Privacy Policy
Last updated September 6, 2026
This Privacy Policy explains how 1602637 BC Ltd., operating as Luminous Social("we," "us," or "our"), collects, uses, discloses, and protects personal information in connection with luminoussocial.com and the fiduciary workspace software available through it (the "Service"). We are a British Columbia, Canada company, and we handle personal information in accordance with the Personal Information Protection and Electronic Documents Act(PIPEDA) and, where it applies, British Columbia's Personal Information Protection Act (PIPA).
This policy applies to visitors, trial users, and paying customers of the Service. It does not apply to third-party sites you may reach through links on our site.
1. Information We Collect
Information you give us directly
- Account information: name, email address, firm name, and phone number.
- Matter records you enter: the estate or guardianship data you choose to store — deadlines, documents and document metadata, asset and account information, beneficiary and interested party contact details, creditor claims, ledger entries, hearings, time entries, invoices, expenses, notes, care-log entries, and client-roster information.
- Billing information: processed directly by our payment processor, Stripe. We do not collect or store full payment card numbers ourselves.
- Support communications you send us by email.
Information collected automatically
- Technical and log data needed to operate and secure the Service: IP address, browser and device information, timestamps, and error/diagnostic reports.
- Strictly necessary cookies used to keep you signed in and to operate the Service. See our Cookie Policy for detail — we do not currently use advertising or analytics cookies.
Some matter records you choose to enter (for example, financial account information connected to an estate) can be sensitive. We ask that you enter only what the matter genuinely requires and avoid storing full government identification numbers or unrelated third-party sensitive data where a shorter reference would do.
2. How We Use Information
We use personal information to:
- Provide, maintain, and secure the Service, including generating the reports, exports, and read-only share links you request;
- Create and administer your account, and authenticate you when you log in;
- Process subscription payments and send billing-related communications through Stripe;
- Send the deadline-digest email if and while you enable it in Settings, and other service-related notices (for example, a password reset or a security notice);
- Respond to support requests;
- Detect, investigate, and prevent fraud, abuse, and security incidents; and
- Comply with legal, tax, and accounting obligations.
We do not sell personal information, and we do not use the content of your matter records to train public or third-party AI models.
3. Consent
By creating an account you consent to the collection, use, and disclosure of personal information as described in this policy, to the extent required by applicable law. Where the law requires express consent for a particular use (for example, sending you promotional email under Canada's Anti-Spam Legislation, CASL), we obtain it separately and you can withdraw it at any time — see Section 8. You can withdraw consent for non-essential processing at any time by contacting us, subject to legal or contractual restrictions and reasonable notice; withdrawing consent for information we need to operate your account (for example, your login email) may mean we can no longer provide the Service to you.
4. How We Share Information
We share personal information only as needed to run the Service, and never sell it. We share information with:
- Service providers (subprocessors) who host, run, or support the Service under contract, currently:
- Supabase, Inc. — database, authentication, and file storage;
- Vercel Inc. — application hosting and content delivery;
- Stripe, Inc. — payment processing;
- Resend — transactional and deadline-digest email delivery.
- People you choose to share with — a read-only share link you create is only accessible to someone who has the link, and you can revoke it at any time from the matter it belongs to.
- Legal and safety disclosures — we may disclose information where required by law, court order, or valid legal process, or where necessary to protect the rights, property, or safety of Luminous Social, our customers, or others.
- Business transfers — if we are involved in a merger, acquisition, or sale of assets, personal information may be transferred as part of that transaction, subject to this policy or a policy providing at least equivalent protection.
5. Cross-Border Data Transfer
We are based in Canada, but the infrastructure providers listed in Section 4 store and process data primarily in the United States (our database is hosted on Supabase infrastructure in the AWS us-east-1 region, in Virginia, USA). This means personal information about you may be accessible to those providers, and to courts, law enforcement, or regulators, under the laws of the United States, which may differ from Canadian law. We select providers with strong contractual and technical safeguards and do not transfer personal information internationally for any purpose beyond operating the Service.
6. Data Retention
We retain matter records for as long as your account is open, or until you delete the specific record. You can close a matter, delete rows you added, or request deletion of your entire account by emailing luminoussocialhelp@gmail.com. We retain billing records for as long as required by tax and accounting law (in Canada, generally six years), and may retain limited technical logs for a shorter period for security purposes even after account deletion.
7. Security
We use encryption in transit (TLS) and at rest for stored data, role-based access controls, and row-level database security so that one customer's matters are not accessible to another. Read-only share links are scoped to a single matter and can be revoked at any time. No system is perfectly secure, and we cannot guarantee absolute security; contact us immediately at luminoussocialhelp@gmail.com if you believe your account has been compromised.
8. Your Privacy Rights
Under PIPEDA/PIPA, you have the right to:
- Access the personal information we hold about you;
- Correct inaccurate or incomplete information — most account fields can be edited directly in Settings;
- Withdraw consent for a use of your information, subject to Section 3;
- Request deletion of your account and associated personal information, subject to our retention obligations described in Section 6;
- Opt out of the deadline-digest email at any time from Settings; and
- Complain to our Privacy Officer (Section 12) or, if unresolved, to the Office of the Privacy Commissioner of Canada or the applicable provincial privacy regulator.
To exercise any of these rights, contact us using the details in Section 12.
9. Cookies
We use only strictly necessary cookies to operate the Service (primarily to keep you signed in). See our Cookie Policy for full detail, including what we will do if that changes.
10. Children's Privacy
The Service is intended for use by adults acting in a professional capacity and is not directed to children. We do not knowingly collect personal information from anyone under 18. If you believe a child has provided us personal information, contact us and we will delete it.
11. Changes to This Policy
We may update this policy from time to time. If we make a material change, we will provide reasonable notice (such as an email or an in-app notice) before it takes effect. The "Last updated" date at the top of this page reflects the most recent version.
12. Contact / Privacy Officer
Our designated Privacy Officer can be reached at luminoussocialhelp@gmail.com for any question, request, or complaint about this policy or how we handle your personal information.
1602637 BC Ltd., operating as Luminous Social. British Columbia, Canada.