This Privacy Policy describes how Luxventory (“we,” “us,” or “our”) collects, uses, stores, and shares information when you visit our marketing website at luxventory.io, sign up for an account, use our software-as-a-service platform, or interact with any feature we offer (collectively, the “Service”). Luxventory is operated from the State of Florida, United States.
We do not sell your personal information. We do not sell your customers’ personal information. We do not rent, lease, or otherwise share personal information with data brokers for their independent commercial use.
1. Who this policy applies to
Luxventory is a multi-tenant platform serving two kinds of users:
- Account holders— dealers and watchmakers (and their staff) who create or are invited to a Luxventory store (“Subscribers”).
- End customers— individuals whose information a Subscriber chooses to store in Luxventory (e.g. their watch buyers, service customers, or wholesale contacts), and individuals who submit a watch through a Subscriber’s public service-intake form.
For end-customer data, the Subscriber acts as the “data controller” and Luxventory acts as the “data processor.” This means each Subscriber is responsible for the lawful collection and use of their own customer data, while Luxventory provides the technical infrastructure to store and process it.
2. Information we collect
2.1 Information you provide directly
- Account information — name, email address, password (stored only as a one-way hash, never in plaintext), phone number, business name, business address, tax ID or reseller certificate number (optional).
- Business inventory data — watches, handbags, accessories, and related fields you choose to enter (brand, model, serial number, photos, internal notes).
- Customer records you create — names, emails, phone numbers, addresses, purchase history, and notes about your own customers that you choose to store.
- Service tickets — including ticket details, photos before and after work, and watchmaker notes.
- Payment information — payment method details provided during subscription checkout (when paid plans are active) are processed by Stripe, Inc. and never stored on Luxventory servers in card-readable form.
2.2 Information collected automatically
- Usage data — pages visited, features used, timestamps, IP address, browser type, operating system. We use this to keep the Service operational and to debug.
- Cookies and similar technologies — strictly necessary cookies (for session login). We do not use third-party tracking or advertising cookies.
2.3 Information collected from Subscribers about their customers
When a Subscriber records a customer in Luxventory, or when an end customer submits a watch through a Subscriber’s public intake form, Luxventory stores that information on the Subscriber’s behalf. The Subscriber decides what data is collected and for what purpose. Luxventory acts only as a processor of that data.
3. How we use information
- To provide, maintain, and improve the Service.
- To authenticate users and secure accounts.
- To process subscription billing through Stripe (when paid plans are active).
- To send transactional emails (account confirmations, password resets, billing notices, security alerts) and operational notifications you specifically request.
- To respond to support requests and communicate about the Service.
- To comply with legal obligations, enforce our Terms of Service, and protect Luxventory, our Subscribers, and the public from fraud or abuse.
- To analyze aggregate, de-identified usage trends to improve the product.
We do not use Subscriber business data or end customer data to train machine-learning models, sell to third parties, or build profiles for advertising.
4. How we share information
Luxventory shares information only in the limited circumstances below:
- Service providers (sub-processors) — vendors we use to operate the platform, each bound by contract to process data only on our instructions:
- Vercel, Inc. (United States) — hosting and content delivery.
- Neon, Inc. (United States) — managed PostgreSQL database.
- Cloudflare, Inc. (United States) — object storage (R2) for uploaded photos.
- Resend Inc. (United States) — outbound transactional email delivery.
- Stripe, Inc. (United States) — payment processing when paid plans are active.
- Optional Subscriber-enabled integrations — Subscribers may connect third-party services (e.g. Shopify, Klaviyo, QuickBooks Online, Chrono24, eBay, Twilio, Gmail/Outlook) which receive only the data the Subscriber authorizes for that integration.
- Legal compliance — when required by valid legal process, court order, subpoena, or to comply with applicable law.
- Safety and rights protection — to investigate violations of our Terms or to protect the rights, property, or safety of Luxventory, our Subscribers, or others.
- Business transfers — if Luxventory is involved in a merger, acquisition, or sale of assets, information may be transferred as part of that transaction, subject to the successor honoring this Privacy Policy.
5. Data retention
We retain Subscriber account information and business data for as long as the account is active. When an account is canceled, we retain data for up to 90 days to allow account recovery, then delete or anonymize it, subject to longer retention required for tax, accounting, or legal compliance.
End customer data is retained on the Subscriber’s behalf under the Subscriber’s control. Subscribers may delete end customer records at any time through the Service.
6. Security
We implement industry-standard administrative, technical, and physical safeguards to protect information from unauthorized access, use, alteration, or destruction. These include:
- HTTPS encryption in transit for all traffic.
- Encryption at rest for the production database and object storage.
- Passwords stored only as bcrypt one-way hashes.
- Strict tenant isolation — Subscribers cannot access another Subscriber’s data.
- Role-based access controls within each Subscriber account.
- Two-factor authentication available to all users.
- Operational monitoring and logging of administrative actions.
No system is 100% secure. While we work continuously to protect information, we cannot guarantee absolute security and we encourage Subscribers to use strong, unique passwords and to enable two-factor authentication.
7. Your rights
Depending on the laws that apply to you (including the Florida Digital Bill of Rights, where applicable), you may have rights to:
- Access the personal information we hold about you.
- Correct inaccurate information.
- Delete your personal information.
- Receive a portable copy of your information.
- Opt out of profiling that has legal or similarly significant effects (we do not engage in such profiling).
- Opt out of the sale or sharing of personal information (we do not sell or share for cross-context behavioral advertising).
To exercise any of these rights, contact us at privacy@luxventory.io. We will verify your identity and respond within the timeframes required by applicable law (generally 45 days). End customers of a Subscriber should direct rights requests to that Subscriber, who is the controller of their data.
8. Children’s privacy
The Service is intended for use by businesses and is not directed to children under the age of 13. We do not knowingly collect personal information from children under 13. If we learn we have collected such information, we will delete it promptly.
9. International users
Luxventory is hosted and operated in the United States. By using the Service, you understand that your information will be transferred to, processed, and stored in the United States, which may have different data protection laws than your country.
10. Changes to this Privacy Policy
We may update this Privacy Policy from time to time. We will post the updated policy at this URL with a new effective date. Material changes will be notified to Subscribers by email or in-app notice at least 14 days before they take effect.
11. Contact
Questions, concerns, or rights requests? Reach us at:
Luxventory
Attn: Privacy
privacy@luxventory.io