Aqara LLC
(A subsidiary of Lumi United Technology Co., Ltd.)
Effective Date: [June 24, 2026]
Last Updated: [June 24, 2026]
This Aqara U.S. Privacy Policy (“Privacy Policy” or “Policy”) describes how Aqara LLC (“Aqara,” “Company,” “we,” “us,” or “our”), a United States subsidiary of Lumi United Technology Co., Ltd., collects, uses, discloses, retains, and protects personal information from individuals located in the United States (“you” or “your”). This Policy is effective as of [June 24, 2026].
Aqara LLC is a U.S. subsidiary of Lumi United Technology Co., Ltd. (the “Parent Entity”), headquartered in Shenzhen, Guangdong, People’s Republic of China. Aqara LLC serves as the data controller (business) is responsible for all personal information collected from U.S. consumers. The Parent Entity may access or process certain U.S. consumer data solely for the limited purposes disclosed in Section 8.5, subject to written intra-group data processing agreements, data desensitization safeguards, and the consumer rights described in Section 10 of this Policy.
This Policy applies to all U.S. users regardless of state of residence. It covers all personal information collected through:
This Policy grants all U.S. users the full set of privacy rights described in Section 10, regardless of state of residence. We use the California Consumer Privacy Act as amended by the California Privacy Rights Act (“CCPA/CPRA”) as a universal baseline for all U.S. consumers, supplemented by additional protections required under other applicable U.S. state privacy laws.
If you connect an Aqara device to a third-party platform (such as Apple HomeKit) rather than the Aqara Home App, Aqara does NOT collect or process your device data. In such cases, the third-party platform’s privacy policy governs the collection and processing of device data.
The following table constitutes our “Notice at Collection” as required by the CCPA/CPRA and other applicable U.S. state privacy laws. It identifies the categories of personal information we collect, the specific data elements within each category, sources, purposes, third-party recipients, whether information is sold or shared, and applicable retention periods.
| Category of Personal Information | Specific Data Elements | Sources | Purpose of Collection/Use | Categories of Third-Party Recipients | Sold or Shared? | Retention Period |
|---|---|---|---|---|---|---|
| Account Information | Nickname, profile photo, phone number, email address, password (hashed) | User-provided | Account creation; authentication; customer communication | Freshworks (customer support) | No | Duration of account plus 30 days after deletion |
| Device Identifiers & Hardware Information | Device name, model, device ID, SN number, hardware version, firmware version, serial number, battery voltage, board temperature, IMSI, IMEI, MEID, SIM, OAID, MAC, Android ID, IDFV, system, language, timezone, resolution, CPU | Automatically collected from device | Device activation; firmware updates; troubleshooting; device statistics | Analytics SDKs (Sensors Data); App monitoring SDK | No | Duration of device connection plus 6 months after deletion |
| Network Information | Wi-Fi SSID/BSSID/MAC/password, Bluetooth MAC, ZigBee MAC, device ID, IP address, Zigbee signal strength, online/offline status, network connection type | Automatically collected | Network configuration; device connectivity; server assignment; troubleshooting | Analytics SDKs (Sensors Data); App monitoring SDK | No | Duration of device connection plus 6 months after deletion |
| Home Environment & Automation Data | Home name, room name, automation name, execution logs, condition/action lists, effective time period settings, execution result notification settings, enable/disable automation settings, voice conversations, energy consumption, temperature/humidity, human presence, device status, weather data | User-provided; automatically collected | Automation services; personalized recommendations; AI-driven suggestions; energy analysis | Azure OpenAI (smart suggestions) | No | Duration of device connection plus 6 months after deletion |
| Device Setting Information (incl. Presence Switch H2 US) | Device room location, intelligent scene settings, icon settings, channel switch status, power-on device status, wireless function settings, quick dual control settings, intelligent load settings, device protection status, switch operations, presence/absence state | Automatically collected from device | Providing device functions per user settings; automation triggers | None | No | Duration of device connection plus 6 months after deletion |
