Privacy Policy

LUMWAY WELLNESS INC.

Effective date: September 10, 2026

1. Introduction and Scope

This Privacy Policy explains how Lumway Wellness Inc. ("Lumway," "we," "us," or "our") collects, uses, discloses, and protects personal information in connection with the corporate informational webpage located at lumwaylabs.com/pages/corporate (the "Site"). It also explains the choices available to you regarding your personal information.

This Policy should be read together with our Cookie Policy (https://lumwaylabs.com/pages/corporate-cookie-policy), which provides a detailed account of the cookies and similar technologies referenced in this document. This document applies only to the corporate informational page at https://lumwaylabs.com/pages/corporate and related business inquiries. It does not govern purchases, customer accounts, or other activities in the online store. The store's separate policies remain applicable to those activities. This Policy is published at https://lumwaylabs.com/pages/corporate-privacy-policy. Shared Shopify technologies operate on the corporate page, and cookies, identifiers, and browser-based privacy choices may be shared with store pages on the same domain.

2. Who We Are

The data controller responsible for personal information collected through the Site is:

• Lumway Wellness Inc.
• 1615 Valley Avenue East, Apt 22, Sumner, WA 98390, United States
• Email: support@lumwaylabs.com

3. Personal Information We Collect

3.1 Information You Provide Directly

The Site includes one form, our contact form, through which you may voluntarily provide the following information:

• Name (optional)
• Company (optional)
• Email address (required)
• Country (optional)
• Your message (optional, free text)

The Site does not request phone numbers, payment information, date of birth, or any special category of personal information, and does not offer file uploads, account registration, sign-in, order placement, or payment.

Important note about the message field: the free-text message field is not validated or restricted in content. Because it is intended for business (B2B) inquiries, please do not include health information, financial account information, or personal information about third parties in your message.

3.2 Information Collected Automatically

When you visit the Site, subject to applicable privacy choices and legal requirements, certain information is collected automatically by the Site's underlying platform and by third-party analytics, marketing, and testing tools described in our Cookie Policy, including:

• IP address and approximate location derived from it;
• browser type and version, operating system, and device type;
• screen resolution, language settings, and time zone;
• page URLs, page titles, referrer information, and UTM campaign parameters;
• pages viewed, clicks, and scroll depth;
• session and device identifiers stored in cookies, local storage, and session storage; and
• session recordings and interaction data collected by session-replay and heatmap tools (see Section 6 and our Cookie Policy).

4. How We Use Personal Information

We use personal information for the following purposes:

• to respond to inquiries submitted through the contact form or by email;
• to operate, maintain, and secure the Site;
• to detect and prevent spam, fraud, and abuse;
• to understand how visitors use the Site and to improve its content and performance (analytics);
• to measure and, where applicable, optimize advertising (marketing analytics); and
• to comply with applicable legal obligations.

5. Legal Bases for Processing (EEA/UK Visitors)

Where the EU or UK General Data Protection Regulation applies to our processing, relevant legal bases include steps requested by you before entering into an agreement where you personally are the prospective contracting party; our legitimate interests in responding to inquiries from business representatives and operating and securing the Site, balanced against your rights and interests; compliance with legal obligations; and consent for processing that requires it. The Site currently provides the U.S. opt-out controls described below, not a cookie consent banner or separate category selector. An opt-out mechanism does not itself constitute prior consent where that is legally required. For visitors outside the EEA/UK, applicable U.S. federal and state laws and other applicable local laws govern the relevant processing; privacy rights are described in Section 11.

6. Cookies and Similar Technologies

The Site uses cookies, pixels, local storage, session storage, and related technologies operated by Lumway and third-party analytics, advertising, and testing providers. Their purposes, providers, categories, and storage durations are described in our Cookie Policy. The four categories are Strictly Necessary, Functional, Analytics, and Marketing/Advertising; they describe the technologies and are not separate selectable controls. The Site currently uses a U.S. opt-out mechanism without a cookie banner. Select "Do Not Sell or Share My Personal Information" in the footer to submit an opt-out immediately, or visit Your Privacy Choices at https://lumwaylabs.com/pages/data-sharing-opt-out. The current implementation also restricts the analytics and session-replay tracking listed in our Cookie Policy. Section 11(e) contains our Notice of Right to Opt-out, and Section 12 explains GPC.

