Privacy Policy

Last updated: 27 October 2026. Version: 1.2.

1. Who handles your information

Lutnoir is a Japan-based independent digital store at lutnoir.com. The individual or small business operating the store decides how customer information is used for the purposes described below. Lutnoir is a trading name; it is not a claim of incorporation.

Contact [email protected] for privacy questions and rights requests, including requests for the operator's legal identity and address, which we supply without delay where a request-based disclosure arrangement is permitted. Seller information is also described in our Japanese commercial disclosure. Wherever law requires controller identity, address or representative information to be supplied directly, those requirements take priority over that arrangement.

This Policy concerns the store and its order/support communications. “Payment Partner” means the processor or reseller identified for your checkout. Stripe processes a sale by Lutnoir; when Paddle is Merchant of Record, Paddle is the transaction seller. This Policy does not replace either partner's own privacy notice. The relevant partner is determined by your transaction; listing both does not mean both receive every purchase.

2. What information is involved

We ask for an email address to deliver your Order. We do not send marketing email because you placed an Order. You do not need a Lutnoir customer account to buy. We do not ask you to upload source footage, photographs or identity documents to purchase LUTs.

Email is the customer contact field we request; it is not the only data involved in a web transaction. The following limited information also arises when you use the store:

We use purchase information for the store purposes described here, without building advertising profiles or obtaining contact lists. Sensitive personal information is not a normal purchase requirement. Payment providers separately handle their own fraud checks and the information described in their notices.

3. Why we use information

We use information to accept and fulfill your purchase, generate or restore download access, send the order email, assist with installation, handle refunds and payment disputes, secure the store, maintain required transaction records and answer privacy requests. We do not add your purchase email to marketing simply because you placed an Order.

Where the EU GDPR or UK GDPR applies, the relevant bases are:

• Contract and steps requested before purchase: checkout, payment confirmation, file delivery, access recovery and order-related help.
• Legal obligations: applicable tax/accounting retention, legally required consumer remedies and disclosures, and compliance with lawful regulatory requests. For this GDPR ground, we rely on applicable EU/UK legal duties. Japanese recordkeeping requirements are handled on an appropriate separate basis, including legitimate interests where applicable and balanced against your rights.
• Legitimate interests: proportionate security, fraud prevention, fault investigation and handling or defending legal claims, after considering your rights. Our interest is operating a reliable, secure store and resolving genuine disputes.

Agreeing to the Terms of Sale does not authorize unrelated uses of your information. If a new use requires consent, you can make that choice separately.

Providing the order email and the payment information required by the relevant Payment Partner is necessary to complete and deliver a purchase. Without it, we may be unable to take payment, send the order link or verify access. We do not make solely automated decisions with legal or similarly significant effects about you as a store policy; the Payment Partner may run its own checks under its notice. Contact us for human review of an order issue within our control; Paddle's own processing requests may also be made directly to Paddle.

4. Providers and limited disclosures

We use the following providers for the store:

We share only information needed for the relevant purpose. Our email provider and the mail services that route your messages necessarily process communications. We do not promise that provider processing is confined to Japan.

Paddle and Lutnoir each have responsibilities for the information they control. For a request involving Paddle's payment or tax records, its notice explains how to contact it directly. A request to Lutnoir does not automatically delete records Paddle must retain. This does not prevent you asking us for help identifying the appropriate contact.

We may also disclose necessary records to competent authorities when legally required, or to professional advisers and payment providers when needed to resolve a specific legal, accounting or payment matter. This is not permission for unrelated marketing. We do not sell personal information or share it for cross-context behavioral advertising. Providers' own notices explain their separate processing and how you can contact them.

5. Cookies and browser storage

The store uses browser storage to remember your cart and display theme on your device. Cloudflare and the relevant Payment Partner may use cookies or comparable technologies for payment, authentication, security and delivery. The checkout connects to the relevant Payment Partner to process your transaction and protect against misuse. Their privacy notices describe their handling of technical and device information.

You can clear local storage or manage cookies through your browser settings. Clearing storage can reset the cart or display preference; blocking technologies needed for payment or security can affect checkout. We do not use your cart or theme preference to build an advertising profile. If we change these practices, we will update this Policy and provide any choice required by law before the new collection begins.

6. Where information is processed

We operate from Japan. Cloud hosting, email and payment services can process information in other countries, including the United States and countries where the providers and their approved service partners operate. Overseas rules may differ from those where you live.

