What happens to your data

Who is responsible

Search Lucid Ltd is the data controller for personal data collected through this website.

• Company: Search Lucid Ltd, registered in England and Wales, company number 14407505
• Registered office: 1a Connaught Road, London, England, E4 7DL
• Data protection contact: [email protected]

What is collected

When you submit the contact form

Only what you type into it:

• Name and email address: required, so I can reply
• Website and monthly ad spend range: optional
• Your message: please don't put anything confidential in it; it travels by ordinary email

Two things are added automatically when the form is submitted: the time of submission, and a two-letter country code derived from your IP address by Cloudflare. Your full IP address is not included in the email I receive. Both exist to help me spot automated abuse.

When you simply read the site

If you decline the cookie banner, or ignore it, nothing is stored on your device beyond the record of that decision. No analytics cookie is set, nothing records what you do on the page, and no advertising measurement runs.

One thing is still sent, and it is worth being direct about. Google Tag Manager, the script that holds this site's tags, loads from Google either way, and through it Google Analytics is told that a page was viewed. That signal carries no cookie and nothing that ties one page view to the next. Google's documentation lists what it does carry: the page, the time, your browser type and screen size, the page you came from, the fact that consent was refused, and a random number generated afresh on every page load. Like any request your browser makes, it arrives from your IP address, which Google says Analytics does not log or store. Google uses these signals to estimate, in aggregate, the visits it could not measure. I don't see them individually, and I can't tell you from any other visitor.

If you accept analytics, two things run. Google Analytics tells me which pages get read and roughly where visitors came from; it reports in aggregate, so I see that a page was read forty times, not that you read it. Microsoft Clarity does something different, and it is worth being direct about: it records your visit (the pages you open, how far you scroll, where you move the mouse, what you click) and lets me play it back. It is how I find the paragraph where people stop reading, rather than only the fact that they left. What you type is never captured: every field on the contact form is masked in your browser before anything is sent, so I can see which field you stopped at but not what you put in it. No name is attached to a recording either. But a replay of your visit is more than a count, which is why it sits behind consent and stops the moment you withdraw it. Microsoft also uses what Clarity collects for its own purposes, which is covered under Who else touches it.

Accepting analytics also lets the site remember, for thirty days, that you closed the "book a call" prompt on an article, so it doesn't reappear there. Without that consent the prompt simply comes back on your next visit, and nothing is stored.

The advertising group is built but dormant. I am not running ads to this site at the moment, so accepting it sets nothing today: it would start measuring only if I begin advertising, and I will ask you again before that happens.

Two things happen either way. Cloudflare, which serves the site, processes technical request data such as IP addresses for security and delivery as part of its own operations. And Google Tag Manager, which is the mechanism the banner controls, loads on every page, but with every storage permission switched off until you grant one.

Cookies

Nothing that needs your consent is set before you give it. When you first arrive, everything except the strictly necessary row below is switched off, and it stays off unless you turn it on.

Legal basis. The strictly necessary cookies are exempt from the consent requirement under the Privacy and Electronic Communications Regulations. Everything else is set on the basis of your consent, and the personal data that follows from it is processed on that same consent.

Changing your mind. Withdrawing is as easy as agreeing. Use the Cookies link in the footer of any page to reopen the panel and switch a group off. Cookies belonging to a group you switch off are deleted at that point. Clearing your browser's cookies for this site also resets the choice, and you'll be asked again.

I'll ask again after six months in any case, and sooner if I add something the current choice doesn't cover.

Why, and on what legal basis

I use what you send to read your enquiry, reply to it, and if it turns into work, to discuss and carry out that work.

The lawful bases under UK GDPR are legitimate interests (you have contacted a business expecting a reply, and responding is the obvious mutual interest) and, where an enquiry progresses toward an engagement, steps taken at your request prior to entering a contract.

