LUMI SHOWS

PRIVACY POLICY - MEXICO

Version

1.0

Effective Date

July 21, 2026

Data Controller

Alexes Navarro Garcia, an individual operating under the trade name Lumi Shows

Business Address

273 E Jackson St, Apt A, Rialto, CA 92376, USA

Privacy Contact

soporte-mx@lumishows.com

Account Deletion

https://lumishows.com/account-deletion

Controlling Language

Spanish

1. Identity and Address of the Data Controller

This Privacy Policy and Comprehensive Privacy Notice explains how Alexes Navarro Garcia, an individual operating under the trade name Lumi Shows ("Lumi," "we," "us," or "our"), with an address at 273 E Jackson St, Apt A, Rialto, CA 92376, USA, processes personal data collected through the Lumi Shows mobile application, websites, live-commerce marketplace, auctions, Buy Now purchases, seller tools, messaging, Coins, digital gifts, support, and related services (the "Platform").

This Notice applies to buyers, sellers, streamers, viewers, account holders, and visitors using the Mexico market. Lumi is responsible for processing it performs directly; sellers, Stripe, carriers, and other third parties may be independent controllers for their own processing.

By using the Platform and providing personal data, you acknowledge this Notice. Where Mexican law requires express consent, Lumi will request it through a checkbox, verification flow, device permission, or other affirmative action.

1.1 No Sale of Personal Data

Lumi does not sell personal data. The current implementation does not use confirmed advertising identifiers or third-party advertising SDKs. The transfers and disclosures described in this Notice are made to operate the Platform, complete transactions, provide security and support, comply with law, or pursue compatible purposes.

1.2 Adults Only

Lumi is intended only for people who are at least eighteen (18) years old and does not knowingly permit accounts for minors.

2. Personal Information We Collect

2.1 Account and Profile Information

Name, display name, username, email address, phone number, password hash, role, language, region, currency, date of birth or adult attestation, account status, verification status, and authentication or recovery information.

Profile photo, banner, biography, seller store name, social or profile fields, follows, favorites, and other profile settings.

2.2 Seller, Identity, and KYC Information

Seller application information, legal consents, business information, tax information, seller origin address, payout status, and risk-review information.

Government identification, identity-document images, proof of address, selfie or liveness information when enabled, document metadata, and information used to verify identity, age, ownership, eligibility, fraud risk, or legal compliance.

2.3 Commerce and Financial Activity

Listings, product descriptions and media, auctions, bids, Buy Now orders, purchases, cancellations, refunds, disputes, chargebacks, shipment status, seller earnings, settlement records, wallet activity, Coins, digital gifts, funded-balance provenance, and related transaction history.

Payment and payout references such as Stripe customer, PaymentIntent, charge, refund, dispute, Connect account, payout, transfer, and status identifiers.

Lumi does not appear to receive or store complete payment-card numbers, card security codes, or complete bank credentials. Those details are entered into and processed by Stripe or another authorized payment provider. Lumi may receive limited identifiers, status, last-four digits, card brand, or similar payment metadata.

2.4 Shipping and Fulfillment Information

Recipient and sender names, phone numbers, shipping and billing addresses, delivery instructions, parcel details, tracking information, label information, carrier events, and evidence of delivery or handoff.

2.5 User Content and Communications

Live video and audio, live-chat messages, private or support messages, comments, reactions, product photos and videos, reports, blocks, moderation records, dispute evidence, support tickets, and communications with buyers, sellers, or Lumi.

2.6 Device, Network, and Technical Information

IP address, user agent, device or hashed device identifier, operating system, app version and build, session and authentication records, cookies, local storage, security logs, audit events, push-notification token, crash or error information generated by the Platform, and timestamps.

The current Platform audit did not confirm use of IDFA, Android Advertising ID, cross-app tracking, third-party advertising analytics, or a third-party crash-reporting SDK.

2.7 Device Permissions

Camera and microphone access when you create listings, upload media, verify identity, or host a live stream.

Photo library, file, or document access when you choose media or verification documents.

Notification permission and push token when you enable push notifications.

Lumi does not collect precise device location based on the current implementation. Addresses you enter for shipping, billing, seller origin, or identity verification are still location-related personal information.

2.8 Information From Third Parties

Google sign-in information, such as Google account subject identifier, email, name, and profile image, when you choose Google authentication.

