measures to protect your information — including encrypted connections (HTTPS), hashed passwords, and access controls. No system is perfectly secure, so we cannot guarantee absolute security, but we work to protect your data and to respond promptly to any incident.

09 Your rights

Depending on where you live, you may have the right to access, correct, export, or delete your personal information, and to object to or restrict certain processing. To make a request, email support@lumahflow.com. We will respond as required by applicable law, including the GDPR and the CCPA where they apply.

10 Data between roasters and cafés

Lumahflow connects roasters with their café clients. When you are linked to a counterparty, the data needed to do business together — such as orders you place, invoices you issue, and catalog items you publish — is visible to that connected party. A roaster can see the orders and account details of cafés connected to them; a café can see the catalog and invoices its roaster shares. We maintain access controls so that businesses can only see data belonging to accounts they are actually connected to.

11 Children’s privacy

The Service is for businesses and is not directed to anyone under 18. We do not knowingly collect personal information from children. If you believe a child has provided us information, contact us and we will delete it.

12 International users

Lumahflow is operated from the United States, and your information may be processed there. If you use the Service from outside the United States, you understand your information may be transferred to and processed in a country with different data-protection laws than your own.

13 Changes to this policy

We may update this policy from time to time. When we make material changes, we will update the “Last updated” date above and, where appropriate, notify you. Your continued use of the Service after changes take effect means you accept the revised policy.

14 Contact

Questions or privacy requests? Email support@lumahflow.com.