Last updated: September 2026
Privacy.
This site loads one third-party script, Google Analytics, and it sends Meta, from our own server, the events we measure our advertising by; both are described in full below. What we collect through the form is what you type into it, plus four things recorded automatically alongside it (all four named below), and it is stored on Lumora’s own server rather than with anyone else.
What you type into the form
Name and phone are required. Email, company, the service you are interested in and the message are optional. Leave them empty and the form still sends.
Four things recorded automatically
The language you were reading in, the page you sent from, a keyed hash of your IP address (not the address itself) and the browser you sent from. The language and the page tell us where people are reaching us. The hash has one use only: stopping anyone submitting the form fifty times a minute. It is keyed with a secret, so it cannot be turned back into a real address even by someone holding the whole database.
Where it is stored
A database on Lumora's own server. Not on a form service, not in Google Forms, not in a shared sheet. So the people who can open it are Lumora and nobody else.
Who sees it
The Lumora team. When a form arrives a Telegram notification is sent carrying the name, the phone and the service. The message body is deliberately not included, because a chat is a much less controlled place than a database row. Beyond that we do not sell the data and do not share it with any intermediary. The one exception is the measurement events that go to Meta and Google, described in full below.
Ad measurement with Meta
If you arrived from a Facebook or Instagram ad, our server (not your browser) tells Meta that you opened a page, which service or case page you viewed, that you tapped WhatsApp, the phone number or the email, and that you sent the form. The event carries your IP address, your browser type and the identifier of the ad you came from. If you send the form, your phone, email and first name are sent as SHA-256 hashes, so Meta can match them to an account it already holds without receiving the values themselves, and the text of your message is never sent. The purpose is one: to know which ad brought whom, and to stop the ones that bring nobody.
Google Analytics
We use Google Analytics to learn where visitors come from and what they open. It is the only third-party script this site loads. Google records the pages you opened, the source you arrived from, your device and browser type, your country and city approximately, taps on WhatsApp, the phone number and the email, and that you sent the form, with nothing of its content. Your IP address is not stored in full, and the data is processed by Google under its own privacy policy. If you would rather not be counted, turn on tracking protection in your browser or install the Google Analytics opt-out add-on.
Cookies
This site sets two kinds of cookie. Google Analytics cookies (their names start with _ga) tell one visit from the next in the same browser. And _fbp and _fbc cookies, set by us, link your visit to the Facebook or Instagram ad you arrived from; they live for 90 days. There are no login or preference cookies, and the language comes from the URL itself. You can clear them from your browser settings at any time.
Pressing a WhatsApp button takes you out of this site and into WhatsApp, where your message and number are handled under WhatsApp's and Meta's policies rather than ours. What reaches Meta from the site itself is the measurement events described above, and nothing else.
How long we keep it
We delete your data when you ask. Write from the same email or number you used in the form, say you want it deleted, and we delete it and confirm.
If we change something
The date above changes. We do not apply a change retroactively to data submitted before it.