What Lummy Ticket keeps about you, why, who can see it, and when it is deleted. Written to match what the app actually does.
1.Who is responsible
The Lummy Ticket team (Zahra Sasongko, Luthfi Hadi and Joanita Timbin Panggalo), the founders running this prototype. There is no company yet; this page will name it once there is.
Write to team@lummy.id for anything on this page.
2.What we collect
- Your account: your email address, and the name, WhatsApp number and payout account if you fill them in on your profile. Sign-in is by an email link, so we never hold a password.
- A ticket PDF you upload to sell. It usually carries the orderer's name and may carry an ID number, email or phone. We keep the file and its fingerprint (sha256). Barcodes read from it are kept only as a keyed hash: the code itself is never stored, and you see its last four characters. When you publish it, we also keep what the AI read from it (see below): the show, date, venue, category, seat, printed price and how many people it admits.
- A photo you attach to a claim or an answer, and what is written in the file: when it was taken, where (GPS, when the phone kept it), the camera model, any editing app, and the barcodes in it (as a keyed hash).
- Orders, payments and claims: what was bought, the amounts, the QRIS payment's status and Xendit's payment number, when the handover documents were opened, what each side wrote, and the decision. At a show's door: when, and at which gate, your entry pass was scanned.
- If you pay for a show abroad in USDC: the address of the wallet you pay from. We keep it with the payment and the order to check that the payment was signed by that wallet, to send any refund back to it, and to limit how many open orders one wallet can have. It is test USDC on the Arbitrum Sepolia test network, which has no money value. You sign the payment in your own wallet app, which is not a service of ours; Lummy sends the transactions and pays their network fee.
- We do not accept photos of ID cards yet, and we run no analytics or advertising trackers. The site keeps a sign-in cookie, and your language and sample data in your browser.
3.Why
- To run the sale you asked for: list, hold the money, hand the ticket over, pay out or refund.
- To stop the same ticket being sold twice and to catch edited files before they go live.
- To fill in the sell form from your ticket, and to check that the category and date you picked are the ones printed on it.
- To let each ticket through the door once, and to refund you on the spot when someone used it before you.
- To decide claims on evidence from both sides.
4.Email we send
- Only the sign-in link, when you ask for one.
- We send no email about orders, claims, cancelled shows or new tickets yet. This page will say when we start.
- Following a show or joining a tier's waitlist is kept only in your browser for now, and nothing is sent.
5.Who sees it
- Everyone: your listing and your public seller name, a first name and an initial (or "Lummy seller" if your profile has no name). Never your email.
- The buyer of your ticket: the whole PDF you uploaded, since that is the ticket.
- The other side of a claim, and Lummy staff: the photos and notes in that claim.
- Both sides of the order, and Lummy staff: where a claim photo was taken, if your camera saved its GPS position, with a link to it on Google Maps. A position at the venue helps a claim from the gate; when you do not need it, turn location off in your camera's settings.
- Anyone, on the public Arbitrum ledger: the state of an escrow or of a QRIS order's record, the amounts, and fingerprints of the payment, the ticket and the handover. No names, emails or files go on chain.
- Anyone, for a show paid in USDC: the wallet you paid from, its payment into the escrow and any refund back to it. Whoever knows that wallet can see that it paid into Lummy's escrow, how much and when.
6.Services that hold it for us
- Supabase: the database and private file storage, in Singapore.
- Vercel: the servers that run the site, in Singapore.
- Mailspace (DomaiNesia), the mail service of lummy.id, as our data processor: it delivers from no-reply@lummy.id the sign-in email that Supabase writes for us, and holds our team inbox (team@lummy.id), where your messages to us arrive.
- Arbitrum (a public blockchain): the escrow ledger described above.
- Xendit: takes QRIS payments. For now it runs in test mode, so no real money moves, and it receives only the amount and a payment number, never your name or email.
- Anthropic (Claude, an AI service): when you fill the sell form in from your ticket, and when you publish it, our server sends Anthropic the ticket's text with the buyer's name, ID and phone numbers, email and order codes taken out. The PDF itself is never sent, and if an ID number, email or phone number is still found after that, nothing is sent. Anthropic does not use it to train its models, and deletes it within 30 days, or keeps it for up to 2 years only if it is flagged for breaking Anthropic's usage policy.
- Before we take real payments, this page will say so first.
This means your data is stored outside Indonesia.
7.How long we keep it
- Ticket PDFs: deleted 30 days after the show, but never while an order on them still holds money or a claim is open.
- Claim photos: deleted 30 days after the claim is decided, and where they were taken is removed from the claim record with them. What the checks concluded and the decision stay.
- Photos uploaded but never attached to a claim: deleted after 7 days.
- Your account, orders, payments and claims: while your account exists, then as long as needed to settle anything still open. Records on the public ledger cannot be deleted by anyone.
- The wallet address you paid from: kept with its payment and order, for as long as they are. The payment itself stays on the public chain for good, and nobody, Lummy included, can delete it.
8.Your rights
Under Indonesia's Personal Data Protection Law (UU 27/2022) you may ask to see, correct or delete your data, or withdraw your consent. Write to team@lummy.id from the email on your account. We answer as soon as we can and tell you if something cannot be deleted yet, for example while a sale is still in escrow.
9.Under 18
Lummy is only for people 18 and older. If we learn an account belongs to someone under 18, we close it and delete its data, except what an open order or the law still needs.
10.How it is protected
Files sit in private storage that no browser can list or open. Each opening goes through our server, which checks who you are, then hands out a link that works for one minute. Database rows are readable only by the people on that order and by staff.
11.This is a prototype
Payments are simulated or run on a test network, so no real money moves. This policy has not yet been reviewed by a lawyer and will be before Lummy takes real payments. When it changes, the date at the top changes.