Payment, fraud, dispute, payout, and identity information from Stripe or another payment provider.

Streaming, notification, shipping, carrier, email, security, and infrastructure events from service providers used to operate the Platform.

3. How We Use Personal Information

Create and secure accounts; authenticate users; provide account recovery; maintain sessions; and prevent unauthorized access.

Operate live streams, auctions, bids, Buy Now purchases, listings, chat, follows, notifications, Coins, digital gifts, seller tools, and support.

Process payments, refunds, disputes, seller settlements, payouts, shipping, labels, tracking, taxes, and transaction records.

Verify age, identity, seller eligibility, payment ownership, business information, tax information, and risk indicators.

Detect and investigate fraud, counterfeit goods, stolen goods, shill bidding, account takeover, payment abuse, harassment, safety concerns, and policy violations.

Moderate user-generated content, enforce Platform rules, resolve disputes, respond to support requests, and protect buyers, sellers, Lumi, and third parties.

Maintain, debug, secure, measure, and improve Platform performance and reliability.

Send transaction, account, security, policy, support, live-event, reminder, and push communications.

Comply with legal, tax, accounting, regulatory, court, law-enforcement, payment-network, and contractual obligations.

4. Payments, Stripe, and Seller Payouts

Lumi uses Stripe and may use other authorized payment providers to process purchases, winning auctions, refunds, disputes, seller onboarding, settlement instructions, and payouts. Stripe acts as an independent service provider or separate controller for portions of its processing under its own privacy notice and terms.

Lumi may send Stripe account details, transaction amounts, order identifiers, customer identifiers, email, billing or shipping information, fraud signals, seller information, and other data necessary to process or protect a transaction. Stripe may return payment status, risk results, charge, refund, dispute, payout, or Connect information.

Stripe is not the seller of marketplace products and does not determine product authenticity, condition, fulfillment, or entitlement to a marketplace remedy. Lumi and sellers remain responsible for their respective obligations.

5. Live Streaming, Notifications, Shipping, and Other Providers

Depending on enabled features, Lumi may use the following categories of service providers:

Amazon Web Services and Amazon IVS for live-video and live-audio streaming, playback, storage, and related infrastructure.

Expo notification services and device platform services for push-token registration and delivery of notification payloads. Notification content may include account, transaction, live-event, support, or message information.

Google for optional Google sign-in and related identity verification.

EasyPost, carriers, and logistics providers when shipping rates, labels, tracking, or delivery services are enabled.

Email and SMTP providers for verification, password recovery, support, and operational notices.

Hosting, database, storage, security, content-delivery, monitoring, and professional service providers necessary to operate and protect the Platform.

A provider may process information in another state or country. Lumi requires service providers to use information only for authorized services and to provide appropriate protection, subject to their own legal obligations.

6. When We Disclose Information

6.1 Buyers, Sellers, and Public Users

Public profile information, listings, product media, live streams, public chat, reactions, and seller information may be visible to other users. Sellers receive buyer, order, delivery, and communication details reasonably necessary to fulfill transactions. Buyers receive seller, listing, shipment, and transaction information reasonably necessary to complete and evaluate a purchase.

6.2 Service Providers

We disclose information to payment, streaming, push-notification, authentication, shipping, email, hosting, storage, security, moderation, support, and professional service providers as necessary to perform services for Lumi.

6.3 Safety, Legal, and Enforcement

We may preserve or disclose information when reasonably necessary to comply with law, legal process, tax or regulatory requirements, court orders, lawful government requests, payment-network rules, fraud investigations, intellectual-property claims, emergencies, or to protect the rights, property, safety, or integrity of users, sellers, third parties, or Lumi.

6.4 Business Changes

Information may be disclosed as part of a financing, reorganization, sale, merger, acquisition, bankruptcy, or transfer of all or part of the Platform, subject to applicable law and appropriate confidentiality protections.

7. Cookies, Sessions, Local Storage, and Similar Technologies

Lumi uses account sessions, authentication tokens, cookies, and local storage to keep users signed in, preserve language or region preferences, secure transactions, maintain cart or navigation state, prevent fraud, and operate the website and mobile application.

Lumi does not currently use confirmed advertising cookies or cross-site behavioral advertising technologies. Browser or device settings may allow you to limit cookies, local storage, notifications, camera, microphone, or photo access, but disabling them may prevent related features from working.

