1. What we collect
Information you give us
When you submit the "Start a project" form, we collect what you choose to share — typically:
- Your name, email address, and phone number
- Your business or brand name and website (if you have one)
- Details about your project — the services you're interested in, your budget range, and what you're trying to achieve
- Anything else you write in the form
Information collected automatically
For security and to keep the site running, we may record limited technical data such as your IP address (used for rate-limiting and abuse prevention) and basic request information. We do not run third-party analytics, advertising pixels, or cross-site trackers.
2. How we use it
We use your information only to:
- Review your enquiry and respond to you
- Scope, quote, and (if we work together) deliver your project
- Keep the website secure and functioning
- Meet legal or accounting obligations
We will never sell your data, rent it, or share it for advertising.
3. Legal basis (GDPR)
If you're in the European Economic Area or UK, we rely on:
- Consent — you opt in when you submit the form.
- Legitimate interest — responding to enquiries and running our studio.
- Legal obligation — where the law requires it.
4. Who processes it
We're a small studio and keep your data tight. It is stored and processed by a few trusted infrastructure providers acting on our behalf, under their own security and privacy commitments:
- Vercel — website hosting and delivery
- Neon — the database where enquiries are stored
- Our email provider — to notify us of, and reply to, your enquiry
We share data beyond these only when legally required, or to protect our rights, our visitors, or the public.
5. How long we keep it
- Active / client enquiries — kept for the duration of our relationship and a reasonable period afterward for our records.
- Enquiries that don't move forward — deleted within 90 days, or sooner if you ask.
- Security logs — kept briefly (around 30 days).
You can ask us to delete your information at any time — see Contact.
7. Security
We protect your data with industry-standard measures, including:
- Encrypted transmission (HTTPS / TLS)
- Hashed admin passwords (bcrypt)
- An access-controlled admin area and rate limiting
- Security headers (CSP, HSTS, X-Frame-Options and more)
No system is perfectly secure, but we take reasonable steps to keep your information safe.
8. Your rights
Depending on where you live, you may have the right to:
- Access a copy of the data we hold about you
- Correct anything inaccurate
- Delete your data ("right to be forgotten")
- Port your data to another service
- Object to or restrict processing, and withdraw consent
California residents (CCPA/CPRA): you have the right to know what we collect, request deletion, and opt out of any "sale" of personal information. We do not sell personal information. To exercise any right, email hello@lumora.agency — we respond within 30 days.
9. Children
Our site and services are for adults and businesses. We don't knowingly collect information from anyone under 18, and will delete it if we discover we have.
10. International transfers
Your data may be processed in the United States. By submitting the form you consent to this transfer, and we rely on appropriate safeguards for it.
11. Changes
We may update this policy occasionally. The revision date at the top will change, and material updates will be highlighted on the site.
12. Contact
Questions or requests about your data? Reach us at:
- Email: hello@lumora.agency
- Lumora Agency — Miami, FL, United States