LUMIBRICKS Privacy Policy

1. Data Controller

HongKong SuSenGo Technology Limited is the controller of personal data processed through the App.
Registered address: ROOM 701 UNIT 108 7/F TOWER B NEW MANDARIN PLAZA 14 SCIENCE MUSEUM ROAD TSIM SHA TSUI KL
Contact: service@lumibricks.com

For EEA/UK matters, our Data Protection Officer / EU representative can be reached at service@lumibricks.com.

2. Information We Collect

2.1 Information from your Shopify sign-in

When you authorize sign-in via Shopify, we receive the following (as present in your Shopify account):

2.2 Device & usage data (collected automatically)

2.3 Bluetooth device data

When you control LUMIBRICKS lighting we process scan data (device address, signal strength), control commands (brightness, color, etc.), and device configuration. This is processed mainly on your device; some device configuration is synced via the Broadlink cloud to enable multi-device/home sync.

2.4 Location permission

Android requires location permission to perform Bluetooth scanning. We use this permission solely for BLE scanning and do not collect, record, or upload your geographic location.

2.5 Push notifications

With your permission, Firebase Cloud Messaging obtains a push token so we can send service notifications. You can disable notifications at any time in system settings.

2.6 In-app Store & purchases

The App includes a Shop tab that opens the official LUMIBRICKS online store (operated on the Shopify platform). When you browse the store, add items to the cart, sign in, or place an order, your shopping data — items viewed, cart and order details, order history, and the shipping/billing address and contact details you enter — is processed by Shopify and, for payment, by our payment providers.

Payment information (such as card numbers) is collected and processed directly by the payment providers (e.g., Shopify Payments and the card networks). We, as the app developer, do not receive or store your full payment card details.

If you join the store's rewards/loyalty program, your participation and points are processed by the store. Store activity is also governed by the store's and Shopify's own privacy terms.

3. How We Use Your Information & Legal Bases (GDPR)

4. Third-Party SDKs & Data Sharing

The App integrates the following SDKs, which may collect data independently under their own policies:

Google ML Kit (barcode scanning) runs entirely on your device and does not collect or transmit your data. Google Play In-App Update is used only to check for and deliver app updates.

We do not sell your personal information. We may disclose data to respond to lawful requests from authorities, to protect safety, to prevent fraud or abuse, or to enforce our Terms.

5. International Data Transfers

Your data may be processed in countries other than your own. Account data handled via Shopify is processed by Shopify Inc. (e.g., Canada/USA); analytics/crash/push data via Google is processed primarily in the USA. Where required, we rely on appropriate safeguards such as the EU Standard Contractual Clauses (SCCs) and the UK Addendum for transfers from the EEA/UK.

6. Data Storage & Retention

• On device: authentication tokens and account/device configuration are stored encrypted on your device (Android DataStore);
• Account data: processed by Shopify;
• Analytics/crash/push: processed by Google (Firebase);
• Device sync: processed by the Broadlink cloud.

7. Your Rights

To exercise your rights, email service@lumibricks.com ("Privacy Request"). We respond within 30 days. You can also manage Shopify-held data by signing in to Shopify.

7.1 California residents (CCPA / CPRA)

• Right to know the categories and purposes of personal information collected;
• Right to delete and right to correct your personal information;
• Right to opt out of sale/sharing — we do not sell or share your personal information for cross-context behavioral advertising;
• Right to limit use of sensitive personal information;
• Right to non-discrimination for exercising your rights.

7.2 EEA / UK residents (GDPR)

In addition to the rights above, you may lodge a complaint with your local supervisory authority. For GDPR matters contact service@lumibricks.com.

8. Data Security

• Encryption in transit: HTTPS/TLS for network communication;
• Encryption at rest: tokens and sensitive data stored encrypted on device;
• OAuth PKCE: OAuth 2.0 + PKCE; we do not store your password;
• Access control & audits: restricted internal access and periodic review.

No method of storage or transmission is fully secure. In the event of a personal-data breach we will notify the relevant authorities and affected users as required by law.

9. Children's Privacy

The App is not directed to children under 13 (or under 16 in the EEA, subject to member-state law). We do not knowingly collect children's personal data. If you believe we have, contact us and we will delete it.

10. Changes to This Policy

We may update this Policy. For material changes we will notify you in-app and update the "Last updated" date; where applicable we will give at least 30 days' notice to EEA/UK users. Continued use after the effective date constitutes acceptance.

11. Contact Us

© 2026 HongKong SuSenGo Technology Limited. All rights reserved.