Privacy Policy
Last updated: October 22, 2026 · Version 2026-10-22
1. Scope
Illuminious LLC ("Illuminious," "we," "our," or "us") is a Wyoming limited liability company with its registered agent address at 30 N Gould St, Ste R, Sheridan, WY 82801, and operations in San Francisco, CA 94107. This policy covers two surfaces: the public website, and the authenticated customer portal where you configure work, upload technical files, receive official quotes, pay, and track orders. The portal handles materially more sensitive data than the website, and this policy says so explicitly rather than treating them as one.
2. What we collect
- Account data: name, work email address, password credential, email-verification and password-reset state, phone number, company name, job title, and the organization your account belongs to.
- Sign-in through another account: where we offer it, you can sign in with your Google, GitHub or Facebook account. That provider then shares your name, your e-mail address and an account ID with us. We do not receive your password for that account. To ask us to delete this data, follow the steps on our data deletion page.
- E-mail you send us: when you write to our e-mail address, we store the message text, its attachments and the sender's address with your account or inquiry, and we post a copy in a private Slack channel that only our staff can read.
- Project and manufacturing files: everything you upload — Gerber archives, BOMs, placement data, CAD models, drawings, stencil sources, requirements documents — along with their filenames, sizes, types, and revision history.
- Order and commercial data: configurations, preliminary estimates, official quotes and their revisions, acceptances and declines, messages between you and our engineers, approvals, milestones, shipments, tracking numbers, and support issues.
- Payment metadata: amounts, currency, order and quote references, payment status, the payment rail used (card or bank debit), the last four digits and brand of a card where the processor supplies them, refund and adjustment records, and the shipping address collected at checkout. We never receive or store your full card number, CVC, or bank credentials — those go directly to Stripe.
- Acceptance records: which version of these documents and of each in-product disclosure you accepted, and when.
- Usage and device data: IP address, browser and device type, pages viewed, referrer, and timestamps, collected through server logs and the tags described in section 8.
3. How we use it
- To operate your account and keep your files, drafts, quotes, and orders attached to it.
- To perform engineering review, produce official quotes, manufacture, ship, and support your orders, including sharing the specific data a supplier needs to do the work.
- To take payment, issue refunds, reconcile unmatched payments, and meet tax and accounting obligations.
- To send transactional email about your orders — verification, quotes, approvals, payment, shipment, and support.
- To keep an audit trail of commercial and approval events, which is a record we are obliged to keep accurate rather than to delete on request.
- To answer inquiries, and to send marketing email only where you have opted in.
- To measure and improve the website and to run advertising, as described in section 8.
We do not sell your personal information, and we do not use your uploaded manufacturing files to train machine-learning models or for any purpose other than quoting, reviewing, producing, and supporting your work.
4. Processors and recipients
We use the following service providers. Each processes data on our instructions for the stated purpose.
| Provider | What it handles | Surface |
|---|---|---|
| Supabase | Authentication, the order database, and private file storage for everything you upload. | Portal |
| Vercel | Application hosting and request logs. | Website and portal |
| Stripe | Card and bank-debit payments, refunds, and payment receipts. Stripe receives your payment credentials directly; we receive only the metadata in section 2. | Portal |
| Resend | Delivery of transactional email — the recipient address and the message content — and receipt of the e-mail you send us, which passes through Resend before we store it. | Portal |
| HubSpot | Customer relationship management, the shared conversations inbox, and website visit tracking. Contact details, company records, order stage, and message threads. | Website and portal |
| Meta Platforms | Advertising measurement through the Meta pixel and the purchase reporting described in section 8, and messaging where you contact us through a Meta channel. | Website and portal |
| Google Tag Manager and the analytics and advertising tags it loads. | Website | |
| Advertising measurement through the LinkedIn Insight tag and the purchase reporting described in section 8. | Website and portal | |
| Slack | Our staff workspace. A copy of the message text you send us through the portal, a contact form or e-mail, and the details of order and payment events, is posted in a private Slack channel that only our staff can read. Slack stores these copies. If you talk with us in a shared channel through Slack Connect, the messages and files you post there are also kept by your own organization's Slack workspace under its own settings; we cannot delete those copies. | Website and portal |
| Typeform | Application forms for our founder tour. Typeform receives the answers you give, your contact details, and hidden fields such as UTM campaign tags and the referring page. We use it only to review tour applications. Typeform stores data in the EU or the US, as set in its own terms. | Website (tour applications) |
| Luma | Event registration for tour events. Luma receives your name, e-mail address and the answers you give when you apply. We use it only to handle event applications. | Event pages |
| Partiful | Event RSVPs for tour events. Partiful receives your name, phone number or e-mail address, and the answers you give. We use it only to manage RSVPs. | Event pages |
We also share the specific technical data required to perform your order with the manufacturing partners and carriers producing and delivering it, under confidentiality obligations. Beyond that, we disclose personal information only where the law requires it, to establish or defend a legal claim, or in connection with a merger, acquisition, or sale of assets — in which case this policy continues to apply until you are told otherwise.