| Customer Support & Feedback Data | Nickname, email, images, videos, logs, address, feedback content, router model, basic contact information, error logs | User-provided | Responding to inquiries; troubleshooting; service improvement | Freshworks (customer support, San Mateo, CA) | No | 2 years from submission |
| Value-Added Service Transactional Data | Account, device ID, package type, service validity period, order number, payment time/amount/currency, activation status, renewal amount/date, payment method, invoice information (name, address, telephone, fax, email) | User-provided; payment processor | Processing transactions; providing subscription services; invoicing | Payment processors | No | As required by applicable tax/accounting laws |
| Hub Device Data | Night light settings, alarm settings, volume, language, sub-device list | Automatically collected from device | Providing hub device functions; managing connected devices | None | No | Duration of device connection plus 6 months after deletion |
| Advertising & Marketing Identifiers | Device type, Android ID, IDFA, OAID, province/city/district, network/carrier information | Automatically collected | Advertising; marketing analytics; service optimization | Facebook SDK; Google SDK; Sensors Data | No | Until opt-out or account deletion |
| Sub-Device Data | As described in each device’s Device Privacy Policy accessible in-app | Automatically collected from device | Providing device-specific functions and services | As applicable per device type | No | Duration of device connection plus 6 months after deletion |
* Footnote: “Sharing” refers to making personal information available to third parties for cross-context behavioral advertising as defined under the CCPA/CPRA, or for targeted advertising as defined under other applicable U.S. state privacy laws. You have the right to opt out of such sharing as described in Sections 10 and 11 of this Policy.
We use the personal information described in Section 2 for the following purposes:
We use Azure OpenAI and proprietary algorithms to analyze device usage patterns, automation settings, energy consumption, presence/absence data, and scene data to provide:
Data used as AI inputs includes: device data (model, settings, status), automation data (execution logs, condition/action lists), energy consumption data, scene/environment data (temperature, humidity, weather).
Outputs include: automation suggestions, energy-saving tips, personalized product recommendations, and smart home optimization recommendations.
You may opt out of personalized recommendations at any time via Settings > Personalized Recommendation Management in the Aqara Home App.
We do not make purely automated decisions that produce legal or similarly significant effects on consumers in the areas of credit, employment, insurance, housing, or healthcare.
We engage in “profiling” as that term is defined under the CCPA/CPRA and other applicable U.S. state privacy laws. Under these laws, profiling means any form of automated processing used to analyze or predict aspects of a person’s preferences, behavior, or other characteristics.
The Company uses algorithms, big data analytics, and Azure OpenAI to analyze the following categories of personal information:
This analysis generates:
Under the CPRA and other applicable U.S. state privacy laws, you have the right to opt out of profiling in furtherance of decisions that produce legal or similarly significant effects concerning you. You may exercise this right through:
When you opt out of profiling, we will cease using your personal information for personalized recommendations and automated behavioral analysis, while continuing to provide core device functionality.
We share personal information with the following categories of service providers who process data on our behalf:
The Aqara Home App integrates the following third-party software development kits (SDKs). Certain SDK integrations that make personal information available to third parties for cross-context behavioral advertising or targeted advertising may constitute “sharing” under the CCPA/CPRA and other U.S. state privacy laws.
SDK integrations include:
We do not sell your personal information as that term is defined under the CCPA/CPRA. However, certain third-party SDK integrations used for analytics and advertising purposes may constitute “sharing” as defined under the CCPA/CPRA or processing for “targeted advertising” as defined under other applicable U.S. state privacy laws. Specifically, Device Identifiers, Network Information, and Advertising & Marketing Identifiers may be shared with analytics and advertising SDKs (Sensors Data, Facebook SDK, Google SDK) for cross-context behavioral advertising purposes.
You have the right to opt out of such sharing as described in Sections 10 and 11 of this Policy.
