Privacy Policy

Last updated: 14 October 2026

1. Who we are

Luma Market is an online marketplace for handmade goods, operated by Luma Market Ltd ("Luma Market", "we", "us", "our"), a company registered in England and Wales. We are the data controller responsible for your personal data when you use our website at lumamarket.co.uk, and we are registered with the Information Commissioner’s Office under reference ZC259263.

If you have any questions about this policy or how we handle your data, contact us at [email protected].

2. The data we collect

We only collect data we need to run the marketplace. Depending on how you use Luma Market, this may include:

Everyone

• Account details: your name, email address and an encrypted (hashed) password, or your Google account profile if you sign in with Google.
• Consent records: confirmation that you are 18 or over and have accepted our Terms, together with the date you did so.
• Technical data: your IP address and basic device/browser information, used to keep your account secure, prevent fraud and abuse, and diagnose errors.
• Communications: messages you send to other users through our messaging system, any support requests you send us, and any report you make about content on Luma. Text you submit to the marketplace (messages, reviews, listings and similar) is checked automatically against our content rules before it is posted or sent.
• Usage data: a record of the key actions you take on the marketplace, and, if you accept analytics cookies, how you move around the site, including a replay of your visit (see sections 3 and 7).
• Bug reports: if you send one, what you type, the page you were on, your browser, recent errors from that page, and a screenshot of the page unless you untick it. Before the screenshot leaves your browser, we blank out anything typed into a form and the parts of the page we mark as personal, such as addresses, names and messages. The one exception is a listing or shop you are writing, which is kept readable because it will be public. If you are signed in, the report is linked to your account.
• Feedback: if you answer one of our short questions about how a task went, your score and any comment, linked to your account.

Shoppers

• Delivery addresses you save to your account.
• Order history: the items you buy, order status, and related delivery information.
• Reviews: review text and any photos you choose to upload. Reviews are public and appear with your name.
• Favourites and preferences: listings you save and your email notification settings.

Makers

• Shop information: your shop name, description, listings, and the photos and details you publish.
• Your application to sell: what you tell us about your work and your shop when you apply, and any reply you write to a question we ask about it. With it we keep our decision, the reasons for it, any message we send you, and our team’s internal notes. You can ask to see all of it (see section 6).
• Identity and payout information: collected and verified by Stripe so you can be paid and anti-money-laundering obligations are met (see section 4). We do not store your full bank or identity documents ourselves.
• Tax reporting details: only if your sales in a calendar year pass HMRC’s reporting threshold (see what we report to HMRC), we ask you for your date of birth, your National Insurance number (a company or LLP gives its registration number, an ordinary partnership its Unique Taxpayer Reference) and the address you live at, or a company’s registered office. The report also carries your VAT number, where you have given us one, and the sort code and last four digits of your payout account, both of which we already hold. We ask only then, and only for the report described in section 4. Most Makers are never asked.

Payment data. We do not store your card details. Payments are processed directly by Stripe (see section 4).

Image metadata. When you upload an image, we strip its embedded metadata (such as camera details and location) from the copies we store and display, so it is never shown to anyone. For listing, shop and workspace photos, we first keep an internal record of that metadata, with any location removed, to help check that items on Luma are genuinely handmade (see section 3). The record is never published and is deleted when the photo is deleted.

3. How we use your data, and our lawful basis

Under UK data protection law we must have a lawful basis for processing your data. We rely on the following:

You can withdraw consent for marketing at any time from your notification settings, or with the unsubscribe link at the foot of any email you can turn off. This does not affect essential service emails.

Reviewing shop applications

A person at Luma makes every decision on an application to sell: approving it, asking you for more information, or refusing it on its merits. The one thing that happens automatically is closing an application after we asked you a question and you did not reply by the date we gave you. That closure says nothing about you or your work, and you can apply again straight away.