7. How We Share Personal Information

We do not sell contact-form submissions to third parties, and we do not use any customer relationship management (CRM), lead-scoring, or data-enrichment system for those submissions. Messages submitted through the contact form are processed through Shopify and delivered to our support@lumwaylabs.com mailbox (hosted on Google Workspace), reviewed by our support team. The mailbox is our working record of those inquiries; platform processing, technical logs, and provider-managed backups may also contain associated information. Submission does not automatically subscribe you to marketing emails, and we do not use contact-form submissions for advertising audience uploads.

Automatically collected technical and analytics information is processed through the following providers and integrations. Their legal roles depend on the relevant service, processing purpose, and arrangements: a provider may process information on our behalf or, for certain activities, for its own purposes under its privacy notice.

• Platform and hosting: Shopify Inc. (site hosting, infrastructure, contact-form processing, spam filtering, and security). Bot protection: hCaptcha, provided by Intuition Machines, Inc., United States, integrated through Shopify in invisible mode. It loads when you first interact with a contact-form field and processes technical browser, device, network, and interaction information for bot protection. It does not set cookies on lumwaylabs.com; its own identifiers are stored in the hcaptcha.com context within an embedded iframe. Google reCAPTCHA is not used. See https://www.hcaptcha.com/privacy for the provider's privacy information.
• Web analytics: Google LLC (Google Analytics 4); Microsoft Corporation (Microsoft Clarity – session recording and heatmaps); Amplitude Inc. (product analytics and session replay).
• Advertising and marketing measurement: Google LLC (Google Ads, Google Merchant Center); Meta Platforms, Inc. and TikTok Inc. (via the Parkour pixel applications); Axon/AppLovin; Klaviyo Inc.
• A/B testing: Shoplift.
• Approximate geolocation: IPinfo and Klaviyo Inc. (IP-based geolocation).
• Fonts and content delivery: Google LLC (Google Fonts); Shopify CDN; Amazon CloudFront (used by Klaviyo).
• Email infrastructure: Google LLC (Google Workspace, hosting the support@lumwaylabs.com mailbox). Further information about provider processing is available in the Shopify Consumer Privacy Policy (https://www.shopify.com/legal/privacy/consumers) and the Microsoft Privacy Statement (https://www.microsoft.com/privacy/privacystatement).

Certain of these disclosures – including to Google Ads, Google Merchant Center, Meta, TikTok, Axon, and Klaviyo – may be considered a "sale" or "sharing" of personal information for cross-context behavioral advertising under the California Consumer Privacy Act, as amended ("CCPA"), and may be subject to sale or targeted-advertising opt-outs under other applicable state laws. You can opt out of this activity as described in Section 11 below. The classification depends on actual uses and applicable arrangements, rather than the provider name alone. Third parties may collect information about online activity over time and across different websites. If your browser is already associated with a profile, for example in Klaviyo, Site activity may be linked to that profile even though the contact form does not send its field values to Klaviyo.

We may also disclose personal information where required to comply with applicable law, regulation, legal process, or governmental request, or to protect the rights, property, or safety of Lumway, our users, or others.

8. International Data Transfers

Our service providers process data primarily in the United States and may also process it in Canada and other countries where they operate. If you access the Site from the European Economic Area, the United Kingdom, or another jurisdiction outside the United States, your information may be transferred to and processed in the United States and those other countries. Where required, such transfers are made using an applicable adequacy decision or appropriate safeguards, such as the EU-U.S. Data Privacy Framework for eligible certified recipients, its UK Extension where applicable, or standard contractual clauses with an applicable UK addendum or UK transfer agreement. You may contact us for information about the mechanism applicable to your data and how to obtain a copy of relevant safeguards, subject to appropriate redactions.

