Privacy policy
Last updated: 18 August 2026.
Lumitela (lumitela.com) is a sales-analytics service for marketplace sellers, currently in early access. This page describes what data the service holds, where it comes from, who processes it, and how to get it exported or deleted.
The short version
Your data comes only from you, is used only to show you your own analytics, and goes to no one else. It's never sold, never shared, and never used for advertising. Export or deletion is one message away.
What we hold
Your account. Your email address, a securely hashed password (we can't read it), and session records, which include the IP address and browser identifier of each sign-in, kept for session security.
Your profile. What you enter in Settings: your name, whether you're a business, business name and ABN (if you provide them), a billing address (if you provide one, used to prefill checkout), country and timezone, and your shop identifiers on Spoonflower and Etsy.
Your seller records. The data you import, whether by file upload, email forwarding you set up, or the Lumitela browser extension reading your own logged-in seller pages:
- Marketplace statements: your sales ledger rows, which include buyer names as the marketplaces record them.
- Order and fulfillment emails: order details including buyer shipping addresses. Addresses are used inside your account to match Etsy orders to their Spoonflower fulfillments, and nothing more.
- Your design catalog: titles, descriptions, tags, and thumbnail images.
Contact-form messages. Sent to us as email; not stored in the service's database.
Survey answers and feedback. If you answer the in-app survey or use the Feedback button, we store your answers or message with your account and email them to Lumitela so we can act on them. A screenshot you choose to include is stored the same way and may show whatever was on your screen, including buyer details on an order page. These are deleted with your account.
Page analytics. We use Umami (cloud-hosted), a cookieless analytics tool, on lumitela.com pages to see which pages get used. It doesn't follow you across the web and we don't connect it to your account data.
Where it comes from
Only from you. Lumitela never crawls, buys, or discovers data about you or your shops on its own. Order emails are processed only from sender addresses you've approved; everything else arrives because you imported it or pressed a button in the extension. The extension reads only pages your own logged-in marketplace session can see, only when you click, and sends the results only to your own Lumitela account.
If the extension can't confirm you're logged in to Spoonflower, it also tells your Lumitela account why (for example "Spoonflower sent us to its homepage", the error code it got, the Spoonflower page address it landed on such as www.spoonflower.com/, the time, and which version of the extension you're running), so we can help you sort it out. It never sends your Spoonflower password or cookies.
What it's used for
Providing your analytics: dashboards, insights, order matching, statement history. That's the whole list. No sale of data, no sharing with third parties for their purposes, no advertising, no profiling of you or your buyers.
Your buyers' data
Your marketplace records naturally contain your customers' names and, in order emails, their shipping addresses. Lumitela processes these only as part of your records: they appear in your order views and power order matching within your account. We never contact your buyers, never analyze them across shops, and never use their details for anything except showing you your own sales.
How long we keep it
- Raw inbound emails (the processing "waiting room"): deleted after 30 days, unless pinned by an operator while investigating a problem for you.
- Processing audit log: 90 days.
- Your imported records (statements, orders, catalog): kept while your account exists, so your history stays complete. Deleted when your account is deleted.
- Backups: nightly, kept on our production infrastructure and mirrored to operator-controlled offsite storage, cycled on a short retention window. Deleted data leaves backups as that window turns over.
Who else touches it (sub-processors)
Each is used for a single purpose:
- Cloudflare: DNS, network proxy in front of the site, and routing of the inbound order emails you forward.
- Resend: sends our outbound email (verification links, notifications, contact-form delivery).
- Paddle: merchant of record for payments, receiving your name, email, country, billing address, business name, and tax identifier at checkout.
- Umami: the cookieless page analytics above.
- Our hosting provider: the server the service runs on.
Cookies
One functional session cookie keeps you signed in. That's it: no tracking cookies, and the analytics above works without cookies.
Export and deletion
Want your data exported, or your account and everything in it deleted? Contact us and we'll take care of it promptly. Deletion removes your account, profile, all imported records, and your stored thumbnails. There isn't a self-serve export/delete button in the app yet; it's planned. Until then, the promise is a human one and we honor it quickly.
Changes
If this policy changes materially, the change and its date will appear on this page. The "last updated" date at the top always reflects the current revision.