Service analytics

Separately from the optional analytics cookies in section 7, we record a small, fixed set of transaction events on our own servers: an account being created, an order being paid, a shop’s first sale arriving, a shop being created, a listing being drafted or published, a maker’s payment setup moving forward, a review being left, and an issue being raised. We also record a shop being approved to go live, at the moment we email the maker to tell them. Each one carries an account ID and a few details of what happened, never a name, email address or postal address. All but two record something you did yourself: the exceptions are the first-sale event, recorded against the maker whose shop received the order, and the approval, which is our decision rather than the maker’s action.

There are no searches and no clicks in this set, and the events are the only thing we send. The one piece of browsing we do record on our own servers is the daily view count described next.

We rely on legitimate interests for it. We use it to see where the marketplace is failing people, such as how many makers get stuck part-way through setting up payouts, and we have weighed that against your privacy: it covers only things you deliberately did, it holds no special-category data, and we have kept it to the smallest set of events that answers the question. Because it runs on our servers rather than on your device, it is not governed by the cookie banner, so we describe it here instead.

The events are sent to PostHog, our analytics provider, which processes them on our instructions on servers in the EU (see section 4).

Your right to object. You can object to this processing at any time, and we will stop. Use our contact form and tell us you object to service analytics. On receipt we mark your account so no further server-side event is recorded for you, and we confirm when it is done, within one month at the latest. You can also ask us to delete the events already recorded, under your erasure right in section 6.

Daily view counts

Every maker sees how many people opened their listings and their shop. To count people rather than page loads we have to recognise a repeat visit within the same day, and we do it without a cookie and without storing anything on your device.

When you open a listing or shop page we keep one short-lived row holding the page you opened, today’s date, and a viewer key. If you are signed in, the key is your account ID. If you are not, it is a one-way keyed fingerprint of your IP address and browser, which we cannot reverse: the day is part of it, so the same device produces a different key tomorrow, and a secret only we hold is part of it, so the key cannot be matched back to an address by guesswork. We do not store your IP address or browser details in these rows. We keep a second key of the same kind, made from the address alone, purely to cap how many different visitors one internet connection can claim to be in a day.

These rows are deleted after two days. Nothing is built from them but the counter itself and the ranking signal behind it, and they are never used to profile you, target you, or decide anything about you. We rely on legitimate interests: a maker seeing honest numbers about their own work is the point, and a view count anyone could inflate would also distort where listings appear in search. We have kept it to the smallest thing that answers the question, and the version of it that identifies you least.

4. Who we share your data with

We never sell your personal data. Here is who we share it with, and why.

The Maker you buy from. When you place an order, the Maker sees your name, your delivery address, any personalisation details you provide, and the messages you send them, so they can make and post your order. For those details the Maker is an independent controller under UK data protection law: they are responsible in their own right for handling them lawfully, and our Terms require that they use them only to fulfil your order, keep them secure, never add you to a marketing list, and tell us without undue delay if they lose them or someone else gets access, so that we can tell you.

Shoppers buying from a Maker. The law requires any business selling online to give its name and the address it trades from before a Shopper is bound, so a Maker’s trading name and business address are shown at checkout, on the order confirmation and on that Shopper’s own order page. They are not shown to anyone browsing, and are not published to search engines.

Beyond that, we share data only with the service providers we rely on to run Luma Market:

• Stripe: payment processing and maker identity verification, payouts and anti-fraud. Stripe acts as an independent controller for the identity and compliance data it collects. When you provide personal data in connection with your payment account, Stripe receives it and processes it in accordance with Stripe’s Privacy Policy.
• Neon: our database host, where your account and marketplace data is stored. Our data is hosted in the UK/EU.
• Vercel: hosts the website, so every request to it passes through Vercel’s servers, which keep short-lived request logs including your IP address.
• Cloudflare: every visit to the website passes through Cloudflare, which protects it from attacks and spam, including the check on our forms. It also stores and delivers images. For the check on our forms, Cloudflare also uses some technical details of your visit to improve its bot detection, as described in its Turnstile privacy notice.
• Resend: sending service (transactional) emails.
• MailerLite: sending marketing emails, for users who have opted in. Those emails tell us whether you opened them and which links you clicked, so we can see which ones are worth sending. Opting in is your consent to that, and unsubscribing ends it.
• PostHog: analytics. This covers the transaction events described in section 3, and, if you accept analytics cookies, how you use the site and a replay of your visit. PostHog acts on our instructions only, and our data is held on their EU servers.
• Sentry: error monitoring, which helps us find and fix problems. Our servers always report errors here; your browser reports them only if you accept analytics cookies, along with basic device and browser information. Our data is held on Sentry’s EU servers.
• Meta: only if you accept marketing cookies. Our advert-measurement pixel tells us which of our Facebook and Instagram adverts led to a visit or a sale. Meta receives the fact of your visit and uses it as described in its own privacy policy. Decline marketing cookies and nothing is sent.
• Google: only if you choose to sign in with Google.

