Privacy Policy

Last updated: May 22, 2026

1. Overview

DarkWave Studios LLC ("we," "us") operates Lume Scan and the Lume-Auto platform. This Privacy Policy explains what data we collect, how we use it, and your rights.

2. Data We Collect

Account Data: Email address and name (for license activation, purchase receipt, and account management via Firebase Authentication).

Payment Data: Processed exclusively by Stripe. We never see or store your credit card number, CVV, or billing details. See Stripe Privacy Policy.

Vehicle Diagnostic Data: OBD-II signals (RPM, speed, fuel flow, DTCs, etc.) are processed entirely on your device. We do not transmit, collect, or store your vehicle data on any server.

Device Activation Data: When you activate Lume Scan Pro, we store a purchase flag and tier status in Firebase Firestore linked to your email. This is used solely for license verification and entitlement management.

3. Data We Do NOT Collect

GPS location or driving routes
Vehicle identification numbers (VIN) — VIN is read by the app but stays on your device
Personal driving habits or behavior profiles
Audio, camera, or microphone data
Contact lists, call logs, or SMS
Browsing history or app usage analytics

4. How We Use Your Data

Email: Purchase confirmation, download link delivery, subscription billing notifications, and critical product updates only. No marketing spam.
License verification: Your Firebase account stores a purchase flag and tier level to unlock Pro features. No vehicle data is transmitted.
Subscription management: Stripe manages billing. We receive webhook notifications for subscription status changes (active, cancelled, expired) to update your entitlement.

5. Trust Layer Ledger (TLL)

When you generate a Condition Report, a SHA-256 hash of the diagnostic data is anchored to the Trust Layer Ledger (dwtl.io) for independent verification. Only the cryptographic hash is stored on-chain — never the underlying diagnostic data, VIN, or personal information. The hash is publicly verifiable but cannot be reversed to recover the original data.

6. Third-Party Services

Stripe: Payment processing and subscription management. See Stripe Privacy Policy.
Firebase Authentication: Account management and license gating. See Firebase Privacy.
Firebase Firestore: Entitlement storage (purchase flag, tier level, activation date). No vehicle data is stored.
Resend: Transactional email delivery (purchase confirmations, download links). See Resend Privacy Policy.
Amazon Associates / eBay Partner Network: Affiliate links to recommended adapters and replacement parts. These services may set cookies when you click affiliate links. We earn a commission on qualifying purchases — this does not affect the price you pay.

7. Data Retention

Account data is retained as long as your account is active. You may request deletion at any time by emailing support@lumescan.tech. Upon deletion, your Firebase account, entitlement records, and any associated data will be permanently removed within 30 days. Vehicle diagnostic data exists only on your device and is never retained by us.

8. Children's Privacy

Lume Scan is not directed at children under 13. We do not knowingly collect data from children. If you believe a child has provided us with personal information, contact us immediately.

9. Your Rights

Request access to your account data
Request correction of inaccurate data
Request deletion of your account and all associated data
Opt out of any communications (except critical security notices)
Export your account data in a portable format
California residents: CCPA rights apply. We do not sell personal information. You may request disclosure of data collected and its business purpose.
EU/EEA residents: GDPR rights apply where applicable. Contact support@lumescan.tech for data subject requests.

10. Security

Account data is protected by Firebase Authentication with industry-standard encryption (TLS 1.3 in transit, AES-256 at rest). Payment data is handled exclusively by Stripe (PCI DSS Level 1 certified). Vehicle diagnostic data never leaves your device. Condition Report hashes are signed with SHA-256 and anchored to the Trust Layer Ledger for tamper-proof provenance.

11. Changes

We may update this policy. Material changes will be communicated via email to all registered users. Continued use of the Services after changes constitutes acceptance.

12. Contact

DarkWave Studios LLC
Gladeville, TN, USA
support@lumescan.tech
Lume42 Labs