9. Data Retention

Retention is determined by the purposes described in this Policy, any continuing business relationship, applicable legal obligations, and the need to establish, exercise, or defend legal claims. The periods and criteria for the main categories are:

Category	Retention period
Contact form submissions / email correspondence	No fixed automatic deletion period is currently applied. Retention depends on the inquiry, continuing correspondence or business relationship, applicable legal obligations, and the need to resolve disputes. Deletion requests may be submitted under Section 11.
Google Analytics 4 event data	According to the retention settings of each GA4 property (standard event-level options include 2 or 14 months). Aggregated reports are not necessarily subject to the same retention setting.
Microsoft Clarity	Standard session playback: 30 days. Labeled or favorited sessions, click data, and heatmaps: 9 months under Microsoft Clarity's published retention schedule.
Amplitude (analytics / session replay)	According to the Amplitude project settings and service plan. Standard replay retention may be 30 days, with longer periods available under other arrangements; analytics events and replays may have different retention periods.
Klaviyo marketing profiles	Until deletion; no fixed inactivity-based deletion interval is currently applied. Contact-form submissions do not create marketing subscriptions, but onsite activity may be linked to an existing profile.
Cookie lifespans	Vary by cookie; see the detailed table in our Cookie Policy (up to 2 years for the longest-lived analytics/marketing cookies) Persistent local storage may have no automatic expiry. Cookie expiry does not determine retention of data already received by a provider.
Browser privacy choices	Stored through the Site and Shopify privacy mechanism for the relevant browser. Browser settings, storage expiry, or deletion can affect persistence; an enabled GPC signal is processed when received. A stored choice is not a complete historical consent log.
Server logs (platform-level)	Controlled by Shopify; not accessible to or configurable by Lumway

Backups of the underlying infrastructure are created and retained by our providers (Shopify and Google) in accordance with their own backup and retention policies; we do not maintain separate backups of contact-form submissions. Deletion from active systems does not necessarily mean immediate removal from provider-managed backups, which follow the applicable backup lifecycle.

10. Data Security

We apply technical and organizational measures designed to protect personal information, including:

• HTTPS/TLS encryption across the Site, including the contact-form endpoint;
• encryption of data at rest at the infrastructure level provided by our hosting platform;
• PCI DSS Level 1 certification maintained by our e-commerce platform provider (applicable to the platform as a whole; the Site itself does not process payment data);
• authenticated email sending (SPF/DKIM) for our domain;
• role-based access to internal systems, with access revoked upon termination of employment; and
• version-controlled, peer-reviewed changes to the Site's codebase.

No method of transmission or storage is completely secure, and we cannot guarantee absolute security of information transmitted to the Site.

11. Your Privacy Rights

11(a). California Residents (CCPA/CPRA)

If you are a California resident and the CCPA/CPRA applies to our processing, you have the following rights, subject to applicable conditions and exceptions:

• know what personal information we have collected, used, disclosed, and (where applicable) sold or shared about you;
• request deletion of your personal information, subject to certain exceptions;
• request correction of inaccurate personal information;
• opt out of the "sale" or "sharing" of your personal information for cross-context behavioral advertising, using the "Do Not Sell or Share My Personal Information" link in the Site footer; and
• not be discriminated against for exercising any of these rights.

We do not knowingly sell or share the personal information of minors under 16 years of age. Because certain analytics and advertising identifiers are stored against a device or cookie identifier rather than your name or email address, an email address alone may not identify all relevant records. We use available identifiers and appropriate provider tools to locate and respond to requests, and may ask for additional information reasonably necessary for that purpose. We will explain any applicable limitation or lawful reason for denying a request.

11(b). Other U.S. State Privacy Laws

Residents of certain other U.S. states with comprehensive privacy laws currently in effect – including Virginia, Colorado, Connecticut, Utah, Texas, Oregon, and others – may have similar rights where the relevant law applies to our processing to access, delete, correct, and opt out of the sale of personal information or targeted advertising, and, where applicable, to appeal a denied request. You may exercise these rights using the contact details in Section 16 below. To appeal a denied request where that right applies, email support@lumwaylabs.com with the subject Privacy Appeal. We will explain our decision and any further complaint options required by law.

