Cookie Policy

Document reference

LUC-LEG-003

Effective date

24 April 2026

Last updated

24 April 2026

This Cookie Policy explains how Lucevo uses cookies and similar technologies on lucevo.io and any subdomains. It supplements Section 10 of our Privacy Policy — read them together for the complete picture of how we handle personal data collected through your browser.

We operate under the UK General Data Protection Regulation (UK GDPR), the Privacy and Electronic Communications Regulations (PECR), and the Data (Use and Access) Act 2025 (DUAA), in each case as amended from time to time. Under PECR as amended in the UK, certain low-risk cookies and similar technologies may in limited cases be used without prior consent. Where we rely on any such exception, we do so only where the relevant legal conditions are met. For visitors in the EEA, we continue to seek consent for non-essential analytics cookies unless a lawful exemption clearly applies.

You can manage your cookie choices at any time by selecting “Cookie Preferences” in the footer of the Site or by reopening our cookie banner. You can also change certain browser settings to block or delete cookies, although doing so may affect site functionality.

If you are reading this from a hotel’s website that uses Lucevo’s agents behind the scenes, that hotel is the data controller for its own site and cookies. Please consult the hotel’s own cookie notice.

A cookie is a small text file a website stores on your device when you visit it, so the site can remember who you are, what you’ve done, or what you prefer on your next visit.

In this notice, references to cookies include similar technologies that store information on or access information from your device, including:

• Browser local storage and session storage — used to persist UI state such as whether you’ve dismissed the cookie banner.
• Pixels and tracking tags — small snippets of code that load an invisible resource to record that a page or action was seen.
• Software development kits (SDKs) — libraries provided by third parties that may read or write identifiers client-side.

Where this notice says “cookie”, treat it as covering all of the above unless otherwise indicated.

We group cookies into four categories, each with a different legal basis. The following section lists the specific cookies in use.

Strictly necessary

Essential for the website to function — for example, routing your request to the right server, remembering that you have dismissed the cookie banner, or preserving the state of the audit form between steps.

Strictly necessary cookies are exempt from consent where they are required to provide a service requested by the user or to transmit a communication over an electronic communications network.

Low-risk analytics

First-party, privacy-preserving audience measurement used solely to understand how our site is used and to improve it. We currently use Cloudflare Web Analytics, which is cookieless and does not track visitors across sites or build individual profiles. Because no cookie is set and no personal data leaves the aggregated measurement system, this measurement typically does not require prior consent under UK or EEA law.

If we add any cookie-based or cross-site analytics in future, we will update this notice and seek consent where required.

Functional

Remember preferences you set — for example, a chosen language or whether you’ve signed in on a return visit. Set only with your consent.

Marketing (not currently active)

Used to measure the performance of campaigns, attribute conversions, or personalise content you see on third-party platforms. Set only with your consent. We do not currently deploy this category, but we reserve the right to do so once we begin paid acquisition — you will be asked to consent before any such cookie is set.

Blocking or removing cookies in any category will not stop you using the site, but strictly necessary cookies are required for core functionality such as submitting the audit form.

For each cookie or similar technology we use, this notice identifies the name, provider, purpose, category and retention period. Cookies may remain on your device only for the duration of your browser session or for a longer defined period after the session ends, depending on their purpose.

Because Lucevo is a young company and our stack is still being finalised, the list below reflects our current deployment and will be updated as we go. If you want the list as it stood on a specific date, email [email protected].

First-party cookies

• LUCEVO_CONSENT — Provider: Lucevo. Purpose: records your cookie-banner choice so we don’t ask again on every visit. Category: strictly necessary. Retention: 12 months.

