Privacy Policy

Last updated: 2 October 2026

This policy explains what personal information Lumina Flora collects when you visit lumina-flora.com, place an order, or use Ritual OS at app.lumina-flora.com, why we collect it, and what you can ask of us. We keep it to what the shop needs.

Who we are

Lumina Flora is operated by Yung-Chih Chen, trading as Lumina Flora, based in Taiwan. For anything in this policy, write to [email protected].

What we collect

Orders. Your name, email address, phone number if you give one, billing and shipping address, the items you bought, order notes, and the order total. With an order we also record how you arrived at the shop (for example, the referring website or campaign link) and the IP address and browser used to place it.

Payments. Payments are handled by PayPal, including card payments processed through PayPal. Your card number goes to PayPal, not to us. We do not see or store card numbers. We receive a payment confirmation and a transaction reference.

Accounts. If you create an account at checkout, we keep your name, email address, password (stored encrypted), saved addresses, and order history. Ritual OS keys you have bought are shown in My Account.

Ritual OS. If you use the Ritual OS app, we keep your account email, the activation key you entered and its membership period, and what you choose to write in the app: onboarding answers, intentions, journal entries, and reflections. These are stored so the app can show them back to you.

Mailing list. If you join the list on our homepage, we keep the name and email address you enter.

Messages. If you write to us by email or through a form on the site, we keep your message and the details you include, such as your order number.

Cookies and similar storage. See the Cookies section below.

Server and security logs. Our servers and security services record technical details of each visit: IP address, browser type, the page requested, and the time. These help us keep the site running and protect it from abuse.

Cookies

Essential cookies make the shop work, and they are always on. They remember your language and currency choice and that you have passed the entry page (lf_locale_gate, lf_lang, lf_currency, pll_language, wcml_client_currency), keep your cart and checkout session (WooCommerce cookies), keep you signed in if you have an account, and record your cookie choice.

Analytics cookies are used only if you allow them in the cookie banner. With your consent, we use Jetpack Stats (by Automattic) to count visits and see which pages are read. You can change your choice at any time through the cookie banner.

WooCommerce also stores a small record of how you arrived at the site (sbjs cookies) so that it can be noted on any order you place.

We do not use advertising pixels from Meta, Google Ads, TikTok, Reddit, Snapchat, or similar services.

Why we use it

To fulfil your order and provide your account and Ritual OS membership. We need this information to take payment, ship your parcel, deliver your key, and answer questions about your order. The legal basis is performance of a contract with you.

To meet legal obligations. We keep order and payment records for tax and accounting.

For our legitimate interests. We use some information to keep the site secure, prevent fraud, understand which pages and products work, and reply to messages. We weigh these interests against your rights and keep the data involved to a minimum.

With your consent. We rely on your consent for analytics cookies and for the mailing list. You can withdraw consent at any time; this does not affect anything done before.

Who we share it with

We do not sell personal information. We share it only with services that help us run the shop, and only as much as each one needs:

• PayPal, to process payments.
• Shipping carriers, who receive your name, address, and phone number to deliver your parcel.
• FraudLabs Pro, which screens orders for fraud using order details, email address, and IP address.
• Cloudflare, which delivers and protects the website and forwards email sent to our address.
• Google Cloud, which hosts the website and its database in the United States. Fonts on the site are loaded from Google Fonts, which receives your IP address when a page loads.
• Automattic (Jetpack), for site security and login protection, and for visit statistics if you consent.
• Supabase, which hosts the Ritual OS app and its data.
• OpenAI, which may process the text you write in Ritual OS (such as onboarding answers and journal entries) to produce the reflections and suggestions shown back to you. It is not used to place or process orders.

We may also disclose information when the law requires it, or to protect our rights in a dispute.

International transfers

We are based in Taiwan, and our service providers process data in the United States and other countries. When information about customers in the European Union, the United Kingdom, or elsewhere is transferred abroad, we rely on our providers’ standard contractual clauses or equivalent safeguards.

How long we keep it

• Order, invoice, and payment records: as long as tax and accounting law requires, generally about 7 years.
• Shop accounts: until you ask us to delete the account. Orders inside it are kept for the period above.
• Ritual OS accounts and what you wrote in the app: until you delete your account in the app or ask us to.
• Mailing list: until you unsubscribe or ask to be removed.
• Messages to us: as long as needed to answer and follow up, then deleted within two years.
• Server logs: about 14 days on our server. Security services may keep their own logs for a limited period.
• Your cookie choice: up to one year, then we ask again.

Your rights

You may ask us to show you the personal information we hold about you, correct it, delete it, or send it to you in a portable format. You may also object to, or ask us to limit, how we use it. Write to [email protected]. We will reply within one month. We may need to confirm your identity first, and we may have to keep some records, such as orders, where the law requires.

If you are unhappy with how we handle your information, you may complain to the data protection authority where you live. In the European Union, that is your national supervisory authority.

Children

Our shop and Ritual OS are intended for adults. We do not knowingly collect information from anyone under 18. If you believe a child has given us information, write to us and we will delete it.

Security

The site uses encrypted connections. Access to order data is limited to the people who run the shop. No method of storage or transmission is perfectly secure, but we take reasonable care to protect what you share with us.

Changes

If we change how we use personal information, we will update this page and the date at the top. For significant changes, we will also let account holders know.

Contact

Questions or requests about your information can be sent to [email protected]. You can also reach us through our Contact page.