Privacy Policy

This privacy policy explains how Lucid Directions Ltd ("Lucid Directions", "we", "us", "our") collects, uses, and protects personal data when you visit www.luciddirections.co.uk, contact us through the website, or use our Jimmy chat assistant.

We are committed to handling your data lawfully, transparently, and with as little of it as possible. If you have any questions about anything in this policy, email info@luciddirections.co.uk and we will respond promptly.

1. Who we are

The data controller for the personal data we collect is:

We are a small business and are not required to appoint a Data Protection Officer. Privacy queries are handled directly by the founders.

2. What data we collect and why

Contact form

When you submit the contact form on this site we collect the name, email address, and message you provide. We use this data to respond to your enquiry and to maintain a record of the conversation.

Lawful basis: legitimate interests (responding to a prospective or existing client) and, where you initiate the contact, the steps necessary to consider entering into a contract.

Jimmy chat

If you use the Jimmy chat widget, the messages you send are processed in order to generate a reply. The chat session, your messages, and the assistant's responses are stored temporarily so we can monitor the quality of the system, detect abuse, and manage costs. We do not link chat sessions to identifiable individuals unless you provide identifying information inside your messages.

Lawful basis: legitimate interests (operating and improving a tool we provide on our website).

Technical data

Our hosting providers automatically receive standard technical information when your browser requests a page: IP address, user agent, request time, and the page requested. This is used for security, abuse prevention, and operating the service. We do not run third-party advertising or behavioural tracking on this site.

Lawful basis: legitimate interests (operating a secure website).

3. Cookies and similar technologies

This website does not use cookies for marketing, analytics, or advertising. The Jimmy chat widget may use your browser's local storage to remember a session identifier within a single visit so the conversation flows naturally. No personal identifiers are placed in this storage, and the data is cleared when you clear your browser data.

Because we do not deploy non-essential cookies, we do not display a cookie consent banner. If this changes, we will update this policy and add appropriate consent controls.

4. Who we share data with

We use a small number of trusted service providers to deliver this site and respond to you. They act as data processors on our behalf and are only permitted to use personal data for the purposes we instruct.

• Vercel Inc. (United States) hosts this website and runs the contact form endpoint. Server logs include IP address, request metadata, and any data you submit through the contact form. Vercel privacy policy.
• Resend Inc. (United States) sends emails generated by the contact form to our inbox. Resend processes the name, email address, and message you submit. Resend privacy policy.
• Cloudflare, Inc. (United States) runs the Jimmy chat worker and stores conversation logs in temporary key-value storage. Cloudflare privacy policy.
• Anthropic, PBC (United States) provides the language model that generates Jimmy's responses. Messages you send to Jimmy are forwarded to Anthropic for the sole purpose of generating a reply. Anthropic does not use this content to train its models. Anthropic privacy policy.

We do not sell personal data. We do not share it with advertisers or data brokers. We will only disclose data to law enforcement or other public bodies if we are legally required to do so.

5. International transfers

Several of the processors listed above are based in the United States. Where personal data is transferred outside the United Kingdom, we rely on appropriate safeguards under UK GDPR, including the UK International Data Transfer Agreement, the UK Addendum to the EU Standard Contractual Clauses, or transfers to jurisdictions covered by an adequacy decision. You can request a copy of the safeguards in place for a specific transfer by emailing us.

6. How long we keep your data

• Contact form submissions and any follow-up correspondence are retained for as long as is necessary to operate the resulting business relationship, and for up to seven years afterwards to meet UK accounting and contract-record obligations.
• Jimmy chat logs are retained for up to 90 days for service quality and abuse-prevention purposes, after which they are deleted automatically.
• Server access logs are retained by our hosting providers in line with their standard retention windows, typically 30 to 90 days.

If you ask us to delete data sooner, we will do so where we are not required by law to retain it.

7. Your rights

Under UK GDPR you have the right to:

• request access to the personal data we hold about you;
• request that inaccurate or incomplete data be corrected;
• request the deletion of your data ("right to be forgotten") where we no longer have a lawful reason to keep it;
• request that we restrict processing of your data in certain circumstances;
• object to processing carried out on the basis of legitimate interests;
• request a copy of your data in a portable format;
• withdraw any consent you have given us at any time, without affecting processing already carried out.

To exercise any of these rights, email info@luciddirections.co.uk. We will respond within one month and we will not charge you for a reasonable request.

8. Right to complain

If you believe we have not handled your data fairly or lawfully, you have the right to lodge a complaint with the UK Information Commissioner's Office.

We would appreciate the chance to address your concern first, so please consider contacting us before escalating.

9. Security

We take reasonable technical and organisational measures to protect personal data against unauthorised access, accidental loss, and misuse. These include encryption in transit, strict access controls on our infrastructure, rate limiting on public endpoints, and the principle of collecting as little data as possible in the first place. No system is perfectly secure, and we cannot guarantee absolute security.

10. Children

This website is aimed at businesses and is not directed at children under the age of 16. We do not knowingly collect personal data from children. If you believe we have, please contact us and we will delete it.

11. Changes to this policy

We may update this policy from time to time to reflect changes to our services, our processors, or the law. When we do, we will update the "last updated" date at the top of this page. Significant changes that affect how we use your data will be highlighted on the site or, where appropriate, communicated to you directly.

12. Contact

Questions about this policy or about how we handle your data should be sent to info@luciddirections.co.uk, or by post to the registered office above.