Card issuers, when a payment is disputed. If a card issuer disputes a payment, it receives, through Stripe, the order and its receipt, the shopper’s name and email address, the delivery address and tracking, the name and address the card was billed under, the messages exchanged about the order, any issue raised on it and how it ended, and any review the shopper posted. When the Maker answers the dispute, it also receives the Maker’s own account of what happened and any photos they add. This is so that the dispute can be answered.

HMRC, for Makers who pass the reporting threshold. UK law requires online marketplaces to report each year on sellers whose sales pass a threshold. For those Makers we send HMRC, by 31 January, their name, the tax reporting details in section 2, their VAT number where they have given us one, and the sort code and last four digits of their payout account, which is all we hold of it. With those go their sales for the year by quarter: how many sales they made, what they were paid for them after our commission, and the commission itself. We send the Maker a copy of the same information. Makers under the threshold are not reported.

We may also disclose data where required by law, to enforce our Terms, or to protect the rights, safety and property of Luma Market, our users or others.

Some of these providers are based outside the UK. Where data is transferred outside the UK or EEA, we rely on appropriate safeguards such as the UK International Data Transfer Agreement (IDTA) or Standard Contractual Clauses.

5. How long we keep your data

We keep your data only as long as we need it:

• Account data: for as long as your account is open. If you ask us to delete your account, we begin a 30-day grace period during which you can change your mind; after that the account is deleted. If you haven’t signed in for two years, we’ll email you. If you still haven’t signed in 30 days later, we’ll delete the account the same way we would if you’d asked. If you sold on Luma, your account with our payment provider (Stripe) stays open a little longer, until everything owed to you has been paid out and the window for payment disputes on your orders has closed, typically a few months. Your personal details on Luma are still removed on the normal 30-day schedule.
• Order and transaction records: retained for as long as required by tax and accounting law (generally six years), even after an account is closed. The trading name and business address shown on each order are kept with that order record, even if the maker later deletes their account.
• Tax reporting details and the reports they fed: retained for as long as tax law requires (generally six years), on the same basis as order records, even after an account is closed.
• Shop applications: each application is kept in full for two years from the date of our decision. After that, or sooner if you delete your account, we keep only the decision itself: what we decided, the reason, the date, who at Luma decided it and their notes. Everything you sent us, your photos and your shop name are deleted. We delete the decision six years after we made it. An application we had not yet decided is deleted with your account. If we refused an application and the wait before you can apply again has not ended when you delete your account, we also keep your email address until the wait ends, so the wait still applies to a new account.
• Messages: kept for six years from the last message in the conversation, including after either of you deletes your account, because a conversation can be the evidence in a dispute about an order. Photos in messages are deleted sooner, once the time for disputing a payment on the order has passed, or after a year where there is no order.
• Reviews: kept with the shop they are about, including after it closes, because they are part of its record. If you delete your account, your reviews stay on the shop under an anonymised name.
• Listings we reviewed or acted on: kept, with our decision, for six years from our last decision on the listing, even if the listing is removed.
• Reports and our decisions on them: reports you make, and the decisions we take on content, shops and accounts (warnings and suspensions included), are kept for six years from our last decision. Photos sent as evidence with a report are deleted a year after it is resolved.
• Answers to a disputed payment: a Maker’s account of what happened is kept with the order record. Photos they add are deleted 120 days after the card issuer decides.
• Our case notes: when our team looks into something (a report, a complaint, a payment problem, a deletion request), the case and our notes on it are kept for six years after we close it, then deleted.
