Privacy Policy

1. Who is responsible

IMEI Luma is operated by Lumasites. Correspondence address: 44 Montagu Crescent, London, N18 2HA, United Kingdom. Email: imeilumasupport@gmail.com.

Lumasites is responsible for the information processed to operate IMEI Luma. Contact the email or correspondence address above about privacy questions or requests.

2. Information we handle

• Accounts: your email address, protected password hash and salt, verification state, account status and service-credit balance.
• Checks: the IMEI or serial number you submit, selected service, report receipt and provider order identifiers, status and returned report information used to display your result.
• Payments: credit amounts, service fees, Stripe transaction references, payment state, ledger entries and relevant refund or dispute information. Our application does not collect or store your full card number or card security code.
• Security and technical information: ordinary hosting and request data, including IP-related information, timestamps and anti-abuse records. Application login and email-request limits use hashed IP and email-related values.
• Support: information you choose to include in emails and any information needed to investigate your request.

3. Why we use it

We use account and order information to perform the service you request: registering and authenticating accounts, confirming email addresses, recovering access, processing credit purchases, generating reports and providing support.

We rely on our legitimate interests in securing the service, preventing fraud and abuse, investigating faults and maintaining reliable transaction records, subject to your rights. We also process records where necessary to meet applicable legal obligations. Optional uses requiring consent will need an appropriate separate choice; accepting terms is not blanket consent for unrelated marketing.

Without the required email and account information we cannot provide a signed-in account. Without the device identifier required by a selected service, we cannot request that report.

4. Providers and other recipients

• IMEICheck.com: receives the device identifier and service request to supply the requested report and maintain its provider order history.
• Cloudflare: hosts the website and database and handles network delivery and security.
• Stripe: processes payments and relevant payment, fraud, refund and dispute information under its own applicable notices.
• Resend: receives the recipient email address and email content needed to deliver account confirmation and password-recovery messages.
• Google/Gmail: processes support correspondence sent to our Gmail support address.

We may also disclose information where required by law or necessary to establish, exercise or defend legal claims. We do not sell personal information or publish customer device identifiers as marketing examples.

5. Cookies and browser storage

The secure session cookie __Secure-imeiluma_session keeps you logged in and expires after 14 days unless replaced or revoked earlier. Logging out removes the session cookie and invalidates that session.

Browser session storage can hold your selected service, prefilled device identifier and a random receipt used to retrieve the existing report. It is specific to that browser tab. If you choose Remember login, local storage keeps your email address until cleared; the website does not save a readable password for this feature. Your browser’s separate password manager is controlled by you.

Our current application does not install advertising or audience-analytics trackers. Payment-provider pages and your browser may use their own storage. We will review this notice and any necessary consent choices before adding optional tracking.

6. Retention and security

We retain account information while needed to operate your account, and order, credit and payment references while needed to reconcile transactions, handle support and disputes, and meet applicable recordkeeping obligations. Retention depends on the record type, outstanding balance, open issue and applicable legal requirements.

Verification links expire after 24 hours and recovery links after 30 minutes. Expiry makes a link unusable; it does not itself mean its database record has been deleted. Existing account, receipt and ledger records do not currently have a general automatic deletion schedule. Deletion and retention requests are reviewed manually, including whether some records must be retained for legal or transaction reasons.

Passwords are stored as protected hashes. Sessions, validation and spending controls limit access to accounts and receipts. No system can guarantee absolute security. Never send passwords, recovery links, API keys or full card details to support.

7. International processing

Our providers may process information in the UK and other countries, depending on the service and their infrastructure. A database region alone does not establish that every part of a request stays in that region. International transfers must be assessed under the applicable data-protection rules; contact us for information about the relevant providers and transfer arrangements.

8. Your rights and complaints

Depending on applicable law, you may request access, correction, deletion, restriction, a portable copy of eligible information, or object to processing based on legitimate interests. Where processing relies on consent, you may withdraw it. These rights can have exceptions, including necessary legal and transaction records.

Email imeilumasupport@gmail.com to make a request. We may need proportionate information to verify that the account or request belongs to you; never send your password. We respond within the applicable legal time limits.

You may complain to the UK Information Commissioner’s Office or another competent data-protection authority. Contacting us first does not remove that right.

9. Changes

We will update this page when our processing changes and show the updated date. Material changes that require a separate notice or choice will be handled accordingly.