Analytics and advertising measurement are the exception: the cookies, the session recording and the measurement that depends on them run on consent and nothing else, as set out under Cookies above. The cookieless page-view signal described under When you simply read the site is the one thing sent without it. For that I rely on legitimate interests: knowing roughly how many people visit, measured in a way that sets no cookie and identifies nobody. You can object to it, as set out under Your rights.

I will not add you to a mailing list, send you marketing you didn't ask for, or pass your details to anyone for their own marketing. There is no mailing list.

Who else touches it

Three providers process your enquiry on my behalf, each doing one job:

• Cloudflare: serves this website and runs the spam check on the form
• Resend: delivers the form submission to my inbox as an email
• Zoho Mail: hosts the mailbox the enquiry lands in

None of them use your data for their own purposes. Beyond these, your details are disclosed to nobody, except where I am legally required to.

If you accept cookies

Google (Google Ireland Limited, and Google LLC in the United States) receives measurement data about your visit through Google Analytics, Google Ads and Google Tag Manager. The cookies, and the measurement that depends on them, happen only if you have accepted the corresponding group in the cookie panel, and stop if you withdraw. Without that, Google still receives the cookieless page-view signal described under When you simply read the site.

Microsoft (Microsoft Corporation, in the United States, and its affiliates) receives the session recording described above through Microsoft Clarity. This also happens only if you have accepted analytics, and it stops if you withdraw.

Google and Microsoft are the two names on this page I cannot describe as processors acting only on my instructions. Each is a controller in its own right and also uses the data for its own purposes, which for Microsoft includes improving its products and, in its own words, creating profiles "for purposes that include advertising". That is set out in Google's own privacy terms and the Microsoft Privacy Statement. It is precisely why both sit behind consent rather than legitimate interests, and why declining costs you nothing here.

Transfers outside the UK

Cloudflare, Resend, Google and Microsoft are US-headquartered and operate global infrastructure, so your data may be processed outside the United Kingdom. Where that happens, the transfer is covered by appropriate safeguards under UK data protection law: an adequacy decision, the UK Extension to the EU–US Data Privacy Framework, or standard contractual clauses, depending on the provider.

How long it is kept

• Enquiries that don't lead to work: kept for up to 24 months in my email, then deleted. Business enquiries have a habit of resurfacing a year later, and it's useful to have the history.
• Enquiries that become clients: kept for the duration of our work together, then for 7 years after the final invoice, to meet UK accounting and tax record-keeping requirements.
• Analytics and advertising data: Google Analytics is set to delete both event data and user-level data after 14 months, and I see it only in aggregate. The cookies themselves expire on the timetable in the table above, or are deleted straight away if you withdraw consent.
• Session recordings: Clarity keeps a recording for 30 days, except one I mark to keep and a random sample Microsoft keeps, which last up to 9 months. Recordings cannot be downloaded, and nothing is kept from them beyond what I have already changed on the site as a result. What Microsoft keeps for its own purposes is governed by its privacy statement, not by me.

Ask me to delete your enquiry sooner and I will, unless I'm legally required to keep it.

Your rights

Under UK GDPR you can ask me to:

• Give you a copy of the personal data I hold about you
• Correct it if it's wrong
• Delete it
• Restrict or stop processing it
• Provide it in a portable format
• Stop relying on legitimate interests, by objecting to that processing

You can also withdraw consent for analytics and advertising at any time, and you don't need to email me to do it: the Cookies link in the footer reopens the panel on any page. Withdrawing doesn't affect anything that was lawfully done before you withdrew.

Email [email protected] and I'll respond within one month. There is no charge.

If you're unhappy with how I've handled your data you can complain to the Information Commissioner's Office at ico.org.uk/make-a-complaint, or on 0303 123 1113. I'd rather you raised it with me first so I can put it right.

Changes

If this notice changes materially, the date below changes with it. There is no archive of previous versions; if that matters to you, save a copy.

Last updated: 13 October 2026