Third-party cookies

• Railway — Our application hosting provider. May set transient cookies for load balancing, bot detection, and abuse prevention. Category: strictly necessary. Retention: short-lived (typically session-only).
• Cloudflare — Our DNS, CDN, and security layer. May set transient cookies such as __cf_bm and cf_clearance for bot management, DDoS protection, and service continuity. Category: strictly necessary. Retention: typically 30 minutes to 30 days.
• Cloudflare Web Analytics — Used for privacy-preserving, first-party audience measurement. This service is cookieless and does not track visitors across sites. No cookie is set. Data is aggregated and anonymised.
• Embedded content — If we embed video, maps, or similar content from a third party, that provider may set its own cookies when the content loads. We keep this to a minimum and we do not currently rely on any embedded third-party content on lucevo.io.

Some cookies are set directly by Lucevo (first-party cookies), while others may be set by third-party service providers acting on our behalf or, where applicable, for their own purposes as described in this notice.

5.1 On lucevo.io

When you first visit the site we show a cookie banner that lets you accept all, reject non-essential, or manage by category. You can reopen the banner at any time via the “Cookie Preferences” link in the footer of every page to change or withdraw your choices.

You can accept or reject non-essential cookies through our cookie banner or preferences centre. Rejecting non-essential cookies is made available in the same place and with the same ease as accepting them. We never require consent to multiple categories bundled together, and we never treat “do nothing” as consent.

Where consent is required, we ask for it through our cookie banner or preferences centre before setting non-essential cookies or similar technologies. Non-essential cookies and similar technologies are blocked by default unless and until you choose to enable them.

When you submit a cookie preference, we record the choice made, the date and time of that choice, and the version of this notice in force at the time, so that we can demonstrate compliance where required.

5.2 In your browser

Every major browser lets you block, delete, or be warned about cookies. The exact steps differ by browser and device — the independent guide at allaboutcookies.org keeps current instructions for Safari, Chrome, Firefox, Edge, and mobile browsers. Clearing your cookies will also clear the record of any choice you made on our banner, so you will see the banner again on your next visit.

5.3 Global Privacy Control and Do Not Track

Where your browser sends a Global Privacy Control (GPC) signal and our tooling can detect it, we will treat it as a valid opt-out of non-essential cookies for the session. We do not rely on the older Do Not Track (DNT) signal in isolation, as it has no agreed standard, but we honour it where possible alongside GPC.

5.4 Fingerprinting

We do not intentionally deploy browser fingerprinting technologies on lucevo.io. If this changes, we will update this notice before doing so.

Where a cookie is set by a third party, or where data collected via a cookie is processed by a sub-processor outside the UK or the European Economic Area, the safeguards described in Sections 06 and 07 of our Privacy Policy apply — including the UK International Data Transfer Agreement, Standard Contractual Clauses, and written sub-processor contracts.

Where analytics technologies are used, they are configured to measure site performance and usage patterns. Depending on the tool, this may include device, browser, referral and page interaction data as described in our Privacy Policy.

Where information collected through cookies constitutes personal data, our Privacy Policy explains the legal bases, recipients, retention periods and international transfer safeguards that apply.

6.1 We do not sell your data

We do not sell personal information collected through cookies. Where we use third-party providers for analytics, consent management or website functionality, those providers may receive limited technical data as described in this notice and our Privacy Policy. We do not share cookie data with advertising networks for cross-site profiling.

Because lucevo.io may be accessed from both the United Kingdom and the European Economic Area, cookie controls may differ by visitor location where UK and EEA legal requirements are not identical. The DUAA 2025 changes apply to UK law only; EEA visitors continue to be governed by the EU ePrivacy Directive as implemented in their country.

This Site is intended for business users and not for children. We do not knowingly use non-essential cookies to profile children through the Site.

We may update this Cookie Policy when our site, stack, or the law changes. We will update the “Last updated” date above and, for material changes, surface a notice on the site or by email to registered contacts.

For any question about how Lucevo uses cookies, or to request the cookie inventory as of a specific date:

Email

[email protected]

Website

https://lucevo.io

Regulator

Information Commissioner’s Office — ico.org.uk

Full company details (including registered office and company number) are in Section 02 of our Privacy Policy.

• Version 1.0 — 24 April 2026 — Initial publication.