Privacy notice

Last updated 5 October 2026. This notice covers luxd.design (LUXD Design), including LUXD Studio and LUXD Local.

Who we are

LUXD LTD. Registered in England and Wales, company number 17465024. LUXD LTD is the controller of the personal data described here. For anything about your data, email william@luxd.co.uk. We aim to reply within five working days, and always within one month.

What we collect, and why

We only collect what you choose to send us through a form on this site.

• The contact form and the package builder: your name, email address, company or business name (optional), your message, whether you chose LUXD Studio or LUXD Local, and the package or packages you picked.
• The Lux Score reading and Lux Review (LUXD Studio): your email address, your name if you give it, the company stage, core problem focus and problem statement you enter, your website address if you give one, and the score worked out from them. The meter shows a score in your browser as you type; nothing is sent to us unless you press send. When you do, our server works the score out again from your answers.
• The website check: if you give a website, our server asks its home page for its status once, over HTTPS, the way a browser would before loading it. We record whether a secure connection worked and the status code the site returned. We do not download, store or run any of the site's pages.
• Your Lux Review email: sent once, to the address you enter, with your score and the website check. Your problem statement and name are not included in it.
• Abuse protection: to stop the reading being misused, we count requests from each connection and each email address for 24 hours. We store only a one-way hash of the IP address and of the email address with that count, never the address itself, and the count deletes itself after 24 hours. Cloudflare Turnstile checks that a person, not a script, is sending the form.
• Added automatically when you send it: the date and time, and the country your connection comes from, as reported by our hosting provider. We do not store your IP address with your enquiry.

We use this information to reply to you, to write a proposal if you ask for one, and to keep a record of the conversation. We do not use it for marketing lists, we do not sell it, and we do not share it with anyone except the service providers named below.

Our legal basis

Under UK GDPR, we rely on taking steps at your request before entering into a contract (Article 6(1)(b)) when you ask about working with us, and on our legitimate interest in answering messages sent to us (Article 6(1)(f)) for everything else you send through the site.

Who processes it for us

• Cloudflare, Inc. hosts this website, runs the form handler and stores a copy of each enquiry in LUXD LTD's Cloudflare account.
• Cloudflare Turnstile checks the Lux Review form is sent by a person. It runs only when you open the send step, and Cloudflare receives the technical signals it needs from your browser to do that.
• Resend sends your Lux Review email to the address you enter.
• Web3Forms delivers each enquiry to our inbox as an email. The message is sent to Web3Forms either by our server or directly by your browser; when your browser sends it, Web3Forms also receives your IP address, as any website you connect to does.
• Google provides the business email account the enquiry arrives in.

Each acts on our instructions. Some of them process data outside the UK, including in the United States. Where that happens, the transfer is covered by the provider's own safeguards, such as the UK International Data Transfer Addendum or the UK–US data bridge.

How long we keep it

The copy stored with our hosting provider deletes itself automatically 24 months after you send it. Enquiry emails are kept for the same 24 months and then deleted, unless you become a client, in which case the records are kept for as long as UK company and tax law requires, usually six years after the work ends.

Lux Method sprints and test sessions

This section applies if you take part in a Lux Method sprint, as a client or as someone testing a prototype.

• Sprint clients: your name, role, work email, the readings you take on this site (Day 1 and Day 5), your answers to the post-sprint survey, and notes from our working sessions. We use them to run the sprint and write your sprint report. Legal basis: our contract with you (Article 6(1)(b)).
• Test sessions: if you test a prototype, we record the session (video, audio and screen) only with your written consent, given before it starts. We also keep notes of what you did and said, and measures such as whether you finished a task and how long it took. Legal basis: your consent (Article 6(1)(a)), which you can withdraw at any time.
• Case studies: a free place in a Lux Method cohort is given in return for permission to publish a before-and-after case study on luxd.design. You approve the text before it is published, and you can ask for it to be anonymised. Test participants are never named or shown in a case study.
• Video testimonials: optional, and only with separate written consent. When we publish one, we say that the sprint was provided free.

Who processes it: Google (Google Meet for calls and recordings, Google Drive for storing recordings and notes), in addition to the providers listed above.

How long we keep it: recordings are deleted 90 days after the sprint ends. Notes and test results are kept for 24 months, with test participants identified only by a number. A published case study or testimonial stays on the site until you ask us to remove it. We will take it down within 10 working days.

Cookies and storage on your device

This site sets no cookies of its own and loads no analytics, advertising or tracking scripts. Fonts and images are served from this site, not from third parties. If you use the light/dark switch, your choice is saved in your own browser (local storage, under "luxd-theme") so the site remembers it; it is never sent to us, and clearing your browser data removes it. Our hosting provider may set a strictly necessary security cookie to protect the site from automated attacks.

Links to other sites

Booking links open Calendly, and some pages link to LinkedIn or client websites. Those services have their own privacy notices, and this one does not cover them.

Your rights

You can ask us to give you a copy of your data, correct it, delete it, restrict how we use it, or object to our using it, and you can ask for it in a portable format. Email william@luxd.co.uk. There is no charge.

If you are unhappy with how we have handled your data, you can complain to the Information Commissioner's Office at ico.org.uk/make-a-complaint or on 0303 123 1113. We would appreciate the chance to put it right first.

Children

This site is for businesses and is not aimed at anyone under 18.

Changes

If this notice changes, the new version will appear here with a new date at the top.