5. Where data is held
Illuminious is headquartered in the United States, and the portal database and file storage are hosted in the United States. Our providers and our manufacturing partners operate internationally, so data may be accessed from outside your country. Where a transfer requires a lawful basis under your local law, we rely on the appropriate safeguard for that transfer.
6. Retention
- Account data is kept while your account is active and for a reasonable period after closure.
- Uploaded files are kept while they are attached to a live or historical order, then archived and deleted on a policy-driven schedule. File bytes are held separately from the order metadata, so a file can be removed while the record that it existed, and what was approved, remains.
- Commercial and audit records — quotes, acceptances, payments, refunds, approvals, and the versioned acceptance record — are retained for the period required by tax, accounting, and contractual obligations, and are not deleted on request during that period.
- Server and analytics logs are retained on each provider's own schedule.
7. Security, and its limits
Portal access requires a verified account. Your data is isolated per organization by database row-level security, so a request that is not yours returns nothing rather than being filtered afterwards. Uploaded files are stored privately and served through short-lived authenticated links; a link that leaks stops working. Staff access is role-based and commercially and technically separated, and privileged actions are recorded in an audit log.
No system is perfectly secure, and no transmission over the internet can be guaranteed. We do not claim otherwise. If a breach affects your data we will notify you as required by applicable law.
8. Cookies and tracking
The portal uses strictly necessary cookies for sign-in and security; it does not work without them. The public website additionally loads analytics and advertising tags — Google Tag Manager, the Meta pixel, the LinkedIn Insight tag, and HubSpot tracking — and these load only after you accept optional cookies in the consent banner. You can decline, and you can change your choice at any time through the banner or your browser settings. Declining does not affect your ability to use the portal.
When you pay for an order and have accepted marketing cookies, we send the purchase (order reference, amount, currency and time) to Meta, LinkedIn and Google so they can measure our advertising, with your contact details as described below. If your order was arranged with our sales team (for example by e-mail, phone, WhatsApp or at a trade show), we may report the purchase to Meta and LinkedIn when you pay even if you declined marketing cookies; declining may not stop this. Meta receives the order number, amount, currency and time of purchase, with your e-mail address, phone number, first and last name, postal code, country and our account ID for you in hashed form. LinkedIn receives the amount, currency and time of purchase with your e-mail address in hashed form. Google receives your e-mail address, phone number and first and last name in hashed form, and your postal code and country. Only if you accepted marketing cookies do we also send the advertising cookies on your device (Meta's _fbc and _fbp, LinkedIn's li_fat_id). Hashing is not encryption: these companies compare the hashed values with the details of their own users, and if they match, they learn that you made a purchase from us and for how much. To ask us not to report an order arranged with our sales team, contact info@illuminious.com.
9. Your rights
Depending on where you live, you may have the right to access the personal data we hold about you, correct it, delete it, obtain a portable copy, object to or restrict certain processing, and opt out of marketing email. Marketing email can be stopped from any such message; transactional email about an active order cannot, because it is part of performing the order.
To make a request, email info@illuminious.com from the address on your account. We verify the request against your account before acting on it, respond within the period your law requires, and tell you plainly where a record must be retained for a legal or accounting obligation instead of deleted.
10. Third-party links
Our pages may link to sites we do not operate, including our providers' own pages. We are not responsible for their privacy practices, and we encourage you to read their policies.
11. Children
Our services are directed to businesses and are not intended for anyone under 18. We do not knowingly collect personal information from children.
12. Changes to this policy
We may update this policy. A revision is published under a new version number with an updated date, and the portal records which version you accepted. Material changes to how portal data is handled will be communicated in the portal as well as here.
13. Contact
For questions about this Privacy Policy, or to exercise a right described in section 9:
Illuminious LLC
Registered agent address: 30 N Gould St, Ste R, Sheridan, WY 82801, USA
Operations: San Francisco, CA 94107, USA
Email: info@illuminious.com