11(c). EEA/UK Visitors (GDPR)

Where the EU or UK GDPR applies, you have the following rights, subject to applicable conditions and exceptions:

• access the personal information we hold about you;
• request rectification of inaccurate personal information;
• request erasure of your personal information;
• request restriction of, or object to, our processing of your personal information;
• request portability of personal information you provided to us; and
• lodge a complaint with your local data protection supervisory authority. Where processing is based on consent, you may also withdraw it by contacting support@lumwaylabs.com, without affecting the lawfulness of processing before withdrawal. The browser-based tracking opt-out is described in Section 11(e).

11(d). How to Exercise Your Rights

You may submit a request by emailing support@lumwaylabs.com. We may need to verify your identity before fulfilling certain requests. You may also designate an authorized agent to submit a request on your behalf, subject to our ability to verify the agent's authority to act for you. We do not require identity verification for browser-based sale/sharing opt-outs. We respond within applicable statutory time limits and explain any permitted extension or denial.

11(e). Notice of Right to Opt-out of Sale/Sharing

You have the right, where applicable, to direct Lumway to stop selling or sharing your personal information. Section 7 describes the relevant disclosures. Select "Do Not Sell or Share My Personal Information" in the footer: one click submits the opt-out and the footer displays "Opt-Out Request Honored". You can also use Your Privacy Choices at https://lumwaylabs.com/pages/data-sharing-opt-out or enable GPC as described in Section 12. You do not need an account or identity verification to use the browser-based opt-out. For assistance or an authorized-agent request, email support@lumwaylabs.com; agent requirements are described in Section 11(d).

The Site's implementation restricts more than advertising alone: following opt-out, it blocks the listed tracking by Amplitude (including Session Replay), Google Analytics 4, Google Ads, Google Merchant Center, Microsoft Clarity, Shoplift, Axon, Meta and TikTok through Parkour, IPinfo geolocation, and Klaviyo onsite tracking. Klaviyo may still load a small non-tracking loader without setting a cookie. Shopify platform requests and security services required for the contact form may continue. Opt-out does not mean that every third-party request is eliminated or that all previously collected information is deleted.

Your browser-based choice applies to the corporate page and store pages using the shared control on lumwaylabs.com; this Policy still covers only corporate activities. The Undo control lets you request a change to a previous site-level choice. Any consent and separate confirmation required by applicable law must be obtained before sale/sharing resumes. Clearing browser storage or disabling GPC does not itself provide that consent. Choices may need to be repeated on another browser or device.

12. Global Privacy Control and Similar Signals

We honor Global Privacy Control (GPC) as a request to opt out of sale/sharing and targeted advertising where applicable. To send the signal, enable GPC in a supporting browser's privacy settings or through a compatible browser extension before visiting the Site. Information about supporting tools is available at https://globalprivacycontrol.org/. No separate click on our opt-out link is needed when the signal is received. The footer displays "Opt-Out Preference Signal Honored". On this Site, the signal activates the same broad tracking restrictions as a manual opt-out, including the analytics and session-replay tools described in our Cookie Policy. It applies to the browser or device sending it and, where required and identifiable, an associated profile. An active signal is not overridden merely by a conflicting site setting; any legally required consent to change that choice must be obtained. The absence of a signal does not by itself constitute a new opt-in after a known prior opt-out. We do not separately respond to legacy Do Not Track (DNT) signals.

13. Children's Privacy

The Site is directed to business professionals and is not intended for, and we do not knowingly collect personal information from, children under the age of 16. If we become aware that we have inadvertently collected personal information from a child, we will take steps to delete it.

14. Third-Party Links

This Policy does not apply to any third-party websites, products, or services, even if accessed through a link on the Site. We encourage you to review the privacy practices of any third-party service before providing it with your information. This does not exclude our collection and disclosure of personal information through third-party technologies integrated into the Site, which are described in this Policy.

15. Changes to This Policy

We may update this Privacy Policy from time to time to reflect changes to our practices, the Site, or applicable law. The "Effective date" at the top of this page indicates when it was last revised. If we make material changes, we will provide additional notice as appropriate, such as a notice on the Site.

16. Contact Us

If you have questions about this Privacy Policy or wish to exercise your privacy rights, please contact us at:

• Lumway Wellness Inc.
• 1615 Valley Avenue East, Apt 22, Sumner, WA 98390, United States
• Email: support@lumwaylabs.com