Privacy Policy

What we collect

Two forms on this site collect anything: the contact form and the four-question strategy session at /start. Between them we collect your name, email address, phone number, company or website, the services you tick, a budget range, and whatever you type into the message or free-text fields.

The strategy session also stores your answers in your own browser's localStorage under the key lampy:wizard, so you can leave and come back without starting over. That copy lives on your device. Clearing your browser storage deletes it, and nothing on our side depends on it.

Our server logs record the usual request metadata — IP address, timestamp, user agent — because that is how a web server works. We use the IP address to rate-limit form submissions and chat messages so the endpoints cannot be flooded.

The Lumen chat

Messages you send to Lumen are forwarded to an AI provider (Anthropic, reached through the Vercel AI Gateway) to generate a reply, then streamed straight back to you. We do not store your chat transcripts, and the provider does not use them to train models.

If no AI key is configured, Lumen answers from a deterministic rule engine built from this site's own content, and nothing leaves our server at all.

Do not send confidential information, credentials, or anything you would not put in a first email to a supplier. It is a scoping tool, not a secure channel.

How we use it

To reply to you. To scope a project. To send the strategy you asked for. That is the list.

We do not sell your data, we do not rent it, and we do not enrich it with third-party datasets. We do not set advertising cookies on this site and we do not run cross-site tracking pixels.

If you become a client, your contact details move into our project systems and are governed by the agreement we sign with you.

Who else sees it

Our hosting provider processes requests to serve the site. Our AI provider processes chat and strategy messages to generate a response. If we have configured a lead webhook, form submissions are forwarded to the CRM or inbox we run the studio on.

That is the complete list of processors. We do not add one without updating this page.

How long we keep it

Enquiries that do not become projects are deleted within 24 months. Enquiries that do become projects are kept for the life of the engagement plus the period our accountants and tax authorities require, which is currently seven years.

Server logs roll off within 30 days. Chat transcripts are never written to disk.

Your rights

You can ask us for a copy of what we hold, ask us to correct it, ask us to delete it, or object to us holding it at all. If you are in the EU, UK or California, those rights are backed by law; we honour them for everyone regardless of where you are.

Email hello@lampy.studio with the word "data" in the subject line. We reply within 30 days and usually within two business days. We will not ask you to prove your identity beyond confirming you control the email address involved.

Security

The site is served over HTTPS. Form endpoints are rate-limited and validated on the server. Access to lead data is limited to the three people who work here, all of whom use two-factor authentication.

No system is perfect. If you find a vulnerability, email us and we will credit you if you want the credit.

Changes

If we change this policy in a way that affects what we do with your data, we update the date below and, where we hold your email address because of an enquiry, we tell you.