Privacy
Privacy notice
This notice covers applications, contact messages, partner login, calls to our API and this website.
Last updated November 9, 2026
At a glance
- 12 monthsApplicationsThen removed from our form database.
- 90 daysContact messages and chatsYou can delete a chat yourself at any time.
- 90 secondsVisitor presenceAbout that long, held in memory and never saved.
- 7 daysRate-limit countersBuilt from hashed addresses, not raw ones.
- 180 daysSaved API tracesOnly if your account turns them on in writing.
- NoneAdvertising or analytics cookiesYour theme and login stay in local storage.
What we collect
Messages you send us
Every message includes your name, work email, company and, if you give it, your website.
It also tells us what you need (setup help, self-hosting, Lumbridge 1 access, your own models or the Factory), what you want to run, where models should run, your company size and when you want to start. Requests sent before November 2026 may instead hold the older questions: region, industry, team size, tools and hours, or what you were building, needs, contract status, revenue band and timeline.
We also collect contact messages and their submission details. Partner login uses your email and authentication session.
Chat
Website chat
If you use the chat, we store your messages, the page you started on, the name of the website that sent you, your device type, and the email you choose to give us. LumbridgeCorp staff read them and a person sends every reply.
We keep chats for 90 days after the last message, and you can delete a chat at any time from the chat window. Your browser keeps a chat key in local storage so you can come back to the conversation.
To limit abuse we keep a one-way hash of your IP address with the conversation. New messages are emailed to our team through Resend.
Presence
Visitors
While a page is open, your browser tells us which page you’re on, the name of the site that sent you and your device type, so we can see when someone is here. It goes with a random ID your browser keeps for this tab only. We hold this in memory for about 90 seconds and don’t save it.
We don’t save your IP address for this (a one-way hash of it is held in memory only, to stop abuse), and we don’t use cookies, analytics or advertising trackers.
Your choices
Do Not Track and Global Privacy Control
If your browser sends either signal, it doesn’t report visits to us at all. Chat still works.
Processors
Where it goes
Requests are stored in our self-hosted Supabase service. Resend processes email notifications so we see new requests.
These services process website data for us. Please do not include passwords, access keys or other sensitive information in forms.
API
Calls to our API
For each call to our API we keep usage records: the account and key, the model, token counts, cost, timing and errors. We use them for billing, limits and keeping the service running.
We do not keep the content of your calls unless your account turns on saved traces in writing. Saved traces train only your own edition and are deleted after 180 days. No model is trained on your calls without that written OK.
Calls are processed on cloud GPU infrastructure we rent to run our API. Usage records live in our self-hosted Supabase service.
Retention
How long we keep it
Our form database keeps applications for 12 months and contact messages for 90 days after submission. Rate-limit counters are removed after 7 days.
Partner accounts last while the partnership lasts; you can request deletion. Copies sent by email may remain in our company mailbox or with our email provider; they are not covered by that database cleanup.
Storage
In your browser
Login sessions and your theme preference are stored in your browser’s local storage. We do not use advertising or analytics cookies.
Safeguards
Abuse prevention
We use request identifiers to avoid duplicate submissions. Our form service uses a hashed network address and email address for rate limiting rather than storing your raw IP address with your request.
Hosting infrastructure may process network addresses in normal access logs.
Standards
Accessibility
We aim to meet WCAG 2.2 AA. If something on this site doesn’t work for you, email hello@lumbridgecorp.com.
Contact
Questions or deletion
Email us with questions or deletion requests.