For transfers subject to legal restrictions, we use the applicable legal basis or safeguards, such as an applicable adequacy arrangement for the specific recipient and transfer, or appropriate contractual safeguards and any necessary additional measures. An adequacy finding concerning Japan does not automatically authorize every onward transfer to another country. Applicable Japanese overseas-processing requirements and supplementary protections for EU/UK-origin data also apply.

You can request information about the safeguards relevant to your information and a copy or description where legally available by emailing [email protected].

7. Retention and security

We retain order and payment-related records for as long as needed to fulfill and verify purchases, provide access/support, meet applicable accounting and tax duties and handle claims. Support messages are retained while needed to resolve the issue and for an appropriate follow-up or claims period. Technical and security logs are retained according to the actual service configuration and legitimate diagnostic/security need; longer retention may be necessary for a specific incident or legal requirement.

We determine retention using the record's purpose, applicable statutory periods, outstanding claims and the need to verify your purchase for future access. When retention is no longer necessary, we delete information or make it non-identifying through the applicable process, subject to legal requirements and provider backup cycles. Ask us about the period or criteria relevant to your Order.

We use safeguards appropriate to the nature of the information and restrict use to the purposes described. No internet service can guarantee perfect security. Please keep order links private and contact us promptly if access has been exposed. A security incident will be assessed and notified where applicable law requires it.

8. Your rights and how to use them

Email [email protected] with the subject “Privacy request” and describe what you need. You do not need to create an account. We may ask for proportionate verification, normally using the purchase email and an order reference. Do not send a passport, full card number or unnecessary sensitive information. If another person makes a request for you, we may need to confirm their authority.

Rights depend on the law applying to you and can have exceptions. If we must keep a record, cannot verify a request or cannot grant it fully, we will explain the relevant reason and any available complaint route. Exercising privacy rights does not itself forfeit consumer remedies. Deleting essential order evidence can affect our ability to verify access; we will explain that practical effect rather than demanding you abandon your rights.

EU / EEA and United Kingdom

Where applicable, you can request access, correction, erasure, restriction and a portable copy of eligible data; object to processing based on legitimate interests; and withdraw consent for consent-based processing. You can complain to your local data protection authority or, in the UK, the Information Commissioner's Office. You need not contact us before approaching the regulator. GDPR requests are normally answered within one month; permitted extensions require notice and reasons within the initial period.

California

If the CCPA, as amended by the CPRA, applies to our business and your information, you may have rights to know/access, obtain a portable copy, delete, correct, opt out of sale or sharing, limit qualifying uses of sensitive information, and receive equal treatment when exercising those rights. Authorized agents may act with appropriate authority. The applicable thresholds and circumstances determine whether these additional rights apply to your information.

Our data categories, sources, purposes and recipient categories are listed in Sections 2–4. We do not sell or share personal information for cross-context behavioral advertising and do not use sensitive personal information for purposes that require a limitation choice. We do not knowingly sell or share information of children under 16. We honor Global Privacy Control where legally required and will provide the required notice and choices before introducing a new practice. Applicable verifiable CCPA requests are normally answered within 45 days, with notice for a permitted extension. We do not charge or discriminate merely because you make a valid request.

Japan

Under the Act on the Protection of Personal Information (APPI), where the statutory conditions are met you may request notification of purposes of use, disclosure of retained personal data and relevant third party provision records, correction, addition or deletion of inaccurate information, and cessation of use or third party provision. These rights have defined grounds and exceptions; there is no unconditional right to erase every required transaction record. Contact us with questions or complaints, or consult the Personal Information Protection Commission.

Other locations

We respect rights provided by other applicable privacy laws. Tell us your concern and location if needed to identify the relevant rule. No term of purchase removes a non-excludable privacy right.

9. Children

The store is intended for people able to make a lawful purchase and is not directed to children under 13. We do not knowingly seek children's personal information. If you believe a child provided information inappropriately, contact us so we can investigate and take the steps required by law. A minor needs the permission or legal capacity required by the law applying to their purchase.

10. Updates and contact

We will publish a dated revision when practices change and give any additional notice or obtain consent that applicable law requires. A change to this Policy does not itself authorize a new incompatible use of existing information.

Privacy and support contact: [email protected]. Version 1.2. Last updated: 27 October 2026.

Policy credit: The categories–purposes–rights organization was informed by Basecamp's open-source privacy policy, licensed under CC BY 4.0. This Policy is independently written and narrowed to Lutnoir's operations; Basecamp does not endorse it. Provider policies have not been copied.