Legal

Privacy Policy

Last updated: August 26, 2026

1. Who we are

This site is operated by LumiShop LLC, doing business as The Operator Stack, 30 N Gould St, Sheridan, WY 82801, United States. LumiShop LLC is the controller of the personal data described in this policy. Privacy questions and requests: andrej@theoperatorstack.io.

2. What we collect

We collect different information depending on what you do:

• Purchases: name, email address, billing details, country, any business name or tax ID you choose to provide, the product and price, payment status, refund or dispute status, and a Stripe customer, checkout, or payment identifier. Stripe receives your full card details. We do not receive or store the full card number or card security code.
• Delivery and owner support: the files and emails sent to you, delivery status, scheduled follow-up messages, replies, stop requests, and support correspondence.
• Free downloads and leads: email address, the item requested, form and campaign source, delivery status, scheduled follow-up messages, and any stop request you send us.
• Optional buyer answer: if you answer the one-tap question about what you sell, we store the selected category with your Stripe customer or payment record.
• Site and device activity: pages and links viewed, clicks, scrolls, session duration, referral page, approximate region, language, browser, device, operating system, IP address, user agent, advertising identifiers, and cookie or local-storage identifiers.
• Attribution: UTM source, medium, campaign, content, and term, plus campaign, ad-set, ad, placement, click identifiers, and first or recent landing details when present.
• Security and operations: request logs, timestamps, error details, webhook events, and other records needed to prevent abuse, diagnose failures, and keep purchases and delivery working.

Please do not send us sensitive personal information. This site is built for business operators and does not ask for health, biometric, government-ID, precise-location, or similar sensitive data.

3. Why we use it

• Process payment, prevent fraud, issue refunds, and keep accounting and tax records.
• Deliver the product or free item you requested and show the correct access instructions.
• Send transactional messages, product updates, support replies, and permitted marketing messages.
• Remember attribution details long enough to connect a checkout with the visit that led to it.
• Measure traffic, page use, checkout activity, purchases, and advertising performance.
• Understand where people get stuck, improve the site, and decide what to build next.
• Protect the site, investigate errors, enforce our terms, and meet legal obligations.

4. Our legal bases

Where laws such as the GDPR or UK GDPR apply, we use personal data on one or more of these bases:

• Contract: to take payment, deliver what you requested, provide access, process a refund, and answer product support questions.
• Legitimate interests: to secure and operate the business, prevent abuse, keep accurate attribution and business records, understand aggregate site performance, improve the product, and defend legal claims. We balance these interests against your rights.
• Consent: where you give it for a specific optional use, including marketing where consent is required. You can withdraw consent at any time.
• Legal obligation: for tax, accounting, consumer-protection, sanctions, law-enforcement, and other duties that apply to us.

5. Services that receive data

We use the following providers to run the site and measure it:

• Stripe processes checkout, payment, refunds, fraud checks, and payment records. Stripe Privacy Center.
• Resend sends delivery, lifecycle, marketing, and support email and records delivery events. Resend Privacy Policy.
• Vercel hosts the site, server functions, logs, and private product files. Vercel Privacy Notice.
• Google Analytics measures visits, pages, devices, approximate location, traffic source, and events. Google Privacy Policy.
• Google Fonts supplies the site's typefaces. When your browser requests a font file, Google receives technical request data such as the IP address and user agent. Google Privacy Policy.
• Microsoft Clarity provides interaction analytics, heatmaps, and session replays that can include clicks, scrolls, and the page content shown in a browser. We do not use it to intentionally capture payment-card fields. Microsoft Privacy Statement.
• Rybbit provides traffic, funnel, and custom-event analytics, including URLs, query parameters, device and region data, UTMs, and anonymous session identifiers. Rybbit Privacy Policy.
• Meta, including Meta Pixel, Conversions API, and the Stape CAPI Gateway used to route server events, measures ad delivery and conversions. Purchase or lead events can include page and campaign details, IP address, user agent, Meta cookie identifiers, and contact information transformed into hashed values for matching. Meta Privacy Policy.

We may also disclose information to professional advisers, authorities, courts, or a buyer of the business when reasonably necessary and permitted by law. We do not sell personal information for money.

6. Cookies, local storage, and advertising choices

Google Analytics, Microsoft Clarity, Meta, and related tools can use cookies or similar identifiers. Our own attribution script uses browser local storage to remember campaign and landing details. These technologies can recognize a browser, connect events within a session, and help attribute a purchase or lead.

The current site does not have a dedicated cookie-preference panel. You can block or clear cookies and local storage in your browser, use privacy extensions, or use device and platform advertising controls. Blocking them can reduce measurement accuracy, but the core pages and checkout should still work. Browser settings do not erase information already received by a provider.

Some US state laws may call the use of advertising or cross-context measurement providers a "sale," "sharing," or "targeted advertising" even when no money changes hands. You can request an opt-out at andrej@theoperatorstack.io. We will verify and process requests as required by applicable law.

7. Email

We send transactional messages needed to deliver and support what you requested. We may also send product updates and related offers where permitted. Free-download follow-up can include the requested item, reminders, and product offers. To ask us to stop marketing email, reply STOP or email andrej@theoperatorstack.io. We handle these requests manually, so a message already queued before we process the request may still arrive. Necessary purchase, delivery, refund, security, and support messages may continue.

8. How long we keep it

We keep purchase, refund, and accounting records for the period required by tax, accounting, fraud-prevention, and legal rules. We keep owner, lead, and email records while the relationship is active, until a stop or deletion request is processed, and for a limited period afterward when needed to honor that request, resolve disputes, or meet legal obligations. Support correspondence and operational logs are kept only as long as reasonably needed for support, security, debugging, and claims. Analytics and advertising providers apply their own retention settings and policies.

9. International transfers

We are a United States company and use providers that process information in the United States and other countries. Those countries may have different privacy laws. Where required, we or the relevant provider rely on an approved transfer mechanism or another lawful safeguard. A provider's own policy may give more detail about its transfer practices.

10. Your rights

Depending on where you live, you may have the right to access, correct, delete, restrict, object to, or receive a copy of personal data, withdraw consent, opt out of certain advertising uses, and appeal a request decision. You may also have the right to complain to your local data-protection authority.

Email andrej@theoperatorstack.io with the request and the email address you used. We may ask for enough information to verify your identity and locate the record. Authorized agents may submit a request where local law allows it. We will not discriminate against you for exercising a privacy right.

11. Security

We use access controls, private file storage, signed webhooks, and established service providers to protect information. No online service can guarantee perfect security. Please contact us if you believe your purchase, email, or personal data has been misused.

12. Children

This site sells business tools and is not directed at anyone under 18.

13. Changes

The current version lives on this page. We will update the date above when the policy changes materially.