LEGAL

Privacy Policy

This policy explains what LOTUX processes when jewellery shops use Shop Manager and customers open a shop’s QR catalogue or camera try-on.

Effective: 26 September 2026

Camera privacy: live try-on camera frames stay in your browser and are not uploaded to or stored by LOTUX. A photo is sent only if you separately select or take one for a shop review and submit it. Read the full camera-consent information.

Information we process

Shop accounts: shop and owner details, contact details, account credentials stored as secure hashes, product information and images, subscription status, customer-facing shop messages.
QR catalogue activity: the shop QR used, catalogue requests, product-interest events, and the technical information needed to keep the service secure and available.
Customer reviews: review text and any photo you deliberately attach and submit. Review photos are resized and stripped of embedded metadata before private storage. The review is shown to the shop whose QR you scanned, not posted publicly.
Shop chat: text messages sent from a shop’s QR website and replies from that shop. The chat text is stored so the shop can respond. A random, tab-scoped token secures the conversation; LOTUX does not require a customer account or phone number for this feature. Chats are visible only to the QR shop and the customer holding that token. Do not send passwords, payment details, or other sensitive information.
Browser data: essential session cookies for signed-in accounts. The customer try-on can store saved-product choices on that device.

How we use information

We use it to operate each shop’s isolated catalogue, authenticate shop and admin accounts, prepare product filters, show shop activity, prevent abuse, provide support, and maintain the service.

Optional Google sign-in for shopkeepers

Where enabled, you can link Google sign-in to your existing LOTUX shop using your LOTUX User ID and password. Google provides a signed identity credential, which LOTUX verifies on its server. We store the Google account identifier and link date, not your Google password, inbox, contacts, or Google access tokens. We do not link shops by email alone. Google processes sign-in requests under its own Privacy Policy.

You can continue using your LOTUX password. To remove a Google link, contact LOTUX support through your verified business contact. An administrator-led shop password reset removes the owner's Google link and revokes existing LOTUX sessions. Short-lived sign-in challenge cookies prevent replay and expire after ten minutes.

Camera and saved pictures

Camera permission is requested only when a customer chooses try-on. Tracking and jewellery rendering run locally in the browser. If the customer takes a picture, LOTUX prepares the picture or PDF locally for download to that device; it is not sent to LOTUX.

The separate review form can open your device camera or photo library at your request. It does not use a try-on frame. Review text and an optional selected photo are sent only when you press Submit review. Review photos are held in private storage and available to the verified account of that shop.

Sharing and service providers

LOTUX does not sell customer camera imagery. We use infrastructure providers, including Cloudflare for website and product-asset delivery and Railway for application and database hosting, only to operate the service. A participating jewellery shop controls the product and shop information in its own catalogue.

Retention and security

Account, catalogue, and operational records are kept while needed to provide the service, meet legal obligations, resolve disputes, and protect the platform. LOTUX uses tenant isolation, restricted access, secure password hashing, encrypted transport, and administrative multi-factor authentication. No internet service can promise absolute security.

Your choices and requests

You may decline camera access and still browse the shop catalogue. You can stop the camera by closing try-on or revoking camera permission in browser settings. Shopkeepers can ask to access, correct, or delete account information using the same verified business contact through which LOTUX issued their account. QR customers should contact the jewellery shop whose QR they scanned so the request can be identified correctly.

Children

Customers under 18 should use camera try-on only with a parent or guardian. Shops must not use LOTUX to collect children’s information without appropriate permission.

Updates and contact

Material changes will be posted here with a new effective date. See Support contact details for the correct route for your request.