Last updated October 31, 2026

Privacy policy

Lumkaro Works, including Lumkaro Ship, Lumkaro Security and Lumkaro Connect, is operated by Bunny Directories LLC, 2355 Westwood Blvd, Los Angeles, CA 90064 ("we", "us"). This page explains what we collect when you use works.lumkaro.com, ship.lumkaro.com, security.lumkaro.com, connect.lumkaro.com and our services, and what we do with it. We collect as little as we can.

The free check

• Website check. We fetch the public pages at the address you enter, the same way a visitor's browser would. We keep the site's domain name, its score and the plan we recommended, to count usage and improve the check. We don't keep the page contents.
• Rejection decoder. The message you paste is sent to our AI provider, Anthropic, to produce your explanation, and we don't store it. Anthropic processes it under its commercial terms, which don't allow it to train models on this data. We keep only a count of how many messages were checked and the type of result. Remove anything private from the message before you paste it.
• Security scan. We read the public pages and code at the address you enter, and check for a few files that should never be public. If a settings file is exposed, we count its entries and don't keep it. Database and storage checks run only after the site owner adds our verification tag, and only count rows or ask for one file name, without reading or keeping the data. We keep the domain name, its score and the plan we recommended.
• Pre-submission check. Your answers stay in your browser. We receive only the overall risk level and number of issues.

If the website check finds secret keys in a site's public code, we show only the first few characters and never store them.

Lumkaro Connect (domain and email)

• Domain scan. We look up the public DNS records for the domain you enter, using Cloudflare's public DNS service, and connect to the website over HTTPS the way a browser would. We only read public information. We never sign in to your email, hosting or domain accounts, and a scan never changes anything.
• Help requests. If you ask for a review or a quote, we store your name, email, domain and the problem you describe, so we can reply and quote the fix.
• Guided Fix and Monitoring. When you buy, we keep your domain, your email and a private link to your report. Monitoring re-checks your domain's public records every day and emails you when something changes, until you cancel.

When you ask us to contact you

If you leave your email for a quote or for a person to read your rejection, we store your email, the plan or topic, and the message you send, so we can reply. We use it only to answer you.

Usage counts

We count which plans people look at and click, without cookies or any information that identifies you. Our hosting provider keeps standard server logs, including IP addresses, for a short time for security and to stop abuse.

Ad measurement (Meta Pixel)

When we run ads on Facebook and Instagram, we use the Meta Pixel to measure which ads work. It tells Meta when someone views a page, completes a free check, asks for a quote, starts checkout or buys a plan, with the plan and its price. Meta may combine this with what it knows about your Meta account, using cookies and your browser and device details, and Meta's own privacy policy applies to that. We never send Meta the website addresses you check, the rejection messages you paste, your email or your payment details.

Under California law, letting Meta use this for advertising may count as "sharing" personal information. You can opt out: we honor the Global Privacy Control signal from your browser, and you can turn ad measurement off for this browser here:

You can also manage how Meta uses your activity in your Facebook or Instagram ad settings.

When you buy a plan

Payments are handled by Stripe. We never see or store your card details. Stripe shares your name, email, billing details and the app or website link you give us, so we can deliver the work. Stripe's own privacy policy applies to the payment.

To do the work, you may invite us to your App Store Connect, Google Play Console, hosting or domain accounts with a limited role. We use that access only for the work you asked for, never ask for your passwords, and you can remove our access at any time.

Who we share it with

We don't sell your information. We share it only with the providers that run the service: our hosting provider (Railway), our payment provider (Stripe), our AI provider (Anthropic), our email provider (Resend), Cloudflare for public DNS lookups and, for ad measurement, Meta, or when the law requires it.

How long we keep it

Usage counts are kept for up to 24 months. Customer records are kept as long as you're a customer and as long afterwards as tax and accounting rules require.

Your choices

You can ask us what we hold about you, and ask us to correct or delete it, by emailing support@lumkaro.com. We'll reply within 30 days. Depending on where you live, for example California or the European Union, you may have additional rights under local law, and we'll honor them.

Changes

If we change this policy, we'll update the date at the top of this page.

Contact

Bunny Directories LLC
2355 Westwood Blvd, Los Angeles, CA 90064
support@lumkaro.com