Plain-language summary. We collect what we need to verify who you are, generate your personalised product, process your payment securely, deliver your vault, and keep accurate records of your order — including the approval, delivery and access records that protect both sides of the transaction. We don't sell your data. You have rights over your personal data under the UK GDPR and the Data Protection Act 2018, and you can contact us about them at any time.
1. Who is responsible for your data
Lucerna Labs Limited, trading as “Lucerna Labs” (Company No. 16577262, 25 Dunkellin Way, South Ockendon, England, RM15 5ES) is the controller of personal data processed through lucerna-lab.com. Contact: [email protected].
We process personal data in accordance with UK GDPR and the Data Protection Act 2018.
2. What we collect
| Category | Examples | When |
|---|---|---|
| Account & identity | Legal name, email (verified), mobile number (verified), country, billing address, intended business or personal use, business/brand name | Account creation |
| Enhanced verification | Government-issued ID details and verification results, processed via our verification provider | Orders of US$5,000+ |
| Configuration data | Your Build Questionnaire answers — business type, target customer, offer, brand preferences, selected modules and licence | Before preview generation |
| Order & approval records | Approved preview version, date and time of approval, IP address, device information, order specification, terms version | At approval and checkout |
| Payment data | Payment method, authentication (3-D Secure) results, transaction amount and status. Card numbers are processed by our PCI-DSS-compliant payment providers and are not stored on our systems. | At checkout |
| Delivery & usage records | Delivery timestamps, file manifest and checksums, emails/SMS sent, vault log-ins, files opened or downloaded, licence activation | From unlock onward |
| Communications | Support messages and complaint records | When you contact us |
| Technical data | Device, browser, IP address, and cookie data as described in section 8 | When you use the Site |
3. Why we process it
- To perform our contract with you — generating your preview, processing your order, unlocking your vault, issuing your licence certificate, and providing support and Change Orders.
- To comply with legal obligations — tax invoicing, consumer-protection requirements, identity-verification and anti-fraud obligations, and lawful requests from authorities.
- For our legitimate interests — securing the Site and vaults, preventing fraud, and maintaining complete records of each order's configuration, preview, approval, payment authentication, delivery and access. These records protect both parties: they evidence what was purchased and delivered, and are used where a payment dispute, chargeback or complaint arises.
- With your consent — marketing communications (which you can withdraw at any time) and non-essential cookies.
4. Who we share it with
- Payment service providers and acquiring banks (to process payments and authentication);
- identity-verification providers (for enhanced verification on high-value orders);
- hosting, email/SMS delivery, and analytics providers acting as our processors;
- card schemes, acquirers and issuing banks, where reasonably necessary to respond to a payment dispute or chargeback concerning your order;
- professional advisers, and courts or authorities where required by law.
We do not sell personal data.
5. International transfers
Some providers process data outside the United Kingdom. Where personal data is transferred internationally, we do so in accordance with UK GDPR — to jurisdictions with an adequate level of protection or subject to appropriate safeguards such as contractual protections with our processors, and only for the purposes described in this policy.
6. How long we keep it
| Records | Retention |
|---|---|
| Order, approval, delivery, access and dispute-evidence records | 5 years from the transaction, or longer where a dispute or legal obligation requires |
| Tax invoices and accounting records | As required by UK tax law (6 years minimum) |
| Identity-verification records | For as long as required for anti-fraud, chargeback defence and applicable verification obligations, then securely deleted or anonymised |
| Account data | While your account is active, then 12 months after closure (unless we must retain records longer for legal reasons) |
| Marketing preferences | Until you withdraw consent |
7. Your rights
Subject to UK GDPR and the Data Protection Act 2018, you have the right to: access your personal data; request correction of inaccurate data; request erasure; restrict or object to certain processing; receive a portable copy of data you provided; and withdraw consent (for consent-based processing) at any time without affecting prior processing. Note that we may be legally entitled or required to retain order and dispute-evidence records notwithstanding an erasure request.
To exercise any right, contact [email protected]. We respond within the timeframes required by UK GDPR. You may also lodge a complaint with the Information Commissioner’s Office (ICO) or other competent authority.
8. Cookies
We use essential cookies (sign-in, security, checkout) that are necessary for the Site to function, and — only with your consent — analytics cookies that help us improve the Site. You can manage non-essential cookies at any time via Cookie Settings, the cookie banner, or your browser settings. Full details are in our Cookie Policy.
9. Security
We apply appropriate technical and organisational measures, including encryption in transit, access controls, watermarking of previews, checksum verification of delivered files, and logging of vault access. Payment card data is handled exclusively by PCI-DSS-compliant providers.
10. Children
The Site is for users aged 18 and over. We do not knowingly process children's personal data.
11. Changes and contact
We will post any changes to this policy on this page with a new version number and date. Material changes will be notified to account holders by email.
Lucerna Labs Limited, trading as “Lucerna Labs” · Company No. 16577262 · 25 Dunkellin Way, South Ockendon, England, RM15 5ES · [email protected]