Privacy Policy

1. Who We Are

LUMO PLATFORM LIMITED (“Lumo”, “we”, “us”, “our”) is a B2B SaaS platform that helps e-commerce brands manage their TikTok Shop. We connect brands with TikTok creators through TikTok's official Shop Partner API.

LUMO PLATFORM LIMITED was incorporated in 2025 and the application is launching in April 2026.

• Company legal name: LUMO PLATFORM LIMITED
• Registered address: 120 Holborn, London, England, EC1N 2TD
• Privacy enquiries: privacy@lumoplatform.ai
• Data protection contact: security@lumoplatform.ai

Lumo currently processes personal data exclusively in the context of UK-based operations and does not specifically target EU residents. Should this change, we will appoint an EU representative in accordance with Article 27 GDPR.

1.1 Our Role Under Data Protection Law

Depending on how data is used, Lumo may act as either:

• Data Controller — when processing information about platform users and creator data used to power the Lumo platform.
• Data Processor — when processing data on behalf of brand users who use the platform to run creator campaigns.

2. Who This Policy Applies To

This Privacy Policy applies to:

• Brand users — individuals who register and use LUMO PLATFORM LIMITED on behalf of an e-commerce brand or organisation.
• TikTok creators — individuals whose publicly available TikTok profile and performance data is processed through the TikTok Shop API in the context of affiliate campaign matching.
• Visitors to our website and platform.

3. What Data We Collect and Why

3.1 Brand Users (Our Direct Customers)

When you create a Lumo account, we collect:

3.2 TikTok Creators

We process publicly available creator data made available through TikTok's official Shop Partner and Creator Marketplace APIs. This includes:

We do not collect:creator email addresses, phone numbers, payment details, private messages, or any data not publicly available through TikTok's official API.

3.3 Automated Decision-Making and Profiling (FitScore)

Lumo uses an automated scoring system called FitScore to help brands assess the suitability of TikTok creators for their affiliate campaigns. FitScore analyses publicly available creator data including follower count, engagement rate, content category, historical campaign performance, and GMV metrics.

FitScore influences outreach recommendations made to brands but does not produce decisions with legally significant or similarly significant effects on creators.

If you are a TikTok creator and wish to understand how your FitScore has been calculated, or to request a human review, contact privacy@lumoplatform.ai.

4. How We Use Data

• Provide and operate the Lumo platform for brand users.
• Match creators to affiliate campaigns based on performance and relevance.
• Send collaboration invitations and direct messages to creators on behalf of brands, strictly via TikTok's official API.
• Process payments and manage subscriptions.
• Monitor platform security, detect fraud, and maintain system integrity.
• Comply with our legal obligations under UK GDPR and TikTok's Partner Programme requirements.

We do not: sell data to third parties, use data for advertising, or share data outside the Lumo platform without legal basis.

5. Data Sharing and Third-Party Processors

We share data only with trusted sub-processors necessary to operate the platform. All sub-processors are contractually bound to process data only on our instructions and in compliance with UK GDPR.

6. Data Retention

7. Data Security

• Encryption at rest: AES-256 encryption on all databases.
• Encryption in transit: TLS 1.3 enforced across all connections, with HSTS enabled.
• OAuth token security: TikTok access tokens are encrypted at the application level using AES-256-GCM before storage.
• Access control: PostgreSQL Row-Level Security (RLS) policies enforce strict multi-tenant isolation.
• Authentication: Multi-factor authentication (MFA) is mandatory for all production users.
• Infrastructure: All data is stored and processed within EU/UK regions.

8. Your Rights Under UK GDPR

9. Creator Opt-Out

If you are a TikTok creator and do not wish to be contacted via Lumo, email privacy@lumoplatform.ai with subject line “Creator Opt-Out” and your TikTok username.

1. Remove your profile from our creator database.
2. Add you to our suppression list so brands cannot contact you through Lumo.
3. Confirm completion within 48 hours.

10. Cookies

Lumo uses strictly necessary cookies required for authentication, session management, and platform security. We do not use tracking cookies, advertising cookies, or third-party analytics cookies.

11. Changes to This Policy

We may update this Privacy Policy from time to time. We will notify registered users of material changes by email at least 14 days before they take effect.

12. Age Restriction

Lumo Platform is intended for use by businesses and individuals aged 18 or over. We do not knowingly collect personal data from children. Contact privacy@lumoplatform.ai if you believe a child has submitted data.

13. Governing Law

This Privacy Policy is governed by the laws of England and Wales. Any disputes shall be subject to the exclusive jurisdiction of the courts of England and Wales.

14. Contact and Complaints

• Privacy enquiries: privacy@lumoplatform.ai
• Data protection contact: security@lumoplatform.ai

If you are unsatisfied with our response, you have the right to lodge a complaint with the UK Information Commissioner's Office (ICO):

• Website: ico.org.uk
• Phone: 0303 123 1113