Privacy policy

The company details on this page are still being added.

This policy explains how the company that runs Lugroom (“Lugroom”, “we”) handles personal data. It covers dealers and their teams who use Lugroom, buyers and visitors who use a store built on Lugroom, and visitors to our own website.

Who is responsible for your data

• Dealers and their teams: we decide how account details are used, so we are the controller of them.
• Buyers, clients and storefront visitors: each store decides why and how it uses the details you give it (for example when you send an enquiry, make an offer, buy a piece or consign one), so the store is the controller and Lugroom processes the data on its behalf, under our data processing terms. The store's name and contact details are on its storefront. For requests about that data, contact the store first.

What we collect

• Account details for dealers and staff: name, email, password (kept only as a one-way hash), two-factor settings, role in each store, and sign-in records.
• Store records that dealers enter or that arrive through their storefront: pieces and their photos; clients and buyers (name, email, phone, notes, what they bought and are interested in, wish lists, newsletter choices); enquiries, offers and viewing requests; sales, deposits, consignments, memos, shipping and tracking details; and reviews.
• Large cash sales: where the law requires a store to check a buyer's identity, the store records the type of ID, its last four characters and the buyer's address. Lugroom never stores the full ID number or a copy of the document.
• Storefront visits: we count visits to each store per day using a salted, one-way hash of the visitor's network address and browser, which can't be turned back into either. We don't store the address itself, and we don't build profiles of visitors.
• Technical logs: request times, pages, status codes and error details, used to run and protect the service.

Why we use it, and on what basis

• To provide the service you or your store asked for: running accounts, storefronts and records, and sending the emails involved (necessary for our contract, or done on the store's instructions).
• To keep Lugroom secure, prevent fraud and abuse, and fix problems (our legitimate interest in a safe, working service).
• To send marketing, such as a store's newsletter or new-arrival and price alerts, only to people who agreed, and you can unsubscribe from every such email with one click (consent).
• To meet legal obligations, such as keeping records the law requires or answering lawful requests from authorities.

We don't sell personal data, share it for cross-site advertising, or use it to train AI models.

Cookies

We use only the cookies the service needs: a session cookie that keeps you signed in, a cookie that remembers a device you chose to trust for two-factor sign-in, and a cookie on password-protected storefronts once you have entered the password. If you choose a light or dark look, your browser remembers it on your device. We don't use advertising or third-party tracking cookies, so there is nothing to opt out of.

Who we share it with

We use these service providers, under contracts that require them to protect the data and use it only for us:

• Amazon Web Services, Inc.: Hosting, database, file storage, content delivery, security filtering and sending email (Amazon SES). Location: United States (US East, Ohio); content delivery from AWS locations worldwide.
• Anthropic, PBC (Claude, through Claude Platform on AWS): The AI storefront designer: drafts storefront text and layout from what a dealer asks it to design. It is not sent client or buyer records.. Location: United States.

A store may also connect services of its own, such as a marketplace or Google (to show its rating, which sends Google only the store's place ID). Those services handle data under their own terms. We also disclose data when the law requires it, to protect people's safety or our rights, or to a company that takes over the service (which must honour this policy).

International transfers

Lugroom's data is stored in the United States. Where data comes from the UK, the European Economic Area or Switzerland, we rely on the European Commission's standard contractual clauses (and the UK and Swiss equivalents) or another lawful transfer mechanism.

How long we keep it

Each store sets how long it keeps its clients' details, within limits we set. By default: people who enquired but never bought are deleted 24 months after the store was last in touch; a buyer's name and contact details are removed from sale records after 7 years (the store keeps the figures for its accounts); the text of enquiries is removed after 24 months. Anyone who agreed to hear from a store, or who has an open wanted-list request, is kept until they unsubscribe or close it. Someone a store holds a piece for, or owes money to, is kept until that is settled.

Account details are kept while the account is open. When a store closes, everything is taken offline at once and deleted 30 days later. Deleted data can remain in backups for up to 90 days before it is overwritten. Technical logs are kept for up to 90 days.

How we protect it

Each store's records are isolated from every other store's at the database level. Data is encrypted in transit and at rest. Staff sign in with two-factor authentication, access is limited to the people a store invites, and private figures such as purchase and sold prices are shown only to the store's owners and admins and never on public pages.

Your rights

Depending on where you live, you may have the right to:

• access the personal data held about you and receive a copy;
• have it corrected, or deleted;
• object to or restrict how it is used, and withdraw consent at any time (for emails, use the unsubscribe link);
• receive it in a portable format;
• complain to your data protection authority (for example the ICO in the UK, or your local authority in the EU).

California residents also have the right to know what we collect, to delete it, to correct it, and not to be treated differently for using these rights. We don't sell or share personal information as those terms are defined in California law.

If you bought from or contacted a store, ask the store: it can see, correct, export and erase your details. If the store doesn't respond, or for your own Lugroom account, contact us at our support page. We answer within one month (45 days for California requests), and may ask you to confirm who you are first.

Children

Lugroom isn't meant for anyone under 18, and we don't knowingly collect their data.

Changes

If we change this policy in a way that matters, we will update the date above and tell account holders by email before the change takes effect.

Contact

the company that runs Lugroom. Privacy questions and requests: our support page.