Effective Date: March 11, 2026

Last Updated: March 11, 2026

1. Introduction & Scope

This Privacy Policy describes how Lux Lights, LLC (“Lux Lights,” “we,” “us,” or “our”) collects, uses, shares, and protects your personal information when you use:

• The Lux Lights mobile application (iOS and Android)
• The Lux Lights web admin portal

(collectively, the “Services”)

This Privacy Policy does not apply to the Lux Lights marketing website (www.luxlights.com), which is governed by a separate policy.

By using our Services, you acknowledge that you have read and agree to this Privacy Policy. If you do not agree, please do not use the Services.

2. Information We Collect

We collect information in two ways:

• Information you provide directly
• Information collected automatically

2.1 Information You Provide

All Users (Admins, Staff, Technicians, Customers)

• Account information: email, phone, name
• Authentication credentials: password (hashed), PIN (hashed)
• Profile info: avatar, role
• Account metadata: creation date

Admins & Staff (Web Portal)

• Customer details: name, contact info, addresses
• Sales/job info: rep details, job descriptions, install dates
• Financial records: deposits, payment status (no direct processing)
• Installation documentation: photos, checklists
• Authorized users

Technicians (Mobile App)

• Installation photos
• Device configuration data (WLED settings)

Customers/Homeowners (Mobile App)

• Lighting preferences: schedules, presets, colors
• Device configurations: naming, grouping

2.2 IoT Device Data

• Device identifiers (IDs, names)
• Network data (IP, ports, tunnel URLs)
• Metadata (firmware, OS, status)
• MQTT configuration
• Lighting data (settings, schedules, effects)

2.3 Automatically Collected Information

• Device info (model, OS, app version)
• Network info (IP, Wi-Fi SSID)
• Location data (for discovery & timezone)
• Crash reports (via Firebase Crashlytics)

3. Mobile App Permissions

You can modify permissions anytime in your device settings.

4. How We Use Your Information

• Provide and maintain Services
• Facilitate installations
• Manage customer relationships
• Enable device communication (mDNS, MQTT)
• Provide remote access
• Improve performance and stability
• Send transactional messages
• Ensure security
• Comply with legal obligations

4.1 Legal Basis

We process data based on:

• Contractual necessity
• Legitimate interests
• Legal compliance
• Consent

5. How We Share Information

We do not sell personal information.

5.1 Service Providers

Providers only process data on our behalf.

5.2 Legal Requirements

We may disclose information for:

• Legal compliance
• Safety protection
• Fraud/security prevention

5.3 Business Transfers

Data may transfer during mergers, acquisitions, or asset sales.

5.4 With Consent

We may share data when you explicitly approve it.

6. Data Storage & Security

6.1 Storage

• Stored on Supabase (U.S.)
• Files stored in Supabase Cloud Storage

6.2 Security Measures

• TLS/SSL encryption
• Hashed credentials
• Role-based access
• Secure authentication
• Local network device communication

6.3 Data Breach

We will notify affected users as required by law.

6.4 International Transfers

Data may be processed in the United States or other jurisdictions.

7. Data Retention

• Account data: until deletion request
• Job records: retained (may be anonymized)
• Crash data: per Firebase retention
• Installation photos: part of job records

Deletion requests are processed within 30 days, unless legally required otherwise.

8. Your Rights

• Access your data
• Correct inaccurate data
• Request deletion
• Opt out of communications

Requests are handled within 30 days.

9. Children’s Privacy

We do not collect data from children under 13.

If discovered, we will delete it promptly.

10. California Privacy Rights (CCPA)

California residents have rights to:

• Know collected data
• Request deletion
• Avoid discrimination
• Confirm no sale of data

Requests are processed within 45 days.

11. IoT & Local Network Communication

• Devices discovered via mDNS/Bonjour
• Local control stays on your network
• MQTT enables remote updates
• Tunnel URLs allow remote access
• Configurations synced to cloud

12. Cookies & Tracking (Web Portal)

Used for:

• Session management
• Preferences
• Usage analytics

Advertising cookies may be supported

Do Not Track: Not currently supported.

13. Policy Updates

We may update this policy.

Changes will include:

• Updated effective date
• Notification via app or email

14. Contact Information

Lux Lights, LLC

Attn: Matt Romero, Privacy Officer

478 S. W. Frontage Rd, Suite 104

Springville, UT 84663

Email: hello@luxlights.com

Phone: (385) 595-4448

Governing Law: State of Utah, United States