We collect what we need to talk to you, run your account, bill you, build your project, and understand how the site is used. We never sell your data.
Last updated October 2026
Luminal Agency (“we”, “us”) builds websites and automation systems. Based in British Columbia, Canada. For anything in this policy, reach us at [email protected].
Only what you give us, or what we need to provide the service:
Our hosting provider keeps short-lived server logs that may include your IP address and browser user-agent. That is standard infrastructure logging used to keep the site running and to investigate abuse; we do not analyse it or link it to you.
When you sign in, we set session cookies that keep you logged in. They are used strictly for authentication and access to your dashboard, are only set once you sign in, and are cleared when you sign out.
We use standard web analytics tools to measure traffic, how visitors use the site, and how well it performs, so we can improve it. These tools may set their own cookies or similar identifiers and collect details such as pages viewed, referring site, device and browser type, and approximate location.
We do not use cookies or tokens for cross-site advertising, and we do not sell analytics data or use it to build advertising profiles.
Stripe’s checkout and the Cal.com scheduler on our booking page run on those providers’ own domains and may set their own cookies under their privacy policies.
We use your information to reply to you, run your account, take payment, and scope and deliver the work you asked for. Submitting the contact form, creating an account, or completing onboarding is your consent for that, and we record when you agree to our Terms of Service. We will not add you to a mailing list or send you marketing you did not ask for.
We use a small number of service providers that process data on our behalf, only to provide their service to us:
Each provider handles the data it processes for us securely, under its own privacy policy and data processing terms, and only receives what it needs to do its job.
We do not sell, rent, or trade your personal information, and we do not share it with anyone else unless we are legally required to.
These providers may store data outside Canada, which means it can be subject to the laws of the country it is stored in.
Enquiries stay in our inbox and database while the conversation is live and for up to two years afterwards, so we have context if you come back. Account and onboarding details are kept while your account is open and removed when you delete it. Billing records and project correspondence are kept for as long as we need them for tax and record-keeping obligations. Ask us to delete your data sooner and we will, except where the law requires us to keep it.
You can ask us at any time to:
Email [email protected] and we will respond within 30 days. If you are unsatisfied with our response, you can escalate to the Office of the Information and Privacy Commissioner for British Columbia, or to the Office of the Privacy Commissioner of Canada.
The site is served over HTTPS. Passwords are stored only as hashes, your account data is protected by access controls, and access to our inbox is protected by two-factor authentication. No system is perfectly secure, so please do not send passwords, payment card numbers, or other sensitive credentials through the contact form.
Our services are sold to businesses. We do not knowingly collect personal information from anyone under 16.
If we change what we collect or who processes it, we will update this page and move the date at the top. Material changes to how we handle data we already hold will be communicated directly to the people affected.