Website Privacy Policy

Northland Creative Wonders, LLC ("NCW," "we," "us," or "our") respects your privacy. This policy explains what information we collect when you visit our website for Lumen, the Illuminated GM Screen, how we use it, who we share it with, and the choices available to you.

For details on the specific cookies we use and how to manage them, see our Cookie Policy.

We Do Not Sell Your Personal Data

We have never sold, rented, or traded our customers' or visitors' personal data to third parties, and we have no plans to. We do share limited, purpose-specific event data with advertising vendors (currently Reddit) so we can measure whether our own ads are working. Under California's CCPA/CPRA and similar US state laws, this type of cross-context behavioral advertising is defined as "sharing" and is treated the same as a "sale," even when no money changes hands — which is why you will see opt-out language and a Do Not Sell or Share My Personal Information link in our footer. You can opt out at any time using that link, via the Cookie Settings link in the footer, or by enabling the Global Privacy Control signal in your browser.

1. Information We Collect

We do not collect personally identifiable information from people who simply visit or browse our website, beyond what is needed to deliver the site and measure our own advertising. The information we do collect falls into these categories:

Aggregate website analytics (Plausible)

We use Plausible Analytics to understand how visitors find and use our site. Plausible is a cookieless, privacy-focused analytics service. It does not use cookies, does not set persistent identifiers, and does not collect personal information as defined by GDPR. It records aggregate data such as:

• Country of origin (derived from IP and then discarded)
• Device type and browser version
• Pages viewed and referring source

Because Plausible is cookieless and processes no personal information, it runs without requiring your consent and is not controlled by our cookie banner. Review Plausible's privacy policy here: https://plausible.io/privacy.

We retain Plausible analytics data for no more than 12 months.

Google Analytics 4 (with Consent Mode v2)

We use Google Analytics 4 (GA4) as an additional analytics service. GA4 uses cookies (such as _ga and _ga_<id>) to measure site usage and conversions. We have implemented Google Consent Mode v2, which means:

• If you decline analytics cookies, GA4 does not set cookies or identifiers. Google may still receive aggregate, non-identifying signals used only for modeling overall trends.
• If you accept, GA4 operates normally and data is tied to a browser-level identifier.

You can opt in or out at any time via the cookie banner or the Cookie Settings link in the footer of every page.

Advertising and conversion measurement (Reddit Pixel)

We run advertising campaigns on Reddit and use the Reddit Pixel to measure whether those ads are reaching interested people and leading to purchases. The Reddit Pixel sets cookies (such as rdt_uuid) and sends event data — including page views, add-to-cart, and purchase events — to Reddit when the ads manager attributes them to a Reddit ad click.

We may add additional advertising vendors in the future (such as Meta or Google Ads). When we do, we will update this policy and re-prompt you for consent before those vendors are activated.

The Reddit Pixel only loads if you have granted consent for Marketing cookies via the cookie banner. You can change this choice at any time via the Cookie Settings link in the footer. California, Colorado, Connecticut, Texas, Oregon, and Montana residents can also opt out via the Do Not Sell or Share My Personal Information link in the footer, or by enabling the Global Privacy Control signal in their browser (see Section 5).

We may also share hashed (anonymized) email addresses from customers with advertising platforms for audience targeting (so our ads reach people similar to existing customers). This data is not retained by those platforms beyond the audience match.

Newsletter subscription

You can sign up for our newsletter in three places: the homepage, during Stripe checkout when you purchase a product, or during the first run of the Lumen app. In every case the newsletter opt-in is explicit and optional — we do not pre-check the box, and you can buy a product or install the app without subscribing. When you sign up, we collect:

• Name
• Email address

How we confirm your subscription depends on where you signed up:

• Homepage form: We send you a confirmation email with a link you must click to activate the subscription (double opt-in). This protects against someone else entering your email address.
• Stripe checkout or Lumen first-run: Checking the newsletter opt-in box during a deliberate purchase or installation is treated as confirmed consent at that moment, and we activate the subscription immediately. No confirmation email is required in these flows, because the opt-in is already made within an authenticated, intentional action.

We use this information only to send product updates, announcements, and marketing communications. You may unsubscribe at any time by clicking the "unsubscribe" link in any email we send.

We do not combine newsletter data with analytics or advertising data.

Purchases (Stripe)

We use Stripe to process purchases. If you buy a product on this website, Stripe collects:

• Name
• Email address
• Phone number (optional)
• Credit card number
• Expiration date
• CVV
• Billing address (including postal code)

We do not see nor store your credit card information on our servers. We do receive and store your email address from Stripe for order fulfillment and license delivery. Stripe's privacy policy is available at https://stripe.com/privacy.

