Lustrum Privacy Policy

There are three kinds of reader and this policy treats them differently.

• A store.
• The business that subscribes to Lustrum. Its records are its own and we hold them to run the service it is paying for.
• A user.
• An owner, manager or staff member who holds an account under a store. Accounts are created by Lustrum or by that store, and there is no public sign-up.
• A visitor.
• Somebody reading this marketing site who holds no account. We collect nothing about you here beyond what your browser has to send to fetch a page, and you can read every word of this site without us setting anything at all.

Lustrum is not a consumer product and has no customer-facing surface. Nothing in it concerns a shopper who walks into a shop that uses it.

Account information, for the people who sign in: a name, an email address, and a password we store only as a scrypt hash, which means we cannot read it and cannot tell you what it is. Alongside it, which store the account belongs to and what its role and permissions are in that store.

Operational records, which are the store’s own books and the substance of the product:

• Vendors, their representatives, phone numbers, emails and the terms the store buys on.
• Invoices and their line items, deliveries, cheques, and the weekly plan a store orders against.
• Photographs of invoices and cheques, taken by staff on the phone app at the door.
• Items, shelf locations and the restock flags raised from the shop floor.
• Employees, schedules and hours, where a store uses those parts of the product.
• Where a store has connected its register, the sales totals that register reports.

Activity records. Sign-in events, and a record of who changed what and when. That record is the reason an audit trail is worth having, and it is also what lets a store answer “who marked this cheque written” three weeks later.

What you send us. If you write to us through the contact form we keep what you typed, so that we can reply to it.

Technical records. Our servers keep ordinary request logs, which include IP addresses, for as long as it takes to run and debug the service. We do not build profiles out of them.

When operational diagnostics are enabled, the application also sends a small set of navigation, browser-error and failed-request events to our own API. They contain a page category, action category, timing, build version and a temporary random identifier for that browser tab, and a random request reference for failed API calls. They do not contain page addresses, search terms, invoice details, form contents or screenshots. We use them to investigate broken or slow interactions, not to advertise or follow anyone across sites.

No cookies. No third-party analytics package. No advertising or marketing pixels. No session replay, no heat maps, no fingerprinting, and no third-party script on any page of this site or of the application. There is nothing here following you between sites because there is nothing here that could.

The full account of what Lustrum stores in your browser instead, and what each item is for, is on the cookie policy.

We do not ask for and do not want payment card numbers, government identifiers, health information, or anything about a store’s customers.

Almost all of it is typed or photographed by the store’s own staff in the course of doing the work: an invoice photographed at the door, a delivery marked received, a cheque marked written.

Some is derived by Lustrum from that: payment terms measured from a store’s own pay-by dates, per-vendor bands split out of a weekly budget, spend rolled up by week. Derived information is still the store’s.

A little is imported at a store’s request from a system it already runs, such as a register it asks us to connect. We import what that connection returns and nothing else.

To run the service the store is paying for, which means:

• Showing a manager this week’s plan, the order lists under it and what has been spent.
• Attaching a photographed invoice to the delivery and the invoice it belongs to.
• Telling an owner what is owed, to whom, and when it is due.
• Keeping an account signed in, and enforcing what its role is allowed to see.
• Sending the small number of messages the product sends, which are described below.
• Keeping the service working, secure and backed up, and diagnosing it when it is not.
• Answering a store when it writes to us.

We do not process a store’s records for any purpose of our own beyond those, and we do not train models on one store’s records to sell to another.

Lustrum sends transactional email only: sign-in links, password resets, invitations to an account, and alerts a store has switched on for itself. There is no marketing list and no newsletter, so there is nothing to unsubscribe from.

A message only ever fires from something that actually happened in the data. Nothing in Lustrum notifies on a timer or on a guess.

We do not sell anything we hold, and we never have. We do not share a store’s operational records with another store, with advertisers, or with data brokers.

The complete list of who else can touch it:

• The store itself.
• Its own users, according to their roles.
• The people who operate Lustrum
• , to run and support the service.
• The infrastructure providers named below
• , which hold the data in order to serve it and do not use it for anything of their own.
• Anyone a law requires
• , if we are compelled by a valid legal process. We will tell the store first unless we are forbidden from doing so.
• A buyer or successor
• , if Lustrum is ever sold or merged, on the same terms as this policy. We will tell every store before that happens.

The full list of third parties that touch the service:

• Oracle Cloud Infrastructure
• , where the server and the database run.
• Cloudflare
• , which serves this marketing site and the web application as static files and sits in front of the API.
• Resend
• , which delivers the email the product sends.
• A register provider
• , and only where a store has asked us to connect one, in which case the connection is that store’s and can be revoked by it.

If that list changes in a way that touches a store’s data, this page changes with it.

The application database is PostgreSQL, on a server we run, in the United States. Invoice and cheque photographs are held with it. The web application and this site are static files served through Cloudflare’s network, which means the pages themselves may be cached near you; the data behind them is not.

If you use Lustrum from outside the United States, the records are still held in the United States.

What is actually in place, rather than a list of adjectives:

• Traffic to the site and the API is encrypted in transit.
• Passwords are stored as scrypt hashes and never in a readable form.
• Two-factor authentication is available on an account.
• What an account can see and change is enforced by the server on every request, not by hiding buttons.
• The database is backed up on a schedule and the backups are held on the same server.

Two things we would rather you heard from us. Those backups being on the same machine as the database means they protect against a mistake and not against losing the machine, and moving them off it is work we have not finished. Restoring from one has not been rehearsed end to end. Both are on the list, and this page will say so plainly when they are done.

No system is perfectly secure. If you find a problem, please tell us through our contact form before telling anyone else; we will not come after somebody who reports one in good faith.

A store’s records are kept for as long as its account is open, because they are the record it is using. An invoice from two years ago is the point of having the product.

If a store leaves, tell us and we will return its data or delete it, whichever it asks for. Backups roll off on their own schedule after that.

We have not set a fixed retention period beyond that, and saying so is more useful than a number nobody measured. When one is set it will be written here.

If you hold an account, ask your store’s owner or manager first: the records are the store’s and it can already export, correct or remove most of them itself.

Otherwise write to us through our contact form and say what you are asking for. You can ask us what we hold about you, ask us to correct it, ask for a copy, or ask us to delete it, and we will do it or explain why we cannot. Some things we may have to keep: an audit record of who changed what is a store’s protection as well as ours.

We will not charge you for asking and we will not treat you differently for having asked.

Lustrum is a tool for people at work. It is not directed at children, and we do not knowingly hold information about anyone under 16. If you believe we have, tell us and we will remove it.

When this policy changes materially we will change the date at the top of it and tell the stores it affects, before the change takes effect where we reasonably can. Changes that are not material, such as making a sentence clearer, will simply appear here.

Questions about this policy, or about anything Lustrum holds, go to our contact form and we will answer them.

Lustrum is early, and the company that will operate it is still being formed. When it is, its legal name and registered address will be named here rather than left to be guessed at.