All service providers and processors with whom we share personal information are bound by written agreements that include:
“Sensitive personal information” is defined using the broadest combined definition across all applicable U.S. state privacy laws, including the CCPA/CPRA, and includes:
The Company collects the following categories of sensitive personal information:
The Company does not knowingly collect:
We use the sensitive personal information described in Section 6.2 only for purposes that are necessary to provide the services you request and as otherwise permitted by applicable law. Specifically, account credentials are used solely for account security and authentication, and precise geolocation data is collected and used solely to enable the geofencing automations and location-based features you have requested. We do not use or disclose sensitive personal information for advertising, profiling, or any other secondary purpose beyond those necessary to provide the services you request or as otherwise permitted by law. For residents of states whose privacy laws require affirmative opt-in consent for the processing of sensitive personal information, we obtain such consent prior to processing. If our use of sensitive personal information changes in the future to include purposes beyond those necessary to provide the services you request, we will update this Policy and provide any mechanisms required by applicable law, including the right to limit such use.
We retain personal information only as long as necessary for the purposes described in this Policy, or as required by law. Specific retention periods:
We maintain an internal written retention schedule, broken down by data category, that is reviewed and updated annually.
When a retention period expires, personal information is securely deleted or irreversibly anonymized using methods such as:
You may delete all local data stored on your Aqara devices by performing a factory reset. Factory reset procedures for specific devices include:
Warning: A factory reset cannot be undone. Please ensure you no longer need the locally stored data before performing a reset.
The Company maintains data centers in: mainland China, Germany, South Korea, Singapore, Russia, and the United States.
U.S. User Data Storage: Personal information collected from U.S. users is stored on servers located in the United States.
Personal data stored on U.S. servers will not be directly transmitted to mainland China without data desensitization (de-identification). The Company employs the following data desensitization techniques, applied according to a tiered sensitivity classification:
Applicable U.S. state privacy laws require clear disclosures of cross-border data practices, reasonable security safeguards, purpose-limited processing, and consumer opt-out rights. Our cross-border data transfers are safeguarded as follows:
We maintain written intra-group data processing agreements with the Parent Entity governing cross-border data flows. These agreements include:
Personal information may be accessed from outside the United States in limited circumstances. The Company discloses the following categories of cross-border access so that you may make informed choices about your data:
In all such cases: (a) access is governed by the intra-group data processing agreements described in Section 8.4; (b) data desensitization techniques are applied prior to any bulk data transfers; (c) access is limited to the minimum personal information necessary to accomplish the stated purpose; and (d) your rights under Section 10 of this Policy, including the right to request deletion of your personal information, remain fully available to you regardless of where your data is accessed.
We implement physical, electronic, and managerial safeguards to protect personal information against unauthorized access, disclosure, alteration, and destruction:
Physical Safeguards:
Electronic Safeguards:
Managerial Safeguards:
We maintain a valid ISO/IEC 27001:2022 certification covering smart home and IoT integrated solutions.
We conduct data protection assessments for processing activities that present heightened risk to consumers, as required by applicable U.S. state privacy laws, including for targeted advertising, profiling, sensitive data processing, and AI‑driven behavioral analysis. See Section 14 for additional detail.
In the event of a data breach involving personal information, the Company will:
Regardless of your state of residence, we grant all U.S. users the following privacy rights:
You have the right to request disclosure of the personal information we have collected about you, including the categories and specific pieces of information, sources, purposes, and categories of third parties with whom we share it.
You have the right to request that we delete personal information we have collected from you, subject to certain exceptions permitted by law (e.g., legal compliance, security, completing a transaction).
You have the right to request correction of inaccurate personal information we maintain about you.
You have the right to receive a copy of your personal information in a portable, readily usable format that allows transmission to another entity.
You have the right to opt out of the “sale” or “sharing” of your personal information, and to opt out of the processing of your personal information for targeted advertising purposes, as those terms are defined under the CCPA/CPRA and other applicable U.S. state privacy laws. See Section 11 for detailed instructions.
You have the right to opt out of profiling in furtherance of decisions that produce legal or similarly significant effects concerning you. See Section 4 for details on our profiling activities and how to opt out.
As described in Section 6.4, we use sensitive personal information only for purposes necessary to provide the services you request and as otherwise permitted by applicable law. Because we do not use or disclose your sensitive personal information for purposes beyond those necessary to provide the services you request, a 'Limit the Use of My Sensitive Personal Information' mechanism is not required and is not offered.
