What happens to your data

Who is responsible

Search Lucid Ltd is the data controller for personal data collected through this website.

• Company: Search Lucid Ltd, registered in England and Wales, company number 14407505
• Registered office: 1a Connaught Road, London, England, E4 7DL
• Data protection contact: harry@searchlucid.com

What is collected

When you submit the contact form

Only what you type into it:

• Name and email address: required, so I can reply
• Website and monthly ad spend range: optional
• Your message: please don't put anything confidential in it; it travels by ordinary email

Two things are added automatically when the form is submitted: the time of submission, and a two-letter country code derived from your IP address by Cloudflare. Your full IP address is not included in the email I receive. Both exist to help me spot automated abuse.

When you simply read the site

If you decline the cookie banner, or ignore it, I learn nothing about you. No analytics runs, nothing records what you do on the page, no advertising measurement runs, and nothing is stored on your device beyond the record of that decision.

If you accept analytics, two things run. Google Analytics tells me which pages get read and roughly where visitors came from; it reports in aggregate, so I see that a page was read forty times, not that you read it. Contentsquare does something different, and it is worth being direct about: it records your visit (the pages you open, how far you scroll, where you move the mouse, what you click) and lets me play it back. It is how I find the paragraph where people stop reading, rather than only the fact that they left. What you type is never captured: every field on the contact form is stripped in your browser before anything is sent, so I can see which field you stopped at but not what you put in it. No name is attached to a recording either. But a replay of your visit is more than a count, which is why it sits behind consent and stops the moment you withdraw it.

Accepting analytics also lets the site remember, for thirty days, that you closed the "book a call" prompt on an article, so it doesn't reappear there. Without that consent the prompt simply comes back on your next visit, and nothing is stored.

The advertising group is built but dormant. I am not running ads to this site at the moment, so accepting it sets nothing today: it would start measuring only if I begin advertising, and I will ask you again before that happens.

Two things happen either way. Cloudflare, which serves the site, processes technical request data such as IP addresses for security and delivery as part of its own operations. And Google Tag Manager, which is the mechanism the banner controls, loads on every page, but with every storage permission switched off until you grant one.

Cookies

Nothing that needs your consent is set before you give it. When you first arrive, everything except the strictly necessary row below is switched off, and it stays off unless you turn it on.

Legal basis. The strictly necessary cookies are exempt from the consent requirement under the Privacy and Electronic Communications Regulations. Everything else is set on the basis of your consent, and the personal data that follows from it is processed on that same consent.

Changing your mind. Withdrawing is as easy as agreeing. Use the Cookies link in the footer of any page to reopen the panel and switch a group off. Cookies belonging to a group you switch off are deleted at that point. Clearing your browser's cookies for this site also resets the choice, and you'll be asked again.

I'll ask again after six months in any case, and sooner if I add something the current choice doesn't cover.

Why, and on what legal basis

I use what you send to read your enquiry, reply to it, and if it turns into work, to discuss and carry out that work.

The lawful bases under UK GDPR are legitimate interests (you have contacted a business expecting a reply, and responding is the obvious mutual interest) and, where an enquiry progresses toward an engagement, steps taken at your request prior to entering a contract.

Analytics and advertising measurement are the exception: those run on consent and nothing else, as set out under Cookies above.

I will not add you to a mailing list, send you marketing you didn't ask for, or pass your details to anyone for their own marketing. There is no mailing list.

Who else touches it

Three providers process your enquiry on my behalf, each doing one job:

• Cloudflare: serves this website and runs the spam check on the form
• Resend: delivers the form submission to my inbox as an email
• Zoho Mail: hosts the mailbox the enquiry lands in

None of them use your data for their own purposes. Beyond these, your details are disclosed to nobody, except where I am legally required to.

If you accept cookies

Google (Google Ireland Limited, and Google LLC in the United States) receives measurement data about your visit through Google Analytics, Google Ads and Google Tag Manager. This happens only if you have accepted the corresponding group in the cookie panel, and it stops if you withdraw.

Contentsquare (Content Square SAS, of France) receives the session recording described above. Unlike Google it acts as my processor: on my instructions, for my purposes, and not for its own. This also happens only if you have accepted analytics, and it stops if you withdraw.

Google is the one name on this page I cannot describe as a processor acting only on my instructions: it also uses the data for its own purposes as a controller, which is set out in Google's own privacy terms. That is precisely why it sits behind consent rather than legitimate interests, and why declining costs you nothing here.

Transfers outside the UK

Cloudflare, Resend and Google are US-headquartered and operate global infrastructure, and Contentsquare is French and does the same, so your data may be processed outside the United Kingdom. Where that happens, the transfer is covered by appropriate safeguards under UK data protection law: an adequacy decision, the UK Extension to the EU–US Data Privacy Framework, or standard contractual clauses, depending on the provider.

How long it is kept

• Enquiries that don't lead to work: kept for up to 24 months in my email, then deleted. Business enquiries have a habit of resurfacing a year later, and it's useful to have the history.
• Enquiries that become clients: kept for the duration of our work together, then for 7 years after the final invoice, to meet UK accounting and tax record-keeping requirements.
• Analytics and advertising data: Google Analytics is set to delete both event data and user-level data after 14 months, and I see it only in aggregate. The cookies themselves expire on the timetable in the table above, or are deleted straight away if you withdraw consent.
• Session recordings: Contentsquare deletes a recording after 1 month, and the IP address it saw after 3 days. Recordings are not exported, and nothing is kept from them beyond what I have already changed on the site as a result.

Ask me to delete your enquiry sooner and I will, unless I'm legally required to keep it.

Your rights

Under UK GDPR you can ask me to:

• Give you a copy of the personal data I hold about you
• Correct it if it's wrong
• Delete it
• Restrict or stop processing it
• Provide it in a portable format
• Stop relying on legitimate interests, by objecting to that processing

You can also withdraw consent for analytics and advertising at any time, and you don't need to email me to do it: the Cookies link in the footer reopens the panel on any page. Withdrawing doesn't affect anything that was lawfully done before you withdrew.

Email harry@searchlucid.com and I'll respond within one month. There is no charge.

If you're unhappy with how I've handled your data you can complain to the Information Commissioner's Office at ico.org.uk/make-a-complaint, or on 0303 123 1113. I'd rather you raised it with me first so I can put it right.

Changes

If this notice changes materially, the date below changes with it. There is no archive of previous versions; if that matters to you, save a copy.

Last updated: 31 August 2026