• Messages to our support team: kept in our support inbox for two years after our last reply, unless they are part of a report or case we are still dealing with. The email address and IP address a contact-form message arrives with are kept separately for 30 days, to limit how many can be sent, then deleted.
• Sign-in records: the IP address and outcome of each attempt to sign in, kept for 30 days so we can spot someone guessing at a password, then deleted.
• In-app notifications: kept for 180 days, then deleted.
• Emails we send you: a record of which email we sent, its subject and when, without its content, kept for six years.
• Account deletion requests: when we delete an account, we keep a record that we did. Your name and email are removed from it 12 months after the deletion; the dates and the outcome stay.
• Shop setup steps: if you set up a shop, a record of the steps you took through the setup, kept for 12 months.
• Feedback: your answers to our short questions stay linked to your account for 12 months. After that we keep the answers without knowing whose they were.
• Analytics events and session replays: kept by PostHog for up to 12 months, then deleted. The order records above are separate, and keep their own six-year clock.
• Daily view-count rows: kept for two days, then deleted by a nightly job. The view totals they produce carry nothing about who viewed anything.
• Error reports: kept by Sentry for 90 days, then deleted.
• Bug reports you send us: kept for 90 days, then deleted along with their screenshot.
• Names refused at signup: if we turn down a name at signup because it impersonates Luma, our staff or another organisation, we keep the name, the email address and the IP address it came with for 90 days, then delete them. If an account is opened from the same email address or connection in that time, we copy the refused attempt onto a record for our team to review, and keep it for as long as that record.
• Safety warnings: if we email you to stop using an item we believe may be unsafe, we keep a record of who we warned and when, for as long as the maker’s account exists, because it shows the warning was given.
• Fraud-prevention records: if an account is closed for fraud or serious abuse, we keep a minimal record (the email address, and an identifier for the payment account used, provided by Stripe) so the same details cannot simply open a new account. We keep these under legitimate interests for six years from our decision to close the account, then delete them.

When data is no longer needed, we delete or anonymise it.

6. Your rights

Under UK data protection law you have the right to:

• Access the personal data we hold about you;
• Correct data that is inaccurate or incomplete;
• Erase your data ("right to be forgotten"), subject to records we must keep by law;
• Restrict or object to certain processing;
• Portability: receive your data in a usable format;
• Withdraw consent at any time where we rely on it.

You can manage and update much of your data directly in your account, and you can request deletion of your account from your profile settings. For any other request, contact us at [email protected]. We will respond within one month.

7. Cookies

We use a small number of strictly necessary cookies to keep you signed in and to keep the service secure. These are essential for the website to work and do not require consent. Any optional analytics or marketing cookies are only set once you agree to them in our cookie banner, and you can change your mind at any time. See our Cookie Policy for the full list of cookies we use, what each one does, and how to update your preferences.

Accepting analytics cookies also switches on session replay, a recording of how you moved around the pages you visited. We switch replay off on your account pages, your messages, your order screens, a maker’s reviews page and our staff portal, because those show someone else’s information as well as your own.

Accepting analytics cookies also lets your browser send us an error report when a page breaks, so we can fix it.

Your cookie choice covers what happens on your device. It does not cover the service analytics in section 3, which run on our servers under legitimate interests and have their own objection route.

8. Children

Luma Market is intended for adults. You must be 18 or over to create an account or use the marketplace. We do not knowingly collect data from anyone under 18.

9. Changes to this policy

We may update this policy from time to time. When we do, we will change the "last updated" date above and, where the change is significant, let you know directly.

10. Complaints

If you have concerns about how we handle your data, please contact us first at

[email protected] so we can put things right. You also have the right to complain to the Information Commissioner’s Office (ICO), the UK’s data protection regulator, at ico.org.uk.