Supplemental Privacy Notice for California and Other U.S. State Residents

Effective date: October 26, 2026 · Last updated: October 26, 2026

1. When this notice applies

State privacy laws apply to businesses that meet certain thresholds, such as annual revenue or the number of residents whose data they process. Many of these laws also exempt information that the Gramm-Leach-Bliley Act (GLBA) or other federal financial privacy laws already govern. Some of these laws may not apply to Luminara, or may not apply to some of the information we hold.

We publish this notice so that our practices are clear. We will consider privacy requests from any U.S. resident and will respond as applicable law requires. Describing these rights here does not waive any exemption or exception available to us under law.

This notice does not cover information we collect about our own employees and contractors, which we address separately. It also does not cover information about people acting for a business in a business-to-business context, to the extent the applicable law excludes it.

2. What we collect and why

The table below lists the categories of personal information we have collected in the past 12 months. For each category, it shows where the information comes from, why we use it, and who we disclose it to. We have not sold any category for money. As section 4 explains, we have made identifiers (such as cookie IDs and IP address) and internet activity available to Google for targeted advertising, which some laws treat as “sharing” or a “sale.”

We do not collect biometric information, precise geolocation, or information about health, sex life, sexual orientation, religion, union membership or racial or ethnic origin, unless you choose to include it in records you give us. We do not create profiles or draw inferences about you to predict your behavior.

We keep each category for the periods described in the retention section of our Privacy Policy.

3. Sensitive personal information

We use and disclose sensitive personal information only to provide the Services you request and for other purposes the CCPA permits, such as security, fraud prevention and legal compliance (Cal. Code Regs. tit. 11, §7027(m)). We do not use it to infer characteristics about you. Because of this, the right to limit the use of sensitive personal information does not apply, and we do not offer a “Limit the Use of My Sensitive Personal Information” link.

4. Targeted advertising and how to opt out

We do not sell personal information for money. We do use Google advertising features, including remarketing, on the Site. Google collects cookie IDs, IP address and information about the pages you visit, so that it can show our ads to you on other websites and measure them. California law calls this “sharing” for cross-context behavioral advertising. Some other states treat it as “targeted advertising” or a “sale.” In the past 12 months, we have done this only with identifiers and internet activity collected on the Site. We have never done it with client financial or tax information.

To opt out of the sale or sharing of your personal information and of targeted advertising:

• Use the Your Privacy Choices link in the footer of our Site, or the cookie settings on the Site.
• Turn on Global Privacy Control (GPC) in your browser. We treat a GPC signal as a valid opt-out request for that browser.
• Email inquiries@luminarallc.com with the subject line “Opt Out,” or call 510-306-4016. We don’t need to verify your identity for an opt-out request.
• You can also turn off personalized ads in Google Ad Settings.

We act on opt-out requests as soon as feasibly possible, and within 15 business days. We do not knowingly sell or share the personal information of consumers under 16.

5. Your rights

Depending on your state of residence and subject to the law’s exceptions, you have the right to:

• Know and access: ask what personal information we have collected about you, its sources, why we collected it and who we disclosed it to, and get a copy of specific pieces of it in a portable format.
• Delete: ask us to delete personal information we collected from you.
• Correct: ask us to correct inaccurate personal information.
• Opt out: of the sale of personal information, of sharing it for targeted advertising, and of profiling that produces legal or similarly significant effects. We do not profile you in this way. To opt out of targeted advertising, see section 4.
• Appeal: ask us to reconsider if we deny your request (see Appeals).
• Not be discriminated against for using your rights.

These rights have limits. For example, we may keep information when we need it to complete a service you requested, to meet tax and recordkeeping laws (including IRS and state record-retention rules), to detect security incidents or fraud, to establish or defend legal claims, or to comply with a legal obligation. We will not disclose Social Security numbers, financial account numbers, account passwords or similar data in response to an access request; we will tell you that we have that type of information instead. If we cannot fully honor a request, we will explain why.

6. How to make a request

• Email: inquiries@luminarallc.com, subject line “Privacy Request”
• Phone: 510-306-4016, Monday to Friday, 9am to 5pm Pacific Time
• Mail: Luminara LLC, Attn: Privacy, 548 Market Street, San Francisco, CA 94104

Please tell us which right you want to use, your state of residence, and how we can reach you.

7. Verifying your request

To protect you, we must confirm that you are the person the request is about. We will ask you to confirm information we already have, for example by replying from the email address we have on file and matching two or more details we hold. Requests to access or delete sensitive information require a higher level of verification. We use the information you give us for verification only for that purpose. If we cannot verify your identity, we will tell you, and we may deny the request.

8. Authorized agents

You can use an authorized agent to make a request for you. The agent must give us your signed written permission or a valid power of attorney. Unless the agent has a power of attorney, we may also ask you to verify your identity directly and confirm that you gave the agent permission.

9. Response times

We will confirm receipt of your request within 10 business days and respond within 45 calendar days. If we need more time, we may extend this period by up to another 45 days, as the law allows, and we will tell you why. We respond free of charge. We may charge a reasonable fee or decline a request that is clearly unfounded, excessive or repetitive, as the law allows. Access requests cover the 12 months before your request, or a longer period where the law requires it.

10. Appeals

If we deny your request, you can appeal. Reply to our decision, or email inquiries@luminarallc.com with the subject line “Privacy Appeal,” within 60 days of our decision. We will respond in writing within the time your state’s law requires, usually 45 to 60 days. If we deny the appeal, you can contact your state Attorney General. California residents can also contact the California Privacy Protection Agency at cppa.ca.gov.

11. No discrimination

We will not deny you Services, charge you a different price, or give you a different quality of service because you used your privacy rights.

Notice of financial incentive. We offer free downloadable guides to people who join our email list. To get them, you give us your first name, email address and, if you choose, a description of your business. We use this information to send you the guides and occasional bookkeeping and tax emails. You join by completing the sign-up form and checking the consent box. You can withdraw at any time by unsubscribing or emailing us, and you keep the guides. We estimate that the value of your information to us is about equal to our cost to create and deliver the guides, which is nominal. We calculate this from our time and costs to produce the guides and run our email list.

12. Minors

We do not knowingly sell or share the personal information of anyone under 16, and the Site is not directed to minors. California residents under 18 who have posted content on the Site can ask us to remove it by emailing us; this may not remove copies held by others.

13. California “Shine the Light”

California Civil Code §1798.83 lets California residents ask whether a business has disclosed personal information to third parties for their own direct marketing purposes. We do not disclose personal information to third parties for their direct marketing.

14. Nevada and other states

Nevada residents can ask us not to sell certain personal information. We do not sell personal information, but you can still submit a request using the contact details below. If you live in a state that is not named in this notice and has its own privacy law, contact us and we will honor the rights that law gives you.

15. Contact us