PCI Compliance

Last updated: September 10, 2026

1. Our Commitment

We treat the security of your payment information as a core responsibility. habitlume does not store, process, or transmit full cardholder data on our own servers. All card data is collected directly by our payment processor through their hosted payment fields.

2. How Card Data Is Handled

When you purchase a habitlume pack, your card details are entered into secure fields hosted by our payment processor, not by habitlume. The processor tokenizes the card and returns a payment token to us. We never see, store, or log your full card number, CVV, or expiration date. All card data collection, storage, and transmission is performed by our PCI-DSS Level 1 certified payment processor.

3. Our PCI Scope

habitlume's merchant PCI scope is SAQ A (Self-Assessment Questionnaire A), the simplest scope, because we fully outsource card data handling to a PCI-DSS Level 1 certified payment processor. We do not touch, store, process, or transmit cardholder data on our infrastructure.

4. What We Do Store

After a successful purchase, we retain only the following payment metadata, which is safe to keep:

• Last 4 digits of the payment card
• Card brand (e.g., Visa, Mastercard)
• A processor-issued payment token
• Billing zip code, if collected at checkout

We do not store anything that can be used to reconstruct your full card number or perform a transaction without the processor.

5. What We Do NOT Store

habitlume does not store, log, or have access to any of the following:

• Full primary account number (PAN)
• Card verification value (CVV)
• Expiration date
• Magnetic stripe data
• PIN data
• Any other sensitive authentication data

6. Transport Security

All connections to habitlume.app are encrypted with TLS 1.2 or higher. Our payment processor uses TLS 1.2+ for all card data transmission. We do not accept unencrypted connections.

7. Internal Access Controls

Access to habitlume production systems is limited to authorized personnel on a role-based basis. Administrative accounts require multi-factor authentication. We maintain audit logs of access to production infrastructure.

8. Incident Response

In the event of a suspected security breach, we will investigate promptly and notify affected users within 72 hours where required by applicable law, including under GDPR Article 33 and 34 and relevant United States state breach notification laws.

9. Your Role

You can help keep your account secure by:

• Keeping your account password secure and unique
• Not sharing your credentials with anyone
• Contacting us immediately if you suspect unauthorized access to your account

10. Contact

For security questions or to report a concern:

Meltian Advertising Solutions
10316 Sepulveda Blvd, #377
Mission Hills, CA 91345
United States
support@habitlume.app
+1 (888) 516-0845
8:00 AM to 8:00 PM ET, seven days a week

Charges appear on your billing statement as HABITLUME.APP.

For more about how we handle personal data, see our Privacy Policy. For refund terms, see our Refund Policy.