Privacy Policy

1. Notice At Collection & Scope

This Privacy Policy applies to lexilucks.com, the Curiosity membership portal (/curiosity), the Lexi Concierge interactive experience, partner inquiry forms, and associated digital services operated by Lexi Lucks Productions ("we", "us", or "our").

Entertainment service: Curiosity is a creator membership service and is not designed to collect health or medical records.

2. Categories of Personal Information Collected

We strictly adhere to data minimization principles. We collect the following categories of information solely for defined product and business purposes:

• Identity Information: Name (if provided), email address, and an internal membership account identifier. Used to identify members, manage subscriptions, and verify identity for privacy requests.
• Billing & Commerce Metadata: Stripe customer and subscription references, pricing tier, payment status, and subscription billing period dates. Payment entry is handled by Stripe; LexiLucks does not receive or store full card numbers or card security codes.
• Community Identity (Discord): Verified Discord Snowflake User ID, Discord username, and community role status. Collected solely if you choose to link your Discord account to receive your Curiosity role.
• Communications & Preferences: Transactional welcome email records, newsletter consent status, partner inquiry details, and unsubscription flags.
• Authentication & Necessary Cookies: Cryptographically encrypted session tokens (lexios_member_session) flagged HttpOnly, Secure, and SameSite=Lax, used strictly for authenticating members to protected content.
• Product Interactions: First visit / return visit indicators stored in your local browser storage to personalize the Curiosity world experience without server profiling.

3. Sensitive Information Policy

We do not intentionally request, collect, or store sensitive personal information such as health or medical history, precise geolocation, biometric data, government IDs, sexual orientation, or sexual activity. Community affinity or creator engagement does not justify collecting sensitive identity data.

4. Third-Party Service Providers & Data Map

We use these service providers to operate the site and membership experience:

• Stripe: Payment processing, customer billing records, and automated invoicing. (Stripe Privacy Policy)
• Discord: Community platform and role fulfillment. Account linking requires your explicit OAuth approval. (Discord Privacy Policy)
• Resend: Transactional email delivery for membership confirmation and receipts.
• Supabase: Site data storage, privacy request intake, system event logging, and delivery retry queues.
• LexiOS and CRM infrastructure: Membership entitlement, member sessions, Discord fulfillment, and operational customer records.
• Vercel: Edge hosting, serverless execution, and CDN distribution.

5. No Sale or Sharing of Personal Information

We do not sell your personal information. We do not share your personal information for cross-context behavioral advertising. We do not use third-party data tracking pixels to sell patron profiles.

6. Email & SMS Communications

Transactional vs. Marketing: Membership confirmation, receipts, security notices, and Discord linking links are transactional communications essential to your paid subscription.

Marketing Opt-Out: Any promotional or marketing updates require separate consent and always include an immediate unsubscribe mechanism. A member cannot be forced to receive marketing messages to maintain paid membership.

7. Data Retention & Deletion Standards

We retain personal information only for as long as necessary to fulfill the purposes for which it was collected:

• Active Member Accounts: Retained while your Curiosity membership remains active.
• Cancelled Subscriptions: Member profile data is scheduled for deletion upon request, subject to legitimate legal, accounting, tax, and fraud-prevention retention obligations (e.g. IRS financial records).
• Discord Account Links: Access is disabled when entitlement ends. Link records may remain temporarily for reconciliation, security, or audit needs and are reviewed for removal after a verified request.
• Security & Audit Logs: Retained for a limited period appropriate to troubleshooting, security, fraud prevention, and legal needs. The final schedule remains subject to owner and legal review.

8. Your Privacy Choices and Rights

Regardless of whether statutory thresholds apply, we voluntarily provide full consumer privacy rights to all members:

• Right to Know / Access: Request details regarding categories and specific pieces of personal information collected.
• Right to Delete: Request deletion of your personal information across our active systems.
• Right to Correct: Request correction of inaccurate personal information.
• Right to Data Portability / Export: Receive a machine-readable export of your member account records.
• Right to Non-Discrimination: We will never discriminate against you for exercising your privacy rights.

Submit a Request: You can exercise your rights at any time via our online intake portal:

Submit a Privacy Rights Request

Available legal rights and response periods depend on your location and the circumstances. We will verify identity before disclosing or deleting sensitive account information.

9. Security & Data Protection

We use safeguards including HTTPS in transit, secure and HttpOnly member cookies, same-origin checks for sensitive writes, server-side authorization, rate limiting, redacted logs, and isolated environment secrets. No system can guarantee absolute security.

10. Contact Us

For questions regarding this policy or our privacy practices, please contact our privacy desk at privacy@lexilucks.com or hello@lexilucks.com.