02Legal
What we collect, why, and how to ask us to change or delete it.
This page explains what personal data LUMENLOOM (“we”, “us”) collects when you use lumenloom.studio and the project sites published under it, such as lumenloom.studio/indigo-dreams, and what we do with it. We keep this deliberately small: the sites show our work and let you reach us. There are no accounts to create and no payments are taken.
Who we are
LUMENLOOM, a visual production studio in Lisbon, Portugal, is the controller of the data described here. Write to hello@lumenloom.studio, or use the contact form, about anything on this page.
What we collect
Messages you send us. If you use a contact or booking form on any of our sites, we receive the name, contact details and message you choose to give, and any optional fields (location, dates, timeline, budget, how you found us). They reach the studio’s inbox and a private Telegram group so a person can answer.
A waitlist address. If you join a waitlist, the email address you give, so we can tell you when places open.
A security check. Cloudflare Turnstile checks that a person, not a script, is sending a form or signing in. It looks at signals from your browser for that check only.
Basic technical data. Like any website, our server and Cloudflare, our network provider, log IP addresses and browser details for security and to keep the sites running. We do not use them to profile you.
Analytics, only with your consent. If you accept cookies we use Google Analytics to count visits. Until you accept, nothing is stored and nothing is sent. See our Cookie Policy.
We do not collect special category data and do not ask for it. Please do not send it to us.
Why we use it
To read and answer your message, and to arrange a shoot or a project if you ask us to — because you asked, and because we have a legitimate interest in answering people who write to us.
To keep the sites secure and available — our legitimate interest.
To understand which pages are read — only with your consent, which you can withdraw at any time.
Each of these sees only what its job needs:
Brevo sends email on our behalf, so it handles your address and your message.
Telegram is where a new message is announced to the studio.
Cloudflare serves the sites, filters abusive traffic and runs the Turnstile check.
Google receives page-view data if you accepted analytics, and may receive your IP address when fonts load from Google Fonts.
Wasabi keeps encrypted off-site copies of our backups.
We never sell your data or share it for advertising.
Where it is kept
Our sites, their databases and our photography are hosted on our own server in the European Union. Some of the services above are based in the United States and may process data there under the appropriate safeguards, including standard contractual clauses.
How long we keep it
Messages and booking requests: three years from your last contact with us, unless you ask us to delete them sooner.
Waitlist sign-ups: until you unsubscribe or the waitlist closes.
Analytics: 14 months.
Server logs: 30 days.
Backups: seven days on our server, then replaced.
Your rights
Under the GDPR you can ask us to show you the data we hold about you, correct it, delete it, restrict or object to its use, or send it to you in a portable form, and you can withdraw consent for analytics at any time. Write to hello@lumenloom.studio and we will answer within one month. If you are not satisfied, you can complain to the Portuguese supervisory authority, the CNPD.
Changes
If this policy changes, we will update it here and change the date below. Questions? Get in touch.
Last updated: 23 September 2026
Also in legal