Privacy policy

Who we are

This policy covers the Lumien Payments website, the online merchant application and the merchant and partner portals (together, the "services"). "Lumien", "we" and "us" mean Lumien Payments. Lumien Payments is an authorized sales representative of Shift4 Payments, LLC, Center Valley, PA. Shift4 Payments, LLC is a registered ISO of Citizens Bank, N.A., Providence, RI.

Effective date: 2026-09-30 (draft, not yet in effect).

Personal information we collect

Information you give us

• Contact form: your name, business name, email address, phone number, an estimate of monthly card sales, your current processor, your message, and whether you agreed to receive calls and texts.
• Merchant application: business details (legal and trade names, addresses, tax ID, ownership type), processing details, and details about each owner and control person, which can include name, date of birth, Social Security number or passport number, home address, government ID details and contact details. We also collect business bank account details and documents you upload, such as a voided check, bank letter, processing statements or an ID photo.
• Portal accounts: your login email, password (stored only as a secure hash) and two step verification settings.

Information collected automatically

• Pages you visit on our site, how long you stay, the site that referred you, your browser and device type, and an approximate location derived from your IP address. We measure this ourselves; we do not use advertising cookies or third party ad trackers.
• A small setting saved in your browser to remember choices such as pausing animation. Signing in to a portal uses a session cookie on the application site only.

We never ask for or store full card numbers from your customers.

How we use personal information

• To answer your questions and follow up about merchant services you asked about.
• To prepare, pre-screen and submit your merchant application, and to verify identity and screen against government sanctions lists as the law requires.
• To show application, equipment, deposit and commission information in the portals.
• To send service emails, and marketing emails you can unsubscribe from at any time.
• To secure the services, prevent fraud, keep required records and comply with law.
• To understand, in aggregate, how the site is used so we can improve it.

Who we share it with

• Our processing partner and its sponsor bank (Shift4 Payments, LLC and Citizens Bank, N.A.), to evaluate, approve and run your merchant account.
• The sales representative assigned to your business, limited to what they need to help you. Representatives never see your full Social Security number, date of birth or bank account number.
• Service providers who host, store and deliver the services for us (for example cloud hosting, database, file storage and email delivery), under contracts that limit their use of the information.
• Authorities and others when required by law, to respond to legal process, or to protect our rights and the safety of others.
• A buyer or successor if our business is sold or reorganized, subject to this policy.

We do not sell personal information, and we do not share it for cross context behavioral advertising.

How we protect it

Sensitive details such as Social Security numbers, dates of birth, ID numbers, tax IDs and bank account numbers, and every uploaded file, are encrypted before they are stored. Access is limited by role, requires two step verification for staff, and each view of a sensitive value is logged. No method of storage or transmission is perfectly secure, but we work to protect your information and review our safeguards regularly.

How long we keep it

• Applications that are never submitted: sensitive fields and documents are deleted after 180 days.
• Declined or withdrawn applications: deleted after 25 months.
• Approved merchant accounts: kept for the relationship and at least two years after it ends, as card network rules require.

Deleted data can remain in encrypted backups for a limited period before those backups expire.

Your choices

• Review or correct: ask us to review or correct personal information you gave us by using our contact form. Portal users can update most details in their account.
• Calls and texts: reply STOP to any text, or tell us through the contact form. We honor opt outs within 10 business days. See calls and texts consent.
• Email: every marketing email has an unsubscribe link. Service emails about an open application or account continue while it is open.

Do Not Track and third party tracking

Our site does not track you across other websites, and we do not allow third parties to collect personal information about your activity over time and across different websites through our site. Because we do not do that kind of tracking, our site responds the same way whether or not your browser sends a Do Not Track signal.

Children

The services are for businesses and are not directed to children under 13. We do not knowingly collect their information.

California residents

California residents may have additional rights under state law, such as the right to know what we collect and to request deletion, subject to legal exceptions. To make a request, use our contact form. We will not discriminate against you for exercising these rights.

Changes to this policy

When we change this policy we post the new version here with a new version number and effective date. If a change is material, we will also show a notice on the site or tell account holders by email before it takes effect.

Contact us

Questions about this policy or your information: use our contact form. Mailing address: to be added before launch.