You have the right to opt out of the use of automated decision-making technology, including profiling, in connection with decisions that produce legal or similarly significant effects. The Company does not currently make such decisions; however, this right is available to you should our practices change.
We will not discriminate against you for exercising any of your privacy rights, including by denying services, charging different prices, or providing a different level or quality of service.
You may submit a privacy rights request through any of the following methods:
We will verify your identity before fulfilling your request by matching information in your request against your account records. We may require confirmation from your account email address or ask for additional identifying information.
We will acknowledge receipt of your request within 10 business days and respond substantively within 45 calendar days from receipt. If additional time is needed, we may extend the response period by up to 45 additional calendar days (15 additional days for Montana residents) upon notice to you explaining the reason for the extension.
You may designate an authorized agent to submit a privacy rights request on your behalf. An authorized agent must provide written authorization signed by you or a valid power of attorney. We may require the authorized agent to provide proof of authorization and may require you to verify your identity directly with us.
If we decline to act on your request, you have the right to appeal our decision. To submit an appeal, contact us at privacy@aqara.com with the subject line “Privacy Rights Appeal.” We will respond to your appeal within 45 days. If we deny your appeal, we will inform you of the reason for the denial and of your right to contact the applicable state attorney general to submit a complaint.
You have the right to opt out of the “sale” or “sharing” of your personal information as those terms are defined under the CCPA/CPRA and other applicable U.S. state privacy laws.
You may opt out of the sale or sharing of your personal information by:
When you exercise this opt-out, we will suppress data flows to all third-party advertising and analytics SDKs in real time. Specifically, we will cease making available your Device Identifiers, Network Information, and Advertising & Marketing Identifiers to third-party analytics and advertising SDKs for cross-context behavioral advertising or targeted advertising purposes.
The opt-out of sale/sharing also functions as an opt-out of:
The Company honors the Global Privacy Control (GPC) signal and other qualifying universal opt-out mechanisms recognized under applicable U.S. state privacy laws. When we detect a GPC signal from your browser or device, we will treat it as a valid opt-out of the sale and sharing of personal information associated with that browser or device.
Our products and services are intended for individuals who are 18 years of age or older. We do not knowingly collect, use, or disclose personal information from individuals under 18 years of age.
If we learn that we have collected personal information from a child under 18, we will take steps to delete such information as promptly as possible. If you are a parent or guardian and believe that your child has provided us with personal information without your consent, please contact us at privacy@aqara.com so that we can take appropriate action.
If you connect Aqara devices to third-party platforms (e.g., Apple HomeKit, Google Home, Amazon Alexa) rather than the Aqara Home App, the Company does NOT collect or process device data generated through those third-party platform connections. In such cases, the third-party platform’s privacy policy governs the collection, use, and disclosure of your data.
When you use both the Aqara Home App and a third-party platform simultaneously, this Privacy Policy applies only to data collected through the Aqara Home App and direct device connections to our servers.
We conduct data protection assessments as required by applicable U.S. state privacy laws, including the CPRA, Virginia Consumer Data Protection Act, Colorado Privacy Act, and Connecticut Data Privacy Act.
Assessments are conducted for processing activities that present heightened risk to consumers, including:
Each assessment weighs the benefits of the processing against potential risks to consumer rights, considering available safeguards. Assessments are documented and made available to state regulatory authorities upon lawful request.
We may update this Privacy Policy from time to time to reflect changes in our practices, technologies, legal requirements, or other factors. When we make material changes, we will:
Your continued use of our products and services after the effective date of a revised Policy constitutes acknowledgment of the revised terms.
If you have questions, concerns, or requests regarding this Privacy Policy or our data practices, please contact us:
Aqara LLC
Email: privacy@aqara.com
Web Form: [https://app.prighter.com/dsr/13345230]
Mailing Address: [1178 Broadway, New York]
For privacy rights requests, please use one of the methods described in Section 10.10.
For appeals of privacy rights decisions, email privacy@aqara.com with the subject line “Privacy Rights Appeal.”