Privacy Policy

1. Overview

ILLUMA COM (“we”, “us”, “our”) runs an ecommerce platform and services for parts and equipment businesses. This policy explains what information we collect, how we use it, who we share it with, how we protect it, and the choices you have. It covers three groups of people: merchants (the dealers and sellers who use our platform), their customers (shoppers whose order details are processed through a merchant’s store or connected marketplace account), and visitors to our website. A merchant’s store may have its own privacy policy, which governs how that merchant uses its customers’ information.

2. Information we collect

• Merchant account information: name, business name, email, phone, business address and billing details. Subscription payments are processed by Stripe.
• Product and inventory data: catalogs, prices, images, fitment, part numbers and stock levels that merchants upload, import or sync.
• Order information: items, prices, shipping addresses and fulfillment status for orders from a merchant’s website and connected marketplaces.
• Marketplace account data: when a merchant connects Amazon, eBay or Walmart, we receive what those marketplaces’ official APIs provide for the features the merchant turns on, such as listings, inventory, orders, buyer shipping details for orders the merchant fulfills, and financial reports.
• Payment details: card payments are handled by Stripe. We never receive or store full card numbers or security codes. We keep only the card brand, the last four digits and the expiry date with the order record.
• Website and usage data: IP address, browser and device type, pages visited, and the cookies described in section 9.
• Messages you send us, for example through our contact form.

3. How we use information

We use information to provide and run the platform: operating storefronts, syncing products, inventory and orders across sales channels, routing orders, printing shipping labels, repricing listings and producing reports for the merchant. We also use it to communicate with merchants about their accounts, to answer questions, to keep the platform secure and prevent fraud, and to improve our products.

We do not sell personal information. We do not use merchant or shopper data for advertising or to train machine-learning models. Data from a merchant’s marketplace accounts is used only to provide the services that merchant authorized, and is never combined across merchants.

4. Marketplace data

Merchants connect marketplace accounts through each marketplace’s official authorization (Amazon Selling Partner API, eBay APIs, Walmart Marketplace API). Buyer names, shipping addresses and phone numbers from Amazon and eBay orders are stored encrypted with AES-256-GCM. The encryption is bound to the merchant’s account, so the data cannot be decrypted in another merchant’s context. We record each time a person views decrypted buyer details. Buyer information is used only to fulfill the order it came with, and is shared only as fulfillment requires (for example, with a shipping carrier or a supplier that ships the order).

5. Who we share information with

We share information only with service providers that help us run the platform, with the marketplaces and services a merchant chooses to connect, or when the law requires it.

Services a merchant connects: Amazon, eBay, Walmart, ShipStation, QuickBooks and the merchant’s own suppliers (for example by SFTP, EDI or email). When a merchant drop-ships an order, the supplier receives the shipping details it needs to deliver that order.

We may also disclose information when required by law, or to protect the rights, property or safety of ILLUMA COM, our merchants or others.

6. How we protect information

• Data is stored in the United States with DigitalOcean. Our main platform database runs on DigitalOcean’s managed database service, which encrypts data at rest and in transit. All connections to our website and platform use HTTPS.
• Amazon and eBay buyer details receive an extra layer of encryption, described in section 4.
• Merchants’ data is kept in shared databases and separated by merchant account. The platform enforces that separation on every request.
• Dashboard users must set up two-factor authentication with an authenticator app before using the dashboard. The only exceptions are documented service accounts. Our administrative and infrastructure accounts use multi-factor authentication.
• Card details are entered in Stripe’s secure payment form and never touch our servers.
• An independent third-party penetration test was performed on our live platform. Every finding was fixed and confirmed fixed by a follow-up test.
• The managed database service takes daily backups and can restore to any point in the previous seven days.
• We keep a documented incident response plan. If we confirm an incident involving marketplace data, we notify the affected marketplace within 24 hours, and we notify affected merchants promptly.

No system is perfectly secure, and we can’t guarantee absolute security, but we work to protect the information entrusted to us.

7. How long we keep information

8. Your rights

Depending on where you live, you may have the right to access, correct or delete your personal information, to restrict or object to how it’s used, to receive a copy in a portable format, and to withdraw consent. Merchants can export their product catalog and download order, customer and other lists as CSV files from the dashboard. For a full export, or to delete your account, contact us. Shoppers who bought from a store running on ILLUMA COM should contact that store first. We’ll help the merchant respond, and you can also contact us directly. We respond to requests within 30 days and don’t charge for them.

9. Cookies and analytics

We use essential cookies for sign-in, sessions, shopping carts and security. Our hosting and CDN providers may set a cookie to tell people from bots. When you sign in to the ILLUMA COM dashboard, we also set a small cookie on illumacom.co that only remembers you’re signed in, so this website can show a Dashboard button. It holds no personal information. The ILLUMA COM dashboard also remembers whether you prefer light or dark mode with a small cookie on app.illumacom.co, which also holds no personal information. We do not currently use analytics or advertising cookies on this website.

Stores that run on ILLUMA COM are operated by merchants, who choose their own analytics. Those stores support a cookie consent banner and Google Consent Mode, and they honor the Global Privacy Control signal for advertising. The merchant’s own policy describes its choices. You can also control cookies through your browser settings.

10. Children

Our platform is for business use and isn’t directed at anyone under 18. We don’t knowingly collect personal information from children, and we delete it promptly if we learn we have.

11. Changes to this policy

We may update this policy as our practices or the law change. We’ll update the date at the top of this page and email merchants about material changes.

12. Contact us

ILLUMA COM
Matthew LeBrun, Founder & CEO
Email: [email protected]
Phone: (888) 384-8018
Coarsegold, California