2. How We Use Your Information

We use the information we collect for:

1. Improving website performance — analyzing aggregate and consented analytics data to optimize user experience.
2. Measuring advertising effectiveness — understanding which ads lead to purchases so we can allocate our advertising budget efficiently.
3. Communications — sending newsletters, product updates, and transactional messages about your purchases.
4. Fulfilling purchases — generating license keys, delivering downloads, and providing customer support.

As noted at the top of this policy, we do not sell your personal data. The only third parties we share data with are processors acting on our behalf: Plausible and Google for analytics, Reddit for advertising measurement, Stripe for payments, and similar service providers. We never share your data for third parties' own marketing or resale purposes.

3. Cookies and Tracking Technologies

Our website uses three categories of cookies:

• Strictly Necessary — required for the site to function. These include your session, your cart, your stored cookie-consent choice, and anti-forgery tokens. These cannot be turned off.
• Analytics — used by Google Analytics 4 to measure site usage. Optional.
• Marketing — used by the Reddit Pixel (and future advertising vendors) to measure ad effectiveness. Optional.

Plausible Analytics is cookieless and is not part of the banner.

On your first visit, we show a cookie banner asking for your consent. You can:

• Accept All — allow analytics and marketing cookies.
• Reject All — deny everything except strictly necessary cookies.
• Customize — choose each category individually.

You can change your choice at any time via the Cookie Settings link in the footer of every page. The choice is stored in a cookie for 12 months, after which we will ask again.

For the complete list of cookies, including names, providers, purposes, and retention periods, see our Cookie Policy.

4. Legal Basis for Processing (EU/UK Residents)

• Consent: For analytics cookies, marketing cookies, and newsletter subscriptions. You may withdraw consent at any time.
• Legitimate Interest: For aggregate, cookieless website analytics (Plausible) and for audience targeting using hashed email addresses.
• Contractual Necessity: For completing purchases and providing customer support.

5. Your Rights

EU, UK, and Canadian residents

You may:

• Access the personal data we hold about you
• Correct any inaccuracies
• Withdraw consent (for newsletter or cookies)
• Request deletion of your data
• Object to processing based on legitimate interest

We may ask you to verify your identity before fulfilling requests. We respond within 30 days.

California, Colorado, Connecticut, Texas, Oregon, Montana, Virginia, and Utah residents

Depending on your state, you have the right to:

• Know what personal information we collect, use, disclose, or share
• Delete personal information we have collected
• Correct inaccurate personal information
• Opt out of the sale or sharing of personal information, including cross-context behavioral advertising (the Reddit Pixel and similar vendors)
• Limit the use of sensitive personal information (we do not collect sensitive personal information from website visitors, so this right has no data to apply to)

We honor the Global Privacy Control (GPC) browser signal as a valid opt-out of sale and sharing. If your browser sends GPC, we automatically treat you as opted out of marketing cookies and ad-related sharing for as long as the signal is active.

To exercise your rights, you can:

• Use the Cookie Settings link in the footer to adjust your cookie choices.
• Use the Do Not Sell or Share My Personal Information link in the footer for a one-click opt-out of advertising-related sharing.
• Contact us directly for any other request (see Section 10).

We do not discriminate against residents who exercise these rights.

6. Data Transfers

Your data may be processed in countries outside your home jurisdiction (including the United States) under GDPR standard contractual clauses and other lawful transfer mechanisms.

7. Data Retention

• Newsletter data: Retained until you unsubscribe or request deletion.
• Analytics data (Plausible): Retained up to 12 months, then deleted.
• Analytics data (Google Analytics 4): Retained per GA4's configured retention period (currently 14 months, the shortest available).
• Advertising event data (Reddit Pixel): Retained per Reddit's retention policies; we do not hold a separate copy.
• Cookie consent records: Retained for 24 months for audit and compliance purposes.
• Credit card data: Never retained by us (handled by Stripe).
• Purchase records: Retained as required for tax, accounting, and warranty obligations.

8. Children's Privacy

Our website is not intended for children under 13. We do not knowingly collect personal data from them. If we learn we have collected data from a child under 13, we will delete it promptly.

9. Security and Limitations

We employ commercially reasonable safeguards and work with trusted vendors to protect your data. However, no system is 100% secure. Please exercise discretion when sharing personal information online.

10. Changes to This Policy

We may update this policy periodically. When we do, we will revise the "Last Updated" date. For material changes — including adding a new advertising vendor or a new category of data collection — we will notify you by email (if subscribed) and will re-prompt you for cookie consent on your next visit.

11. Contact Us

For questions or concerns about this Privacy Policy, or to exercise any of the rights described in Section 5, contact us at:

Email: support@ncwonder.us

Mailing Address: Northland Creative Wonders, LLC; c/o Privacy Request; 800 Main St. #290, Holden, MA 01520

Privacy Request Form: Lumen Contact Form