How we handle your data.

Who’s responsible (data controller)

This site is operated by Oliver Victor Mingo Simonsen, based in Denmark. Lumoheart is a project in development. The operator plans to formalise it as a Danish company in due course, and this page will be updated when that happens.

For any privacy question, write to [email protected]. We reply within 30 days.

What we collect, and why

Waitlist signup

• Email address — to send you confirmation, welcome, and product-update emails.
• A snapshot of the consent text you agreed to, and the version number — so we have proof of what you opted in to.
• IP address, hashed with SHA-256 before storage. The raw IP is never written to disk. Used as an anti-abuse signal only.
• User-agent header (truncated to 200 characters) — anti-abuse signal.
• Timestamps of signup, confirmation, and (if applicable) unsubscribe.

Contact form

• Name, email, message — forwarded to our inbox so we can write back. Stored only in our email inbox; no separate database row is created.

Spam protection (Cloudflare Turnstile, invisible mode)

We use Cloudflare Turnstile to block automated form abuse. Turnstile collects technical signals such as device data, input timing, and an anonymised browser fingerprint to distinguish humans from bots. We never see or store this data. Cloudflare processes it on their infrastructure. For full detail see the Cloudflare Turnstile Privacy Addendum.

Legal basis (GDPR Article 6)

• Waitlist: explicit consent — Article 6(1)(a). You opt in by entering your email and clicking the confirmation link. You can withdraw consent at any time via the unsubscribe link in any email we send.
• Contact form: legitimate interest — Article 6(1)(f). Replying to a message you sent us.
• Turnstile: legitimate interest — Article 6(1)(f). Preventing automated abuse of the forms.

How long we keep your data

• Waitlist email + consent snapshot: until you unsubscribe. After unsubscribe, the row is marked as unsubscribed; we keep just enough information to make sure we never accidentally email you again.
• IP hash and user-agent: 12 months from signup, then deleted. After that they’re no longer useful as an anti-abuse signal.
• Contact form messages: in our email inbox until manually deleted. Typical lifetime is “as long as the conversation is still relevant.”
• If the project is wound down before product launch, we’ll delete the entire waitlist and notify everyone on it by email.

Who processes data on our behalf (subprocessors)

We rely on a small set of service providers. Each is bound by GDPR Article 28 — they may only process your data on our instructions.

• Cloudflare — site hosting (Pages), database (D1), DNS, spam protection (Turnstile). Some processing in EU data centres; some in the US under Standard Contractual Clauses.
• Brevo (formerly Sendinblue) — sends our confirmation, welcome, and contact-form emails. Servers in the EU (France/Germany).
• simply.com — provides our email inbox at [email protected]. Denmark.
• GitHub — hosts our source code. No user data stored here.

International transfers: when your data leaves the EEA (e.g., to Cloudflare US infrastructure), Standard Contractual Clauses are in place to provide an adequate level of protection under EU law.

Your rights under GDPR

You have the right to:

• Access the personal data we hold about you
• Correct inaccurate data
• Delete your data (the “right to be forgotten”)
• Restrict how we process your data
• Portability — receive your data in a portable format
• Object to processing based on legitimate interest
• Withdraw consent at any time, without affecting prior lawful processing
• Lodge a complaint with the Danish Data Protection Authority (Datatilsynet — datatilsynet.dk)

To exercise any of these, write to [email protected]. We respond within 30 days.

Cookies and local storage

We use only essential, first-party storage:

• A short-lived Cloudflare Turnstile session token (anti-abuse only).
• No analytics cookies.
• No advertising cookies.
• No cross-site tracking.
• Your language preference (English or Danish) is stored in your browser's local storage under the key 'lang'; it is first-party, essential for the site to remember your choice, and requires no consent.

Because we don’t set any cookies that require consent under EU law, this site shows no cookie banner.

Children

This site is not directed at children under 16. We don’t knowingly collect data from minors. If you believe a minor has signed up, contact us and we’ll delete their data right away.

Changes to this policy

If we materially change this policy, we’ll email everyone on the waitlist with the new version before it takes effect. Non-material edits (typos, clarifications) are made silently. The “Effective from” date at the top of this page always reflects the most recent material revision.