8. Data Retention

Lumi retains personal information only for as long as reasonably necessary for the purposes described in this Policy, to provide the Platform, and to satisfy legal, tax, accounting, payment, fraud-prevention, safety, dispute, chargeback, moderation, and recordkeeping obligations.

Retention depends on the type of information and why it is needed. Account credentials, public profile content, active sessions, push tokens, and content not required for retention should be deleted or de-identified after a valid deletion request. Transaction, payment, tax, seller, KYC, fraud, dispute, safety, and audit records may be retained after account deletion when reasonably necessary or legally required.

When retention is no longer necessary, Lumi will delete, de-identify, aggregate, or securely isolate the information. De-identified or aggregated information that cannot reasonably identify an individual may be retained.

9. Account and Data Deletion

You may initiate account deletion from the account or privacy settings in the Lumi mobile application. You may also request deletion without reinstalling the app by visiting https://lumishows.com/account-deletion or contacting soporte-mx@lumishows.com.

After verifying the request and resolving any steps that must occur first, Lumi will delete the account and associated personal information that Lumi is not legally or operationally required to retain. Temporary suspension, deactivation, or freezing is not treated as completed deletion.

Certain records may remain where necessary for legal compliance, taxes, accounting, completed transactions, payment disputes, chargebacks, fraud prevention, marketplace safety, seller obligations, intellectual-property claims, law-enforcement requests, or the establishment, exercise, or defense of legal claims. Retained records will be limited to those purposes and access will be restricted.

Deletion may not remove copies of public or transaction communications already received or lawfully retained by another user, seller, payment provider, carrier, or other independent recipient. Lumi will request deletion from service providers when applicable and reasonably possible.

10. Security

Lumi uses administrative, technical, and organizational safeguards designed to protect personal information, including authenticated access, role-based permissions, HTTPS/TLS transmission, session controls, risk review, restricted KYC and support access, and provider security controls.

No system is completely secure. You are responsible for protecting your password and devices and for notifying Lumi promptly of suspected unauthorized access. Lumi will investigate and provide notices of qualifying security incidents as required by applicable law.

11. Choices, ARCO Rights, and Withdrawal of Consent

11.1 Access, Rectification, Cancellation, and Objection

Under applicable Mexican law, you may request access to personal data; rectification of inaccurate or incomplete data; cancellation when data is no longer necessary or is processed improperly, subject to applicable blocking or retention periods; and objection to certain processing based on legitimate grounds.

You may also request portability when legally applicable, limit the use or disclosure of personal data, withdraw consent for processing that depends on consent, and obtain information about data transfers.

11.2 Submitting a Request

Send a request to soporte-mx@lumishows.com or use https://lumishows.com/account-deletion. Include your name, account or associated email, the right you wish to exercise, a description of the data, and a method for receiving a response. Lumi may request reasonable information to verify identity and authority.

Withdrawal or cancellation is not retroactive and may be limited when processing is necessary for a legal relationship, transaction, legal duty, fraud prevention, safety, taxes, accounting, disputes, chargebacks, or defense of rights.

11.3 Permissions and Communications

You may change notifications, camera, microphone, photos, and file permissions through device settings. You may update account information through the app or support. Removing a permission may prevent the related feature.

12. Domestic and International Transfers

Lumi may transfer or disclose personal data to buyers, sellers, Stripe, AWS/IVS, Expo, Google, EasyPost, carriers, email providers, hosting, security, support, advisers, authorities, and other recipients described in this Notice when necessary for the stated purposes, a legal relationship, compliance obligations, protection of rights, or another transfer permitted without additional consent.

Personal data may be processed in the United States or other countries. Lumi uses reasonable contractual, technical, and organizational safeguards. Where law requires consent for a specific transfer not covered by an exception, Lumi will request it.

13. Changes to This Policy

Lumi may update this Policy to reflect changes in law, Platform features, providers, data practices, or security controls. The current version will identify its effective date and version number. Material changes may be communicated in the app, on the website, by email, or through renewed consent when required.

14. Privacy Contact

Questions, ARCO requests, withdrawal, limitation, complaints, and deletion requests: soporte-mx@lumishows.com.

Lumi ShowsAttn: Mexico Privacy273 E Jackson St, Apt ARialto, CA 92376United States

You may also contact the competent Mexican data-protection authority if you believe your rights have been violated.